Overview

overview

8

Static

static

3

Madium-Boo...er.exe

windows10-2004-x64

6

Madium-Boo...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    485s
  • max time network
    624s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    31/07/2026, 12:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Madium-Bootstrapper.exe
  • Size 6.9MB
  • Sample260731-pmpytsshlf
  • SHA256 1650251facc91ff98b7c710c9a3949ddcc1c91c08fd4c789ca0295be977c0b26
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoverypersistenceransomwarespywaretrojan

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Modifies system certificate store 2 TTPs 9 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of FindShellTrayWindow 56 IoCs
  • Suspicious use of SendNotifyMessage 51 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
    1⤵
    • Downloads MZ/PE file
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:2904
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2904.4984.39029958235949904 /pfhostedapp:53f26a3d077bc0d1a2aef806e645b275d197af59
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:2924
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView /prefetch:4 /pfhostedapp:53f26a3d077bc0d1a2aef806e645b275d197af59 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffdf41b5fd8,0x7ffdf41b5fe4,0x7ffdf41b5ff0
        3⤵
          PID:4244
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1840 --field-trial-handle=1844,i,16519382573749831188,7157389308218729136,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:53f26a3d077bc0d1a2aef806e645b275d197af59
          3⤵
            PID:2896
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2148 --field-trial-handle=1844,i,16519382573749831188,7157389308218729136,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:53f26a3d077bc0d1a2aef806e645b275d197af59
            3⤵
              PID:2492
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1844,i,16519382573749831188,7157389308218729136,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:53f26a3d077bc0d1a2aef806e645b275d197af59
              3⤵
                PID:4908
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3516 --field-trial-handle=1844,i,16519382573749831188,7157389308218729136,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:53f26a3d077bc0d1a2aef806e645b275d197af59 /prefetch:1
                3⤵
                  PID:3636
              • C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
                "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
                2⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies trusted root certificate store through registry
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of WriteProcessMemory
                PID:4284
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4284.2920.11266485848913689659 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                  3⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of WriteProcessMemory
                  PID:2416
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffdf41b5fd8,0x7ffdf41b5fe4,0x7ffdf41b5ff0
                    4⤵
                      PID:2932
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2004 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                      4⤵
                        PID:4164
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2596 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                        4⤵
                          PID:240
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2608 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                          4⤵
                            PID:5316
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
                            4⤵
                              PID:2632
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                              4⤵
                                PID:3108
                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                4⤵
                                  PID:5776
                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4636 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                  4⤵
                                    PID:3636
                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                    4⤵
                                      PID:1172
                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4640 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                      4⤵
                                        PID:5136
                                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4608 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                        4⤵
                                          PID:3668
                                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4384 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                          4⤵
                                            PID:5128
                                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4720 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                            4⤵
                                              PID:5096
                                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                              4⤵
                                                PID:3000
                                              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4728 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                4⤵
                                                  PID:2376
                                                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                  4⤵
                                                    PID:2532
                                                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4780 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                    4⤵
                                                      PID:1408
                                                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                                                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4708 --field-trial-handle=2008,i,4857333229182814178,5985169069019128273,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                                                      4⤵
                                                        PID:1704
                                                    • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                      "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:3368
                                                    • C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe" -quiet -nolaunch
                                                      3⤵
                                                      • Executes dropped EXE
                                                      PID:2276
                                                    • C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe" -quiet -nolaunch
                                                      3⤵
                                                        PID:2372
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?framework=Microsoft.NETCore.App&framework_version=10.0.0&arch=x64&rid=win-x64&os=win10&gui=true
                                                          4⤵
                                                            PID:5140
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x350,0x7ffdecdfc188,0x7ffdecdfc194,0x7ffdecdfc1a0
                                                              5⤵
                                                                PID:4384
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,60940563811900478,196198092084630721,262144 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
                                                                5⤵
                                                                  PID:1396
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,3283502534580723799,4915161106907629332,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:11
                                                                  5⤵
                                                                  • System Time Discovery
                                                                  PID:3996
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,5303409667492117503,14301283613035602338,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:13
                                                                  5⤵
                                                                    PID:1756
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,162032291306055136,160103002214061120,2097152 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
                                                                    5⤵
                                                                      PID:3444
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,18371645801954005307,6531007568533522747,2097152 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:1
                                                                      5⤵
                                                                        PID:2308
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,16256149780322894868,1857739952352241717,2097152 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
                                                                        5⤵
                                                                          PID:5532
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,13058694433478914345,15093126564793121748,2097152 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
                                                                          5⤵
                                                                            PID:4124
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,5013733369511940290,4298879296827286868,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
                                                                            5⤵
                                                                              PID:4908
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,8770229673814721536,9779905503316129456,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:14
                                                                              5⤵
                                                                                PID:5428
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6733705947118579288,9848326062119968414,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
                                                                                5⤵
                                                                                  PID:2512
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5900,i,2505295096989011027,17157734546236809737,2097152 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
                                                                                  5⤵
                                                                                    PID:5776
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6556894416885278182,10892142060497558812,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                                                                    5⤵
                                                                                      PID:256
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6556894416885278182,10892142060497558812,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
                                                                                      5⤵
                                                                                        PID:5968
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,3604459410536157272,4883122785660717261,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
                                                                                        5⤵
                                                                                          PID:5900
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6720,i,8289448576898711954,10477938667210305907,2097152 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:1
                                                                                          5⤵
                                                                                            PID:2032
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,15262151812884408709,10014452047001986806,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:14
                                                                                            5⤵
                                                                                              PID:6564
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7480,i,789305055810472127,13733895942444861321,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:14
                                                                                              5⤵
                                                                                                PID:6572
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,12029713994771701821,18001881368489820064,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:14
