Overview

overview

8

Static

static

3

Madium-Boo...er.exe

windows10-2004-x64

6

Madium-Boo...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    712s
  • max time network
    716s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-ja
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 04:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Madium-Bootstrapper.exe
  • Size 6.9MB
  • Sample260731-e24enatfqf
  • SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 31 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 4 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 21 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 24 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 16 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:4228
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4228.800.3421295062798747910 /pfhostedapp:7b930c8dc27723e57afcef5e9e03e4f46e9fd6af
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:3004
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView /prefetch:4 /pfhostedapp:7b930c8dc27723e57afcef5e9e03e4f46e9fd6af --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x164,0x7fff47df5fd8,0x7fff47df5fe4,0x7fff47df5ff0
        3⤵
          PID:3616
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1668,i,5132412697307053098,14795790971481060118,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:7b930c8dc27723e57afcef5e9e03e4f46e9fd6af
          3⤵
            PID:2424
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1668,i,5132412697307053098,14795790971481060118,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:7b930c8dc27723e57afcef5e9e03e4f46e9fd6af
            3⤵
              PID:6080
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2472 --field-trial-handle=1668,i,5132412697307053098,14795790971481060118,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:7b930c8dc27723e57afcef5e9e03e4f46e9fd6af
              3⤵
                PID:3300
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=ja_JP" --mojo-platform-channel-handle=3496 --field-trial-handle=1668,i,5132412697307053098,14795790971481060118,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:7b930c8dc27723e57afcef5e9e03e4f46e9fd6af /prefetch:1
                3⤵
                  PID:2596
              • C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
                "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
                2⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies trusted root certificate store through registry
                • Modifies Control Panel
                • Modifies registry class
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:2080
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=ja-JP --accept-lang=ja-JP --mojo-named-platform-channel-pipe=2080.2204.11649877274125201558 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                  3⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of WriteProcessMemory
                  PID:1424
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7fff47df5fd8,0x7fff47df5fe4,0x7fff47df5ff0
                    4⤵
                      PID:4420
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1904 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                      4⤵
                        PID:5504
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                        4⤵
                          PID:5852
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1808 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                          4⤵
                            PID:3668
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=ja_JP" --mojo-platform-channel-handle=3408 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
                            4⤵
                              PID:5900
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3976 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                              4⤵
                                PID:4716
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4528 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                4⤵
                                  PID:4128
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4416 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                  4⤵
                                    PID:3836
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3764 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                    4⤵
                                      PID:5180
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4680 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                      4⤵
                                        PID:3772
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4720 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                        4⤵
                                          PID:1804
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4680 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                          4⤵
                                            PID:6716
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4608 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                            4⤵
                                              PID:2332
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4700 --field-trial-handle=1908,i,16805982732462378944,2156357745858557400,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                              4⤵
                                                PID:4436
                                            • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                              "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
                                              3⤵
                                              • Executes dropped EXE
                                              PID:4760
                                            • C:\Users\Admin\AppData\Local\Temp\madium-clients\bloxstrap\v2.11.3\Bloxstrap-v2.11.3.exe
                                              "C:\Users\Admin\AppData\Local\Temp\madium-clients\bloxstrap\v2.11.3\Bloxstrap-v2.11.3.exe" -quiet -nolaunch
                                              3⤵
                                              • Executes dropped EXE
                                              • Modifies registry class
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:6120
                                            • C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe
                                              "C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe" -quiet -nolaunch
                                              3⤵
                                              • Executes dropped EXE
                                              • Suspicious use of WriteProcessMemory
                                              PID:6980
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
                                                4⤵
                                                • Drops file in Windows directory
                                                • Enumerates system info in registry
                                                • Modifies data under HKEY_USERS
                                                • Modifies registry class
                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                • Suspicious use of FindShellTrayWindow
                                                • Suspicious use of WriteProcessMemory
                                                PID:7092
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2f0,0x2c8,0x7fff4510c188,0x7fff4510c194,0x7fff4510c1a0
                                                  5⤵
                                                    PID:7164
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,1894470361052170220,8955536703470739749,262144 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:2
                                                    5⤵
                                                      PID:5480
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2060,i,2797258076764039398,1726086366489884124,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:11
                                                      5⤵
                                                      • Downloads MZ/PE file
                                                      • System Time Discovery
                                                      PID:5140
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,8246178978720517314,9190424134096951148,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
                                                      5⤵
                                                        PID:5192
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,4284539046659240319,7489308048924305230,2097152 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                                                        5⤵
                                                          PID:2192
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3624,i,5251610357868859401,8090670690245477833,2097152 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
                                                          5⤵
                                                            PID:3296
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,7265302751924249721,12747682086630683799,2097152 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:9
                                                            5⤵
                                                              PID:4084
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,9194136312446246297,7655951476246448455,2097152 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
                                                              5⤵
                                                                PID:4344
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,1599036881217929048,9127765935189186063,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
                                                                5⤵
                                                                  PID:2548
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5232,i,933888311551158204,2391127004477300585,2097152 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
                                                                  5⤵
                                                                    PID:6252
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,7418288681857658455,8178231176507702753,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:14
                                                                    5⤵
                                                                      PID:6440
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,3689372703187029440,12269051665135646610,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:14
                                                                      5⤵
                                                                        PID:6492
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8655730170652338159,18046509586866369125,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                                                        5⤵
                                                                          PID:2212
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,8655730170652338159,18046509586866369125,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                                                          5⤵
                                                                            PID:6752
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,4914219435144664743,16793943629167076889,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
                                                                            5⤵
                                                                              PID:3384
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,8966294067391032206,12304737364399039716,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
                                                                              5⤵
                                                                                PID:4576
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=ja --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,8719672004300357896,9966704194875133018,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:14
                                                                                5⤵
                                                                                  PID:1660
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7048,i,15753769049789868573,18112685448340610043,2097152 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
                                                                                  5⤵
                                                                                    PID:2476
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,15813919151883299717,6243596104237062475,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:14
                                                                                    5⤵
                                                                                      PID:6204
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7364,i,13229788505646195191,13643162684167098825,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:14
                                                                                      5⤵
                                                                                        PID:936
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,6399248464182353478,13484353043935913218,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
                                                                                        5⤵
                                                                                          PID:6936
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6468,i,16319084099491293264,5849013397072930408,2097152 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:1
                                                                                          5⤵
                                                                                            PID:4152
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=ja --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,14398644733850732452,7245855538897327769,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
                                                                                            5⤵
                                                                                              PID:4532
                                                                                            • C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                              "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"
                                                                                              5⤵
                                                                                              • Executes dropped EXE
                                                                                              • System Location Discovery: System Language Discovery
                                                                                              PID:6988
                                                                                              • C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.ba\wixstdba.exe
                                                                                                "C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{9FD055D8-B759-4F8A-AB53-06CA399839B2} {4A427864-7E41-4A39-9281-F9358BE2D1C8}
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                PID:6444
                                                                                              • C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                "C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{16EFCBD1-0B90-49FE-A053-8F094FA63289} {AA7423B4-BF83-4883-A91B-9438B778E7C2} 6988
                                                                                                6⤵
                                                                                                • Executes dropped EXE
                                                                                                • Adds Run key to start application
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Modifies registry class
                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                PID:6476
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,6453069367537177355,18343996400414389065,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=1284 /prefetch:14
                                                                                              5⤵
                                                                                                PID:7116
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,8882405963402011110,11568586336549696107,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:14
                                                                                                5⤵
                                                                                                  PID:3696
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,445227416690712451,17463674082808765799,524288 --field-trial-handle=3056,i,2507905194642596980,12030713654344099166,262144 --variations-seed-version --mojo-platform-channel-handle=1268 /prefetch:14