                                                                                                5⤵
                                                                                                  PID:6584
                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7652,i,8657030722830399772,3890764851986184934,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=7624 /prefetch:14
                                                                                                  5⤵
                                                                                                    PID:7120
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,14826721653198954748,1484153584408642567,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:14
                                                                                                    5⤵
                                                                                                      PID:3272
                                                                                                    • C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                      "C:\Users\Admin\Downloads\windowsdesktop-runtime-10.0.10-win-x64.exe"
                                                                                                      5⤵
                                                                                                        PID:6880
                                                                                                        • C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.ba\wixstdba.exe
                                                                                                          "C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{878439B0-6339-4B75-BD7A-8D48A0A7422D} {A8CD226B-C888-4538-AF72-36EAB363F99A}
                                                                                                          6⤵
                                                                                                            PID:6628
                                                                                                          • C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                            "C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe" -q -burn.elevated BurnPipe.{2ABBF9B3-0263-4470-9B8A-26B0E8F8BAA3} {B530B840-3F6F-47E6-B771-25923B128BCB} 6880
                                                                                                            6⤵
                                                                                                              PID:7128
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,9431864367560683046,15362102873810570672,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:14
                                                                                                            5⤵
                                                                                                              PID:6152
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,6195271370631469917,832355789853973604,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:14
                                                                                                              5⤵
                                                                                                                PID:6804
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,9134269054142319557,16572533929228763148,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
                                                                                                                5⤵
                                                                                                                  PID:6768
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,7726499403497330355,1002858550536000675,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:14
                                                                                                                  5⤵
                                                                                                                    PID:2996
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,14951754744543096672,2658011288151389970,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
                                                                                                                    5⤵
                                                                                                                      PID:6244
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,18349599411656499776,18190854578665673075,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:14
                                                                                                                      5⤵
                                                                                                                        PID:6468
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2824,i,846390722783768739,12332960618355654119,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                                                                                                        5⤵
                                                                                                                          PID:4824
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2824,i,846390722783768739,12332960618355654119,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                                                                                                          5⤵
                                                                                                                            PID:4168
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5796,i,16548974289530446314,4908965577576046762,2097152 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
                                                                                                                            5⤵
                                                                                                                              PID:6152
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2824,i,13991156270327137377,15893602363210233292,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:14
                                                                                                                              5⤵
                                                                                                                                PID:7056
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,12506188537980650638,9774650643197515245,524288 --field-trial-handle=2172,i,1474361996278393155,7421166932952297590,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
                                                                                                                                5⤵
                                                                                                                                  PID:6304
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe" -quiet -nolaunch
                                                                                                                              3⤵
                                                                                                                                PID:6292
                                                                                                                          • C:\Windows\system32\svchost.exe
                                                                                                                            C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                                                                            1⤵
                                                                                                                              PID:2684
                                                                                                                            • C:\Windows\system32\sihost.exe
                                                                                                                              sihost.exe
                                                                                                                              1⤵
                                                                                                                              • Suspicious use of FindShellTrayWindow
                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                              PID:5596
                                                                                                                              • C:\Windows\explorer.exe
                                                                                                                                explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                2⤵
                                                                                                                                • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                • Modifies Internet Explorer settings
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:4560
                                                                                                                                • C:\Users\Admin\AppData\Local\Froststrap\Froststrap.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Froststrap\Froststrap.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:3904
                                                                                                                              • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                1⤵
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:5972
                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                1⤵
                                                                                                                                • Modifies registry class
                                                                                                                                • Suspicious use of SetWindowsHookEx
                                                                                                                                PID:4864
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                1⤵
                                                                                                                                  PID:476
                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                  1⤵
                                                                                                                                    PID:5304
                                                                                                                                    • C:\Windows\System32\MsiExec.exe
                                                                                                                                      C:\Windows\System32\MsiExec.exe -Embedding 0BDE33EA363574FEBB494A376F9959DB
                                                                                                                                      2⤵
                                                                                                                                        PID:6212
                                                                                                                                      • C:\Windows\System32\MsiExec.exe
                                                                                                                                        C:\Windows\System32\MsiExec.exe -Embedding E8C8E3CA3ED408208C2530CADBF5D734
                                                                                                                                        2⤵
                                                                                                                                          PID:4488
                                                                                                                                        • C:\Windows\System32\MsiExec.exe
                                                                                                                                          C:\Windows\System32\MsiExec.exe -Embedding E1C09969CC8B418A148C9CA01DEC0AE3
                                                                                                                                          2⤵
                                                                                                                                            PID:6740
                                                                                                                                          • C:\Windows\System32\MsiExec.exe
                                                                                                                                            C:\Windows\System32\MsiExec.exe -Embedding 893D8AC47066F499A5334D5C281FF92D
                                                                                                                                            2⤵
                                                                                                                                              PID:6864