                                                                                                  5⤵
                                                                                                    PID:6828
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                    5⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies data under HKEY_USERS
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                    • Suspicious use of SendNotifyMessage
                                                                                                    PID:1712
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fff4510c188,0x7fff4510c194,0x7fff4510c1a0
                                                                                                      6⤵
                                                                                                        PID:6268
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1556,i,17011790762156082918,2376929354608917490,262144 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
                                                                                                        6⤵
                                                                                                          PID:4848
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,17354488034077827653,17473337997043498202,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:11
                                                                                                          6⤵
                                                                                                          • System Time Discovery
                                                                                                          PID:6120
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,11597406701058019808,3402303067170852082,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
                                                                                                          6⤵
                                                                                                            PID:6028
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,623393021965350024,11700505078364462712,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:14
                                                                                                            6⤵
                                                                                                              PID:6440
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4452,i,623393021965350024,11700505078364462712,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:14
                                                                                                              6⤵
                                                                                                                PID:3384
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,16095914178656608146,14150941976906264953,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
                                                                                                                6⤵
                                                                                                                  PID:3328
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,7622977012495589326,14091000964220320274,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
                                                                                                                  6⤵
                                                                                                                    PID:4576
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,3060855278590186537,3534130980153172571,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
                                                                                                                    6⤵
                                                                                                                      PID:6176
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,16760927407562578441,10663934108294047711,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
                                                                                                                      6⤵
                                                                                                                        PID:2764
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8633180376316826567,15585308233836070369,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:14
                                                                                                                        6⤵
                                                                                                                          PID:2896
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14822686029044254056,582231504482780993,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
                                                                                                                          6⤵
                                                                                                                            PID:476
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=828,i,5979761368206407925,15303709029204658109,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
                                                                                                                            6⤵
                                                                                                                              PID:6956
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5084,i,11321405522318401866,459117380637131164,262144 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:10
                                                                                                                              6⤵
                                                                                                                                PID:1572
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,7808958520139088651,3237160289503864486,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
                                                                                                                                6⤵
                                                                                                                                  PID:6032
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1100,i,2345218596753853358,17606255105278760789,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
                                                                                                                                  6⤵
                                                                                                                                    PID:6236
                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=ja --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4192,i,8472430292664591554,6530696559251170921,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
                                                                                                                                    6⤵
                                                                                                                                      PID:4504
                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,9814927093472945510,9955598099992582688,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:14
                                                                                                                                      6⤵
                                                                                                                                        PID:4736
                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=ja --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,7921098740172568636,59649925655786110,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
                                                                                                                                        6⤵
                                                                                                                                          PID:5716
                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,17682082635744757925,7209306143520761549,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
                                                                                                                                          6⤵
                                                                                                                                            PID:5752
                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2956,i,5833023702477330578,8067311041081360459,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=1104 /prefetch:14
                                                                                                                                            6⤵
                                                                                                                                              PID:1284
                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5408,i,13752398294599077107,11576544043968275569,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
                                                                                                                                              6⤵
                                                                                                                                                PID:5892
                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3272,i,8760979252494227709,1790390580329178616,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:1
                                                                                                                                                6⤵
                                                                                                                                                  PID:3152
                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,4399060735710155173,229902622184414815,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
                                                                                                                                                  6⤵
                                                                                                                                                    PID:4576
                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,1440739070778595667,5659412243924118883,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
                                                                                                                                                    6⤵
                                                                                                                                                      PID:3168
                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=ja --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,6391382355645694515,18228410620761300687,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:14
                                                                                                                                                      6⤵
                                                                                                                                                        PID:5524
                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6728,i,8403262749297748903,13891348532151911076,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
                                                                                                                                                        6⤵
                                                                                                                                                          PID:6564
                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7100,i,3730465684883496645,13914963410313449649,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
                                                                                                                                                          6⤵
                                                                                                                                                            PID:612
                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,16645665973050184337,5996688782519019254,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
                                                                                                                                                            6⤵
                                                                                                                                                              PID:4000
                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6416,i,14846691828366022332,6864117011650955815,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
                                                                                                                                                              6⤵
                                                                                                                                                                PID:5972
                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5308,i,16516172548688401324,11749164958447003825,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
                                                                                                                                                                6⤵
                                                                                                                                                                  PID:6972
                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7336,i,17491144555614624359,15704179274532375903,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:1
                                                                                                                                                                  6⤵
                                                                                                                                                                    PID:7128
                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7076,i,852712647941657331,14886181958246298481,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
                                                                                                                                                                    6⤵
                                                                                                                                                                      PID:2012
                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7272,i,8494953405020555131,5318108125299743664,2097152 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=7292 /prefetch:1
                                                                                                                                                                      6⤵
                                                                                                                                                                        PID:3148
                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=ja --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,6096713962540423224,14565843078983805828,524288 --field-trial-handle=2260,i,17773024951934439601,11959847588299105628,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:14
                                                                                                                                                                        6⤵
                                                                                                                                                                          PID:6660
                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                                                                          6⤵
                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                          PID:5396
                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x240,0x2e0,0x7fff4510c188,0x7fff4510c194,0x7fff4510c1a0
                                                                                                                                                                            7⤵
                                                                                                                                                                              PID:6700
                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,13618785118221111886,1274006293432378298,262144 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
                                                                                                                                                                              7⤵
                                                                                                                                                                                PID:6428
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,13891845621646272681,9497542101132278043,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:11