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                e61bf1c.rbs
                                                                                                                                                • Path C:\Config.Msi\e61bf1c.rbs
                                                                                                                                                • Size 11KB
                                                                                                                                                • SHA256 b03e9c2065fa2274205ef46c818fd545f8e2dac833ee8711df5c9d4e35deec34
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                e61bf23.rbs
                                                                                                                                                • Path C:\Config.Msi\e61bf23.rbs
                                                                                                                                                • Size 9KB
                                                                                                                                                • SHA256 3ac238cd606873363f244c034146f0913024798fd6aab37c32d1331cf7fe9c4e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                e61bf28.rbs
                                                                                                                                                • Path C:\Config.Msi\e61bf28.rbs
                                                                                                                                                • Size 49KB
                                                                                                                                                • SHA256 9cdad8a009cd37b8e98857aba3fac1510addd170e71801b05e3e95d8df2e5840
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                e61bf2d.rbs
                                                                                                                                                • Path C:\Config.Msi\e61bf2d.rbs
                                                                                                                                                • Size 71KB
                                                                                                                                                • SHA256 bd1c8234f8837ab62993f3265a7cd55a2a36eaffbfda2966e1c7d1bfd8ba3996
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ThirdPartyNotices.txt
                                                                                                                                                • Path C:\Program Files\dotnet\ThirdPartyNotices.txt
                                                                                                                                                • Size 77KB
                                                                                                                                                • SHA256 deb4427a295e1ed474b0d81c5a0d972c1b550b9a715cda939cdfa9236b1b418f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dotnet.exe
                                                                                                                                                • Path C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                • Size 163KB
                                                                                                                                                • SHA256 4377f10c78400f0370b88156773de9843c07f14e65b3232005ec3179ef38d463
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Madium.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
                                                                                                                                                • Size 13.5MB
                                                                                                                                                • SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                luau-lsp.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                                                                                                                                                • Size 16.1MB
                                                                                                                                                • SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                editor.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
                                                                                                                                                • Size 426B
                                                                                                                                                • SHA256 6aa74a67c01373cfb79483dcdb9c330512518458df91128ec8501d3f1612ae84
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                ui.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                • Size 34B
                                                                                                                                                • SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                ui.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                                                                                                                                                • Size 36B
                                                                                                                                                • SHA256 c8d89df060705d2971c39f7338698d24d0e0ecb3f7537e9f541cb66fb2fbea20
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                docs.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
                                                                                                                                                • Size 44KB
                                                                                                                                                • SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 dea9f2a42091e092fc80edc6dcba070fc4b325bb0f35acf4104be6387059b000
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 8f2e520f9223e641f9f2c10685b706d1523574ce8567048ed4b8c027bb549792
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                6bd10125-a189-4245-813f-046767d9ac94.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\6bd10125-a189-4245-813f-046767d9ac94.tmp
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 ffb8e8f4b313e42c2b027a8031c902990c38311ad3074ed2d64cee22fae45c3f
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 240B
                                                                                                                                                • SHA256 408989aba897b160cea75f52abfe3410cfa804d0be893a25b2730af33582b85f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index~RFe5afd2e.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5afd2e.TMP
                                                                                                                                                • Size 48B
                                                                                                                                                • SHA256 e477695d8d166c01b1407ba621f767fa2d0b326e237fcaab7cbc89ca55cdf024
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\wasm\index
                                                                                                                                                • Size 24B
                                                                                                                                                • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                ExtensionActivityComp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\ExtensionActivityComp
                                                                                                                                                • Size 4KB