                                                                                                                                                                                7⤵
                                                                                                                                                                                • System Time Discovery
                                                                                                                                                                                PID:5724
                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,5031449682642845622,10265868988557789216,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
                                                                                                                                                                                7⤵
                                                                                                                                                                                  PID:4304
                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,3836418889839598427,2105992039035670027,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
                                                                                                                                                                                  7⤵
                                                                                                                                                                                    PID:1824
                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=ja --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,3836418889839598427,2105992039035670027,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:14
                                                                                                                                                                                    7⤵
                                                                                                                                                                                      PID:6108
                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4948,i,5503388797101389606,14094500285292088205,2097152 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
                                                                                                                                                                                      7⤵
                                                                                                                                                                                        PID:3568
                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=ja --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,9952081323428303387,9418914101213747349,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
                                                                                                                                                                                        7⤵
                                                                                                                                                                                          PID:5600
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=ja --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,2152353860653142010,15100259049253794593,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:14
                                                                                                                                                                                          7⤵
                                                                                                                                                                                            PID:5536
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=ja --js-flags=--ms-user-locale=ja_JP --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5680,i,7961514185961233148,7387024899261619684,2097152 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:1
                                                                                                                                                                                            7⤵
                                                                                                                                                                                              PID:7112
                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,11853837750546440361,9820965975268759891,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
                                                                                                                                                                                              7⤵
                                                                                                                                                                                                PID:6884
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,2809309820198248410,6432892766914527484,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
                                                                                                                                                                                                7⤵
                                                                                                                                                                                                  PID:6672
                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=ja --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5260838577881322940,3260504768007242074,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
                                                                                                                                                                                                  7⤵
                                                                                                                                                                                                    PID:6120
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=ja --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,16386844760248041907,13460778805943570959,524288 --field-trial-handle=2276,i,8436528148308267550,18011427746907740375,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:14
                                                                                                                                                                                                    7⤵
                                                                                                                                                                                                      PID:6436
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe" -quiet -nolaunch
                                                                                                                                                                                              3⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                              PID:6772
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                          PID:3792
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:6400
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                            PID:6416
                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:2164
                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:3420
                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:4700
                                                                                                                                                                                              • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                • Modifies registry class
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                PID:2548
                                                                                                                                                                                                • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                  C:\Windows\System32\MsiExec.exe -Embedding BB049C772AD3AA2C207EDC764BE387E4
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:6204
                                                                                                                                                                                                • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                  C:\Windows\System32\MsiExec.exe -Embedding 884DFCA2347D72A4065C4466C80679C4
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:6716
                                                                                                                                                                                                • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                  C:\Windows\System32\MsiExec.exe -Embedding EF8699253EC3C9ADBE7F3CEC634D5F12
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:6384
                                                                                                                                                                                                • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                  C:\Windows\System32\MsiExec.exe -Embedding 8CC665BC754FF493FADF27E39E0C8705
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:6756
                                                                                                                                                                                                • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                  C:\Windows\System32\MsiExec.exe -Embedding 4519680C7B2FD3F835313BD9CFDDC755
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:6592
                                                                                                                                                                                                • C:\Windows\System32\MsiExec.exe
                                                                                                                                                                                                  C:\Windows\System32\MsiExec.exe -Embedding 8A20C4D24C480545DC8F9176156C38BF
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                  PID:3208
                                                                                                                                                                                              • C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                                                                                                                "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.runonce
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5012
                                                                                                                                                                                                • C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                                                                                                                  "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_10.0.10_(x64)_20260731053253.log"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                  • C:\Windows\TEMP\{DAE24153-D031-4BCF-81AD-80D5B86BAC50}\.ba\wixstdba.exe
                                                                                                                                                                                                    "C:\Windows\TEMP\{DAE24153-D031-4BCF-81AD-80D5B86BAC50}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{B3B91640-E040-4B63-AA1D-7CA324089DE5} {2C14E677-7ABF-4499-A444-A3013BEAAF26}
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                    PID:7124
                                                                                                                                                                                                  • C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                                                                                                                    "C:\ProgramData\Package Cache\{866BECDA-F284-473A-9E84-0CCE816BF06F}\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{912CC36A-56A0-425E-9AE4-B882FA2B4FCB} {7879FA82-71EF-42A5-B6E9-93F9BF01166C} 1704
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Adds Run key to start application
                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                    PID:4336
                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:2276
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Bloxstrap\Bloxstrap.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                  PID:3644
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:2624
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                                                                                                    PID:2524
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Froststrap\Froststrap.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Froststrap\Froststrap.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:6476
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Froststrap\Froststrap.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Froststrap\Froststrap.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                  PID:6496
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  • Checks whether UAC is enabled
                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                  PID:6408
                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=ja-JP --accept-lang=ja-JP --mojo-named-platform-channel-pipe=6408.3168.14416161025723775210 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                    PID:4620
                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x164,0x1c8,0x7fff47df5fd8,0x7fff47df5fe4,0x7fff47df5ff0
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:6096
                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1884 --field-trial-handle=1892,i,16829058660376469935,12434033597238818639,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4852
                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3032 --field-trial-handle=1892,i,16829058660376469935,12434033597238818639,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4236
                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3176 --field-trial-handle=1892,i,16829058660376469935,12434033597238818639,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:6600
                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=ja_JP" --mojo-platform-channel-handle=3524 --field-trial-handle=1892,i,16829058660376469935,12434033597238818639,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:2072
                                                                                                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:2204
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Madium\Bin\Loader.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Madium\Bin\Loader.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:4124
                                                                                                                                                                                                            • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                              C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                              PID:1068
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Checks whether UAC is enabled
                                                                                                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                              PID:6396
                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=ja-JP --accept-lang=ja-JP --mojo-named-platform-channel-pipe=6396.6496.1432236283682822514 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                PID:2780
                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x164,0x170,0x7fff47df5fd8,0x7fff47df5fe4,0x7fff47df5ff0
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:4192
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1788,i,8516901771706763808,7001524055764138423,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3244
                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=ja --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1788,i,8516901771706763808,7001524055764138423,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:260
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=ja --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2776 --field-trial-handle=1788,i,8516901771706763808,7001524055764138423,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4000
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=ja --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=ja_JP" --mojo-platform-channel-handle=3536 --field-trial-handle=1788,i,8516901771706763808,7001524055764138423,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:5448
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2960
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe"
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:6084
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe"
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:6588
                                                                                                                                                                                                                      • C:\Windows\system32\taskmgr.exe
                                                                                                                                                                                                                        "C:\Windows\system32\taskmgr.exe" /4
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Checks SCSI registry key(s)
                                                                                                                                                                                                                        • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                        • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                        PID:2596
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe"
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:464
                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:6604
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe"
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:4460
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe"
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:2956
                                                                                                                                                                                                                        • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                                                                                          \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:5204
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:7048
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:5140
                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:3504
                                                                                                                                                                                                                              • C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
                                                                                                                                                                                                                                "C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                PID:4848
                                                                                                                                                                                                                              • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                                                                                                \\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:4140
                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                                  PID:3020
                                                                                                                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                  • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                    C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                    PID:464
                                                                                                                                                                                                                                  • C:\Windows\System32\SecurityHealthHost.exe
                                                                                                                                                                                                                                    \\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:1708

                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          e5e859c.rbs
                                                                                                                                                                                                                                          • Path C:\Config.Msi\e5e859c.rbs
                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                          • SHA256 3d7c99d5ad0d383030c520f33b182b7e3a17a4d0aa1a6997aeceeccda67fdb0c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          e5e85a3.rbs
                                                                                                                                                                                                                                          • Path C:\Config.Msi\e5e85a3.rbs
                                                                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                                                                          • SHA256 03abf5aa462b60ef4f3b07ddae6d4b6ec62fc715ebeca8ac97094e3d7a2e7dfa
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          e5e85a8.rbs
                                                                                                                                                                                                                                          • Path C:\Config.Msi\e5e85a8.rbs
                                                                                                                                                                                                                                          • Size 49KB
                                                                                                                                                                                                                                          • SHA256 d62739bf79d3a38eeb2d0ef116de9ca7dfc7f071e0ada05eabbc1a02b6fe8285
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          e5e85ad.rbs
                                                                                                                                                                                                                                          • Path C:\Config.Msi\e5e85ad.rbs
                                                                                                                                                                                                                                          • Size 71KB
                                                                                                                                                                                                                                          • SHA256 aafbee329a9a6bc56cf063b7aa119e69320075573830a55954e22df3bc60bd31
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          e5e85b1.rbs
                                                                                                                                                                                                                                          • Path C:\Config.Msi\e5e85b1.rbs
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 2ac5d6f534eec31e58023341c20f7d4b8ab78f0c90e51af1c1a5c07d1896b695
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          e5e85b4.rbs
                                                                                                                                                                                                                                          • Path C:\Config.Msi\e5e85b4.rbs
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 9d6c13b45e500134a6d28ddd81d8f20c9444da12170b242098a5cac84fdf6349
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ThirdPartyNotices.txt
                                                                                                                                                                                                                                          • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
                                                                                                                                                                                                                                          • Size 77KB
                                                                                                                                                                                                                                          • SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          dotnet.exe
                                                                                                                                                                                                                                          • Path C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                          • Size 163KB
                                                                                                                                                                                                                                          • SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Settings.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Bloxstrap\Settings.json
                                                                                                                                                                                                                                          • Size 696B
                                                                                                                                                                                                                                          • SHA256 cf435f67b67d1e06baffecc06806074423c38c75c052f5f304ad732106ce94e3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          RobloxPlayerBeta.dll
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-145f189a6a974303\RobloxPlayerBeta.dll
                                                                                                                                                                                                                                          • Size 21.2MB
                                                                                                                                                                                                                                          • SHA256 269af4ce0111e647c0a7ca5d7f1e29d769c880fd6394bf03f8a368e5c34761b8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Madium.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
                                                                                                                                                                                                                                          • Size 13.5MB
                                                                                                                                                                                                                                          • SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          luau-lsp.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                                                                                                          • Size 16.1MB
                                                                                                                                                                                                                                          • SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          editor.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
                                                                                                                                                                                                                                          • Size 426B
                                                                                                                                                                                                                                          • SHA256 6aa74a67c01373cfb79483dcdb9c330512518458df91128ec8501d3f1612ae84
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ui.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                                                                                                          • Size 34B
                                                                                                                                                                                                                                          • SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ui.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                                                                                                          • Size 35B
                                                                                                                                                                                                                                          • SHA256 61f3ed23a2be21fb973f6b5a8f84295085120ee3c98775c415e6ff10234b3baf
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ui.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                                                                                                          • Size 39B
                                                                                                                                                                                                                                          • SHA256 1d7d4e09ef38b5ee654d44295fe4a38173381dc595a4543f565685d757e3e634
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ui.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                                                                                                          • Size 37B
                                                                                                                                                                                                                                          • SHA256 cef88d0bd38288c97f86a5235aff7497714fb1b48e31de35e84d58dea5eac43c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ui.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                                                                                                          • Size 37B
                                                                                                                                                                                                                                          • SHA256 7c6552729881310751b8081e5b1eed41704070f949ed09114fd50c3a104df1f0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ui.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                                                                                                          • Size 36B
                                                                                                                                                                                                                                          • SHA256 432b1b0905da045cf89763944864a902757ad3a16fa38c49e2ce9eb97a29fd9c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ui.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                                                                                                          • Size 36B
                                                                                                                                                                                                                                          • SHA256 c8d89df060705d2971c39f7338698d24d0e0ecb3f7537e9f541cb66fb2fbea20
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          docs.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
                                                                                                                                                                                                                                          • Size 44KB
                                                                                                                                                                                                                                          • SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 fa6df2b3c9273c88f7b69d982314b05fcd10d58532c388e1d3461c1530ec4afb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 50a85785943d7ce03ff233b6597c427a5f6ae58bf4e8d873acc07a6412e67db7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 fe428304580c02206a3268cf080b219777fccb0d42c255eafbc9920813cbe332
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 c80195d2f00a86ad88f5cb4766cd2dfcaee9e20456f8633ddd7dd6d659f4e437
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 f6d994a4e37c9d12802fb74ad0501d50527ceb3065b2de06ac16d45849fec264
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 962294fda71e25918574221d99b5634fddc52984f0789d2f27afc03988c25b43
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          6b9129a6-fb59-49c4-87e2-2c5a6b69cc71.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\6b9129a6-fb59-49c4-87e2-2c5a6b69cc71.tmp
                                                                                                                                                                                                                                          • Size 5KB
                                                                                                                                                                                                                                          • SHA256 17c07026819f1977c679fcb6f58eac385283ab4e47317427fd0f5ac9009a8a4b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          data_0
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Cache\Cache_Data\data_0
                                                                                                                                                                                                                                          • Size 44KB
                                                                                                                                                                                                                                          • SHA256 81ef5316c6756ee1efc5949a8b1b172da28963f64ae465b756287e618fb2b1f6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 360B
                                                                                                                                                                                                                                          • SHA256 1aa18fd298f31e44a355f17b53edcc9208183feb723fd64fd93529a2b14b3a21
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 360B
                                                                                                                                                                                                                                          • SHA256 808457dece75e44ad1ce5ea4deb4ad1acfeaf2d022921dd993bed7dafaaca1b2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 240B
                                                                                                                                                                                                                                          • SHA256 93c81628cfb04b30c679b878ac94eeecb2984003d10cdb60593b88eb081b7576
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index~RFe59d7a9.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d7a9.TMP
                                                                                                                                                                                                                                          • Size 48B
                                                                                                                                                                                                                                          • SHA256 413e4965f57dc6ac64472ca547875e032cb0ab6cd394f4372269ce469d926b90
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\wasm\index
                                                                                                                                                                                                                                          • Size 24B
                                                                                                                                                                                                                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          ExtensionActivityComp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\ExtensionActivityComp
                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                          • SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 739d6f62ee6521f14f28b018f98f5b9a39dab78ec9fc9e725dfa5bac1026c108
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 eeea4351cfbbb265fc34f262943eae02cc5c341280e401b03b7edfc36fc15e6c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 2984e61e2f06c279b7193493f11fb9ea9865deda59ea3c3c7a1f096fe080d361
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 f75a9f1721a88d4a7ccb66760d9da9a3ceb8f6354d3c78b14f84474445160dbe
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 4a6ce14b3170f93536889c469ec10b24fd5542878cde4e5c8e33e37636862fab
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State~RFe5a9a4d.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State~RFe5a9a4d.TMP
                                                                                                                                                                                                                                          • Size 59B
                                                                                                                                                                                                                                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 522B
                                                                                                                                                                                                                                          • SHA256 91c6f4290338a7ac4a0ef5f0b2ffec6107e0c4b2d1c0d27ffdc950922254191e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 522B
                                                                                                                                                                                                                                          • SHA256 28d50419b9616ba98de6a93673553a51992cc2bff51b43b4d724e74450ff92cd
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 522B
                                                                                                                                                                                                                                          • SHA256 bb056b35c6c5aa5caa4593d9fed321b5258288cabf35fe5440dd386a3a9dbb0a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity~RFe5c384e.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity~RFe5c384e.TMP
                                                                                                                                                                                                                                          • Size 352B
                                                                                                                                                                                                                                          • SHA256 73748a9180b743aae2d7d6a41be12a308a531b2d34ad7ad42e34ad614f91a998
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 28d7d130257e6ecf79bbef0d047d5f813716b4eda26f662a2740f68902bf055d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 81d3b9e64eda3e679d745d5ef41ebd57d53298a36607d2cc4e75712e0758acf6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 427e835bb11357000b9b0eefb301126de7d7d6bff24e310be73dc892b176e2fa
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 87a0e94f64688fa665f701e9f4cc0554a3666731877f1d4606ad7df0133b66d6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
                                                                                                                                                                                                                                          • Size 6KB
                                                                                                                                                                                                                                          • SHA256 2bd1e14c01a6fa3c0650d3339527518f781de8255c7b49389e4b9896df466641
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 d6f5d7ee83fe17ad70daba168230f973d8df2148bb97f01ceaab57aeca4aa402
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 ee5b57db4605408784ddb5d8a51cb690e4c4d653b6393a7f5cfcd7be4f8b4ec0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 2b75f50c9cdfeed3ff442cd99c52f08b3b91e7cc9df481cc94e4161f5c0c5a7e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 928c0314c6daf50431e82254f1a3ae454a3912fd25266a4407f0997e8aa32295
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 15KB
                                                                                                                                                                                                                                          • SHA256 1122fe2c0fcea711d30ec337389e5ae0dab5f10b08f223d83eda43d4c13dec1f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 d19e875d9d07a7a04ce84b4c49a144979bc65786aefbb9d0c27dc5c3d71b44c9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 6b2f5334fea5fcf9b5fda41ff8e64802458bcb9b45aa69bd0aa5e7c0e11e3566
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 ef2b8f955b377f5ae73d610bca4dd73247655013bdf840307d0116b754a6c9b7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 18KB
                                                                                                                                                                                                                                          • SHA256 dce584c8e696e15ddff457ad3727124ffa992f7b5d1b6d3e4ff9e4f79cda7854
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 18KB
                                                                                                                                                                                                                                          • SHA256 af66c2f8039b991a81b7da5646cf3c4f13442b0977278686dcfe15fe6660435a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 18KB
                                                                                                                                                                                                                                          • SHA256 8b80ebcd5b5f8202c0956b798caf86532943c9ab5eecf2d51907ef83e6eb388a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 fc10580e3bccd80487a111f8a27d8ab3fe5f0815f96054e427c811f775e57612
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 d630606b50632600e770dd2f1bf7854fb777d66f7e1a7055a86231ab929ce856
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 8e4fe70def33f58621232635cdba9a663820c0f9406f3ec0e4f73c211c75b8a4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 17KB
                                                                                                                                                                                                                                          • SHA256 3d685658d547846b26fe7737517808e90d068f8e70fb783c56045f24c98060cf
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State~RFe597e2f.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe597e2f.TMP
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 0f37d78f9d072665037e41ff11fcfae5f12e89ff416b3b0e838f8b35ca3cedf8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Variations
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Variations
                                                                                                                                                                                                                                          • Size 86B
                                                                                                                                                                                                                                          • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Variations
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Variations
                                                                                                                                                                                                                                          • Size 85B
                                                                                                                                                                                                                                          • SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 2923c1222ce49db187e097dafa5245e107880e380c2d4c3c042ec4c5e21d98bb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 f81ad08001e04e7d561cb1fb2b29eb617ac6ea05a91aae10672c24fe7e0c8f2c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 0372820d6ba590b23db1292759f9157f67a9578dd814bcb808696b1045894e61
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          59ba144d-bd09-40c5-86d1-fc68d93f916b.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59ba144d-bd09-40c5-86d1-fc68d93f916b.tmp
                                                                                                                                                                                                                                          • Size 6B
                                                                                                                                                                                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          LOG.old
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                                                                                                                                                                          • Size 334B
                                                                                                                                                                                                                                          • SHA256 e2117e67e6a334dd4a54c7300adbe141a68d21c8e0d7979845fcf94617129dc8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_0000ba
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ba
                                                                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                                                                          • SHA256 c61d7fc4f7772d0dfe6a49202dc20efd9aab79c210cc80df67f24c539679c659
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_0000bd
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd
                                                                                                                                                                                                                                          • Size 60KB
                                                                                                                                                                                                                                          • SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_0000be
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be
                                                                                                                                                                                                                                          • Size 68KB
                                                                                                                                                                                                                                          • SHA256 47d91cd0bf170ab1972a0777e1051fe5ee2a840a1d9efbeb0097e338228a8888
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_0000bf
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
                                                                                                                                                                                                                                          • Size 19KB
                                                                                                                                                                                                                                          • SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_0000c0
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
                                                                                                                                                                                                                                          • Size 63KB
                                                                                                                                                                                                                                          • SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_0000c1
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
                                                                                                                                                                                                                                          • Size 28KB
                                                                                                                                                                                                                                          • SHA256 6672e6a25ff27fb35f4a259d660959bd5581382a5e6d82f386379ebd3f285637
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_0000c9
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
                                                                                                                                                                                                                                          • Size 204KB
                                                                                                                                                                                                                                          • SHA256 35810c75309f4472d74efa074ee0a14f2029b333ab5d44ebdac18186acd04f8f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          f_0000f4
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f4
                                                                                                                                                                                                                                          • Size 331KB
                                                                                                                                                                                                                                          • SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          temp-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 6f5eb7c243874cad02c8caf49d333902322a9b08b94214017d16cec842ef3eca
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          temp-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                                                                                                                                                                          • Size 7KB
                                                                                                                                                                                                                                          • SHA256 fc62cf2c0623844f2ba34f654db167ae338f1ca25f41a3f1f13aa1da4bc6cb05
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 40405b219c17153524d37019b81aa2502b9ff59b83f853cb0d55a481f77d8169
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index~RFe5e8a5c.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5e8a5c.TMP
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 7e87460fa8c1cefb75546054369a8e17221184715b9a0efb1890f9c51a1bcca0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          SiteList-Enterprise.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Edge Profile.ico
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                          • Size 70KB
                                                                                                                                                                                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          8e3d3708-2acb-4fbf-be26-f6f1b351c4c6.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e3d3708-2acb-4fbf-be26-f6f1b351c4c6.tmp
                                                                                                                                                                                                                                          • Size 40B
                                                                                                                                                                                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 3eb7d3d83aba70ab9e7ccf38ffa89837cb09837e1df3a179f704a9a60dd1d1ae
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Network Persistent State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                          • SHA256 e4dd78ef9117c86449d81b62d97e30c09e451b1636172909e458fbe37b70ce2f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Sdch Dictionaries
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                          • Size 211B
                                                                                                                                                                                                                                          • SHA256 42a271bf2390f23144014711b0f76dc830e84fff9e85eb6f3b4769842a014e7e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          TransportSecurity
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 52812a83f101776746613686e1d38fffe02c71f96e797b2b29aa83fdd5031237
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 21KB
                                                                                                                                                                                                                                          • SHA256 55870bee4711ad07442a0ffbb5c3e3770fb5e14f1e70cc9b2cd17d94a457397d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                          • SHA256 1d1d2b4bd59285e02f092c8e475b33b8062612fa9354c09562a4faf8e3684b68
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                          • SHA256 715ee86f62967f1231c85bad00d82f6955ee221a74e5e27586c9fb70bc5d6a49
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 18KB
                                                                                                                                                                                                                                          • SHA256 8b82b67923908acd4dde52c344a2a04ff22f8ed014d88c7ee0af6ca42b2a6751
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                                                                          • SHA256 34f6925c8cce0ae25683ae34e4902b57c3d8b37e1a78ec4863e13dbaa3374987
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 12KB
                                                                                                                                                                                                                                          • SHA256 d48139129778f157b3008ca2307e6184a90a467b45ec325477af9ce97de3b0e0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 23KB
                                                                                                                                                                                                                                          • SHA256 efd0ea26405cf63ceaeb192363edf7861670926734786475cbcb0865c56b758e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 13KB
                                                                                                                                                                                                                                          • SHA256 dfb4ec72137972b4b092d7df5de18041c036fd3c8a733c0f89b0ed28216ee1b4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                          • Size 24KB
                                                                                                                                                                                                                                          • SHA256 958a0fdeadc319be0cf711ad19140000ffb88cb30aa87086ca0572940732fbd4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Secure Preferences
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                          • Size 27KB
                                                                                                                                                                                                                                          • SHA256 e2960556684c2e099c8ea6a47224e54963dadb06d9f80b9998c7386a96c8ce26
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0b9f9a76-8079-4131-acfe-5689ffab2e61\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 336B
                                                                                                                                                                                                                                          • SHA256 59dabe9f8b5b3975f4370f9194722cc2ce732e75a787f29aab9a572fba4ab2d9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0b9f9a76-8079-4131-acfe-5689ffab2e61\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 e53d0d9488fedfa96e7d98915719a0b53e499d139a85ed1eafbe396d37372eb3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index~RFe625ffd.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0b9f9a76-8079-4131-acfe-5689ffab2e61\index-dir\the-real-index~RFe625ffd.TMP
                                                                                                                                                                                                                                          • Size 336B
                                                                                                                                                                                                                                          • SHA256 4296442a3f3862897b8ce776afe61da03b43e183d98da58c28420cd68e26a220
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b2773-6899-4787-9751-b3c8e62d3eab\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                                                          • SHA256 e6584187b6d94158bef36dfa5d7d046e53a090fc044ba6cecfb016e0f908dfb2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b2773-6899-4787-9751-b3c8e62d3eab\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                                                          • SHA256 594482a6fb16739e8f8f893727ecce1b509fd2f69e4a4446de56970ebe8594c3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index~RFe630c3a.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\656b2773-6899-4787-9751-b3c8e62d3eab\index-dir\the-real-index~RFe630c3a.TMP
                                                                                                                                                                                                                                          • Size 48B
                                                                                                                                                                                                                                          • SHA256 ad940b7e5909775c67b1adbd9f61f8cd7c84c075f04b029041042472d06505ec
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af7afd3a-2a01-471e-986e-2c900ab96b35\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                                                          • SHA256 1c0ff08c5674c6829e9b45ea535a4455e0a82ca913162b5311b64d6d47d7a9d1
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\af7afd3a-2a01-471e-986e-2c900ab96b35\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                                                          • SHA256 bc63a3a37ea39d56ea32a4cad2de281bb2158f5ed06440d08223d04617c1e534
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          10d4aa211d6a6f1e_0
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\10d4aa211d6a6f1e_0
                                                                                                                                                                                                                                          • Size 62KB
                                                                                                                                                                                                                                          • SHA256 3cf56a2a39a82c4b3aa1d9b09f99b2a3dce94acf0a64766beb4cec22ca77e0c2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 96B
                                                                                                                                                                                                                                          • SHA256 855d7bd4483d013bcdc1821e1c4b0bdbfaf32173308bb90243eb3ea887f2a19e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 96B
                                                                                                                                                                                                                                          • SHA256 c6db3ea669d0456b38a54fa20d113f77d429ea1dd4ac2bb7c3765027cb84bd4f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c944588f-74e1-42da-b6ba-10071240ad2a\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 96B
                                                                                                                                                                                                                                          • SHA256 d90062fdf17abfb42dbe0e1e4b773307a2fc753d12483a5078eab4631545d511
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                                          • Size 476B
                                                                                                                                                                                                                                          • SHA256 b2caf034ba00fa18ca00bfd2b9355d58fa160f80597060dceddafe37c06aba3e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                                          • Size 481B
                                                                                                                                                                                                                                          • SHA256 83399fed15552c6147890103eaaa0fff9998ffd8d85182b8344f11345cf9e853
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          index.txt
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                                                                                                                                                          • Size 476B
                                                                                                                                                                                                                                          • SHA256 7dc1c4699dbf6d0fa69c2f3c10e3b7bc73a4f321af9d31fdffdd881f4e0746b9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 96B
                                                                                                                                                                                                                                          • SHA256 08166109b73a7bd8a5611526d4357e5aa51a44dcf666469b68436b294baeb9f6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                          • Size 72B
                                                                                                                                                                                                                                          • SHA256 3a63774522ed161c56649223b208262808a92e27ba49b6b648127d38e084de9c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          the-real-index~RFe62b36c.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe62b36c.TMP
                                                                                                                                                                                                                                          • Size 48B
                                                                                                                                                                                                                                          • SHA256 e14797fe8e0f635901b2f86179388894f6212bfff4b9bbfeb09f20b104f4bcb9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          sync_diagnostic.log
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                          • Size 4KB
                                                                                                                                                                                                                                          • SHA256 11a5bfdc0c69da67e9e2a85fea6a0301b50d7910f52dcf50038bcb3f4223171a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          b1cbb76c-d602-4b72-8b40-75d193698b89.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b1cbb76c-d602-4b72-8b40-75d193698b89.tmp
                                                                                                                                                                                                                                          • Size 414B
                                                                                                                                                                                                                                          • SHA256 ab4d96a6528cc2ff57cc3044e779c9bc0294b4d6f3dd3ecfea4846a6a498a727
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          fce5e907-a908-4ffa-a0ed-f7c3645d518d.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fce5e907-a908-4ffa-a0ed-f7c3645d518d.tmp
                                                                                                                                                                                                                                          • Size 14KB
                                                                                                                                                                                                                                          • SHA256 13dcae253c57d10f5a5c3783e235e88a6fd907269ab0302ba73f2a4668c3ac53
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          245fb37c-2e9d-42af-8d07-0e2c6790b82f.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\245fb37c-2e9d-42af-8d07-0e2c6790b82f.tmp
                                                                                                                                                                                                                                          • Size 22KB
                                                                                                                                                                                                                                          • SHA256 ca3573f877bb4aef5680546f2c45bbc734e3831cc2ee148aafc8bfe09c32599a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 41KB
                                                                                                                                                                                                                                          • SHA256 e3e34ac198bc42b2c1a8de8e3ed04519e5084fb1e14b2b95f4f15cc8d5e4724c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 38KB
                                                                                                                                                                                                                                          • SHA256 6fc55d07b667c62e8fbce71bd68e5a516fd61098e214d54546fd9f696037f972
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 35KB
                                                                                                                                                                                                                                          • SHA256 4e5c376deed679bd1e11da390f76c27fce30435761aabc24aed6d5a6c1334dc2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 35KB
                                                                                                                                                                                                                                          • SHA256 f80efcc5cbfd9c78c1d924ef0ab71bfab476601e63a6ce711ad4127f39bd99e0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 35KB
                                                                                                                                                                                                                                          • SHA256 021b37da59e783779630f1634f46599aff8697016f7e73f80749ef4ad0e8c9f6
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 38KB
                                                                                                                                                                                                                                          • SHA256 f306f389708ffe520a0a63b8001bae23d1801571f111c33fa091fef72f63b9b3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 41KB
                                                                                                                                                                                                                                          • SHA256 f634a763e4a1e21ca219e00a5307bbadd6a6dfc34cb35a3cdfdb9071472310e8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 38KB
                                                                                                                                                                                                                                          • SHA256 11c3559c900410d0b0b2c1ca066ff9b877104746a454c3a71946ecde2a05f680
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 40KB
                                                                                                                                                                                                                                          • SHA256 b01154810613be1c37964f25ccf9f19d88f16d34c7ca8e27326f9fc6efe08111
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                          • Size 33KB
                                                                                                                                                                                                                                          • SHA256 3e3ae487bdb0692d84ae5485c6cee98b285eeb407e22194c56881b243e761081
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          RevisitationBloomfilter
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                                                                          • SHA256 09baac1cdff1339259d3b8593db5b5c23e2f13cdb982ddeae1d8b2cd6fb51b63
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          RevisitationBloomfilter
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                                                                          • SHA256 6a56b738ef3012d7b2e5638d05abfe83ac5ce03034d7c5d622ce86f2520c43a0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          RevisitationBloomfilter~RFe62c7af.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe62c7af.TMP
                                                                                                                                                                                                                                          • Size 392B
                                                                                                                                                                                                                                          • SHA256 64ad296e8af197bd982b6c50ff4d2892ef058094aad5b51170ff5130139ecf1c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 252B
                                                                                                                                                                                                                                          • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 612B
                                                                                                                                                                                                                                          • SHA256 918167fab0fb4435546513252415c1a2e44b6e8e60caf6f31d07587ba0a71ab0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 972B
                                                                                                                                                                                                                                          • SHA256 6bbc409c6c8e5287723de210e3463bc9873d0adfd3542a753ad8169fa6342edd
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 732B
                                                                                                                                                                                                                                          • SHA256 cf5e5467ab3de71fcb419acbbb754c3effd5e787864ffa7c767f24ff9bbe5ae3
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 492B
                                                                                                                                                                                                                                          • SHA256 55aa4ab756834699189543863036551542c61249184224f927d1681ef15164dd
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 0f4851d2d08fedaaf8104a0fbdc543c6f5a7c82fd67345db7d671b449362cfbb
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 852B
                                                                                                                                                                                                                                          • SHA256 51fa2add3b372e4d932d6926ca9be223a98d6ad3b63fcf099338f199d0a4ad28
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 372B
                                                                                                                                                                                                                                          • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                                                                                                          • Size 153KB
                                                                                                                                                                                                                                          • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                                                                                                          • Size 13B
                                                                                                                                                                                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          metadata.json~RFe5e5a34.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5e5a34.TMP
                                                                                                                                                                                                                                          • Size 132B
                                                                                                                                                                                                                                          • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          80cd96a3-80db-404e-839e-bf8dc518dde9.tmp
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\80cd96a3-80db-404e-839e-bf8dc518dde9.tmp
                                                                                                                                                                                                                                          • Size 1B
                                                                                                                                                                                                                                          • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 83885f9884b06b0f3a302fe3a2abecb433db518c51f2d87481df20f70be08409
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          settings.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                                                                                                          • Size 280B
                                                                                                                                                                                                                                          • SHA256 ddec82ef02c5bab5348e9c124119657820fcd97fd926f22890ff37ebbdd554ab
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          throttle_store.dat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                                                                                                          • Size 20B
                                                                                                                                                                                                                                          • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          SCT Auditing Pending Reports
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                          • Size 2B
                                                                                                                                                                                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          CURRENT
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Default\Site Characteristics Database\CURRENT
                                                                                                                                                                                                                                          • Size 16B
                                                                                                                                                                                                                                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          MANIFEST-000001
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                                                                                                                                                                                                                                          • Size 41B
                                                                                                                                                                                                                                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          data_0
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\GraphiteDawnCache\data_0
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          data_1
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\GraphiteDawnCache\data_1
                                                                                                                                                                                                                                          • Size 264KB
                                                                                                                                                                                                                                          • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          data_2
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\GraphiteDawnCache\data_2
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          data_3
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\GraphiteDawnCache\data_3
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 642c9e5d4b865467301a3ff35269e89f39f56b012b0d24775d2dddd4471153d1
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 334c07e7648aace00f235c1d81fd0fd81345ea79065b0c0ac0f156f9b45aee61
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Local State
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 22a6b2fda0f17e9ac2c36989af19eb7fe959452e0a909dd9cf97ff18ed2b4510
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Local State~RFe595cbc.TMP
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{E0215A89-8FDE-432E-A7EF-559EF58D3D32}\wv2\EBWebView\Local State~RFe595cbc.TMP
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 b13b20f8b21bf7b06e7b3c9a717b7aa20e46cd617efb8729d2c54fdf0c20755f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Bloxstrap-v2.11.3.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\madium-clients\bloxstrap\v2.11.3\Bloxstrap-v2.11.3.exe
                                                                                                                                                                                                                                          • Size 12.0MB
                                                                                                                                                                                                                                          • SHA256 4d423ad46d0bf43cd22c9c1b5d25167edc15e784a57e94f889f1eefb5ce238a0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Froststrap-v1.5.0.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe
                                                                                                                                                                                                                                          • Size 21.5MB
                                                                                                                                                                                                                                          • SHA256 9b97289dd8abcf8de40fb5f6d328ec7191c812b418511344c9eb0f5e60c74c93
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          content_new.js
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir7092_1218605574\CRX_INSTALL\content_new.js
                                                                                                                                                                                                                                          • Size 10KB
                                                                                                                                                                                                                                          • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Bloxstrap.lnk
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\Bloxstrap.lnk
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 a005659a9a2767c3fd91f0867761c9c33eaf470b7964b59930a92cd2887f7e3f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Madium.lnk
                                                                                                                                                                                                                                          • Path C:\Users\Admin\Desktop\Madium.lnk
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 ae0eed080e9e97567be246510e7f41a48c926454dd4bed4ab10c125bbc54f22c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          MSI8BC6.tmp
                                                                                                                                                                                                                                          • Path C:\Windows\Installer\MSI8BC6.tmp
                                                                                                                                                                                                                                          • Size 392KB
                                                                                                                                                                                                                                          • SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          e5e8599.msi
                                                                                                                                                                                                                                          • Path C:\Windows\Installer\e5e8599.msi
                                                                                                                                                                                                                                          • Size 1012KB
                                                                                                                                                                                                                                          • SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          e5e85a5.msi
                                                                                                                                                                                                                                          • Path C:\Windows\Installer\e5e85a5.msi
                                                                                                                                                                                                                                          • Size 28.2MB
                                                                                                                                                                                                                                          • SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          hyph-bn.hyb
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2016549790\hyph-bn.hyb
                                                                                                                                                                                                                                          • Size 703B
                                                                                                                                                                                                                                          • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          hyph-mr.hyb
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2016549790\hyph-mr.hyb
                                                                                                                                                                                                                                          • Size 687B
                                                                                                                                                                                                                                          • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          hyph-nn.hyb
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2016549790\hyph-nn.hyb
                                                                                                                                                                                                                                          • Size 141KB
                                                                                                                                                                                                                                          • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Staging
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1424_2115643157\Mu\Staging
                                                                                                                                                                                                                                          • Size 36B
                                                                                                                                                                                                                                          • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1210348273\manifest.json
                                                                                                                                                                                                                                          • Size 135B
                                                                                                                                                                                                                                          • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          protocols.json
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1210348273\protocols.json
                                                                                                                                                                                                                                          • Size 3KB
                                                                                                                                                                                                                                          • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          crl-set
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1749261791\crl-set
                                                                                                                                                                                                                                          • Size 22KB
                                                                                                                                                                                                                                          • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1749261791\manifest.json
                                                                                                                                                                                                                                          • Size 113B
                                                                                                                                                                                                                                          • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          verified_contents.json
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1895092607\_metadata\verified_contents.json
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 c50e8b66b9c681cbc2fa16cb2d8fd7cc934df1a7863dcf4f0ebedf6a5b78638d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          keys.json
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1895092607\keys.json
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          manifest.json
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_1895092607\manifest.json
                                                                                                                                                                                                                                          • Size 79B
                                                                                                                                                                                                                                          • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          LICENSE
                                                                                                                                                                                                                                          • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1712_733423479\LICENSE
                                                                                                                                                                                                                                          • Size 1KB
                                                                                                                                                                                                                                          • SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          thm.wxl
                                                                                                                                                                                                                                          • Path C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.ba\1041\thm.wxl
                                                                                                                                                                                                                                          • Size 8KB
                                                                                                                                                                                                                                          • SHA256 000e1508d9bacb7156951988ba1d6dc36165facd2163352a93b9a66e8c642089
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          BootstrapperApplicationData.xml
                                                                                                                                                                                                                                          • Path C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.ba\BootstrapperApplicationData.xml
                                                                                                                                                                                                                                          • Size 9KB
                                                                                                                                                                                                                                          • SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          DotNetLogo_256x.png
                                                                                                                                                                                                                                          • Path C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.ba\DotNetLogo_256x.png
                                                                                                                                                                                                                                          • Size 2KB
                                                                                                                                                                                                                                          • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          dotnet.ico
                                                                                                                                                                                                                                          • Path C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.ba\dotnet.ico
                                                                                                                                                                                                                                          • Size 44KB
                                                                                                                                                                                                                                          • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          thm.xml
                                                                                                                                                                                                                                          • Path C:\Windows\TEMP\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.ba\thm.xml
                                                                                                                                                                                                                                          • Size 11KB
                                                                                                                                                                                                                                          • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          wixstdba.exe
                                                                                                                                                                                                                                          • Path C:\Windows\Temp\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.ba\wixstdba.exe
                                                                                                                                                                                                                                          • Size 431KB
                                                                                                                                                                                                                                          • SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                                                                                                                                                          • Path C:\Windows\Temp\{84B900F6-82C8-436D-AFCB-5331229ECAF5}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                                                                                                                                                          • Size 967KB
                                                                                                                                                                                                                                          • SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          memory/2424-468-0x000001D5F3EC0000-0x000001D5F3F69000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2424-94-0x00007FFF6B4B0000-0x00007FFF6B4B1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-128-0x00007FFF6B4B0000-0x00007FFF6B4B1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-6507-0x000001B775400000-0x000001B775401000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-6505-0x000001B775400000-0x000001B775401000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-6508-0x000001B775400000-0x000001B775401000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-6509-0x000001B775400000-0x000001B775401000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-6506-0x000001B775400000-0x000001B775401000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-6501-0x000001B775400000-0x000001B775401000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-6499-0x000001B775400000-0x000001B775401000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-458-0x00000269CF5E0000-0x00000269CF689000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3244-6496-0x0000022A27A80000-0x0000022A27B29000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3836-650-0x00000230632A0000-0x00000230632A1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3836-651-0x00000230632A0000-0x00000230632A1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3836-648-0x00000230632A0000-0x00000230632A1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3836-649-0x00000230632A0000-0x00000230632A1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3836-646-0x00000230632A0000-0x00000230632A1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3836-647-0x00000230632A0000-0x00000230632A1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3836-640-0x00000230632A0000-0x00000230632A1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3836-642-0x00000230632A0000-0x00000230632A1000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4716-592-0x00007FFF69D70000-0x00007FFF69D71000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4716-591-0x00007FFF6B050000-0x00007FFF6B051000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4852-6274-0x0000019779770000-0x0000019779819000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4852-6353-0x0000019779770000-0x0000019779819000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5432-6275-0x0000025A1EA30000-0x0000025A1EAD9000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5448-6497-0x00000277528D0000-0x0000027752979000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5504-556-0x000001D702770000-0x000001D702819000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5504-528-0x000001D702770000-0x000001D702819000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5504-6191-0x000001D702770000-0x000001D702819000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5504-672-0x000001D702770000-0x000001D702819000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5900-579-0x000001D6FDE70000-0x000001D6FDF19000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5900-533-0x000001D6FDE70000-0x000001D6FDF19000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5900-4002-0x000001D6FDE70000-0x000001D6FDF19000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/6476-5472-0x00000000005D0000-0x0000000000696000-memory.dmp
                                                                                                                                                                                                                                          Download