                                                                                                                                                • SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 2b500754b93c5f2e96c4311c843eac2fd294ee3320f4c630d3ba8d0d092894cb
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 6b3b1df2681c3cea49638a42c02ae9412c91c24c80898ee550bb54534c8da900
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                • Size 356B
                                                                                                                                                • SHA256 c471d103bff49429ce644bed49a25b3ace701139cd693b6c39d3009a5b654cdc
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                TransportSecurity
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
                                                                                                                                                • Size 356B
                                                                                                                                                • SHA256 7eef7d684debeface8836c36301b37fe01641ec59ac5bf0c028b131aca2a9ff9
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 1bd8ee7dcf919a7cf9a13f54bd9f469625542b5807630e9a0df2614da31344b2
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
                                                                                                                                                • Size 6KB
                                                                                                                                                • SHA256 0d67cee1a25b9cde2ed72858394b017e2f22ed83bc5f11b2107bb8fdd9a8a8c8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                • Size 18KB
                                                                                                                                                • SHA256 413c78322dc41fe25a5b4296a4ed2ebfa65253211691c618777b082523792681
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                • Size 18KB
                                                                                                                                                • SHA256 5fc986a2adf7ed6e55af06b4165573bc534194eed41271165620b485c1eb2e7a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 9e81c0b54c79b107f8948ec6805ff3486af194e29f2fedb68c15dc17d51c8419
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 79e970cbc5f096ea457e18205da348d85b5f4d5d46696565b7f69b1f5dc7342a
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                • Size 15KB
                                                                                                                                                • SHA256 079a7320dc00f88e4cd79e3b3c51b37a0a9c080f5251109366c111ba6bf0ae55
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                                                                                                                                                • Size 18KB
                                                                                                                                                • SHA256 32b1baea03906ccd6600372fd2402dd040ceb14ef1e36d221b1a842418538da3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State~RFe5aa9fd.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe5aa9fd.TMP
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 e5870a34046b1c1464682e9c9d620d227b0d3b1d7a44107b2bc9a59232309ab9
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 b074b05a0b6469735f9bdf34b67c8d80f1ecf598b57ab076623c759015f9e00f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index~RFe61e3a8.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe61e3a8.TMP
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 ac1d8f73958655516180b4d1b3e0434ca32e8b832a96c921fe545f0882371a1c
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                SiteList-Enterprise.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                • Size 2B
                                                                                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Edge Profile.ico
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                • Size 70KB
                                                                                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 64a7bda02aeaf200d15803a6e13a93a579c7f5b38396ad524008e138d788bc6f
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                b3cb3603-b884-4b4c-ab5e-046fd098b572.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b3cb3603-b884-4b4c-ab5e-046fd098b572.tmp
                                                                                                                                                • Size 40B
                                                                                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 11KB
                                                                                                                                                • SHA256 6b66496c2590d6aeab4ac1561ff0188680619ce777fa6ed80166d8cc8ef3203d
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 12KB
                                                                                                                                                • SHA256 f0e735c64ca11e38b2fbc49c0d9ee5c3357526442b93eb20c8a29fd9e0e1c7e3
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 12KB
                                                                                                                                                • SHA256 00a94fab6f6e4d571407c0fd83fdf3c1c8f4f82fbdb8ecfda032886f894f5173
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                • Size 12KB
                                                                                                                                                • SHA256 03cca4fc0f8419ba968008d931213e36473c8d8ff760e37323e70a02ada08df5
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Secure Preferences
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                • Size 27KB
                                                                                                                                                • SHA256 e8594582a885e73173160dd1285256363312fb07dd710782459dec5780d36fb4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1363acda-d938-4f5a-94df-8f0ab5387367\index-dir\the-real-index
                                                                                                                                                • Size 192B
                                                                                                                                                • SHA256 b5360203b9cdc4c56510ed13527498078fadc2c0e60d3842140bc94792eac763
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                the-real-index~RFe62b3ca.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1363acda-d938-4f5a-94df-8f0ab5387367\index-dir\the-real-index~RFe62b3ca.TMP
                                                                                                                                                • Size 192B
                                                                                                                                                • SHA256 274a133678cad5f33d1fd8cb966f7d54c981334f8c724c8c7b28b8f9205c9a8d
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                OperationConfig
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                                                                                • Size 22KB
                                                                                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                OperationConfig~RFe6247a2.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe6247a2.TMP
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 35KB
                                                                                                                                                • SHA256 82356d2951e8699972c405e756f5839d918e21e00cbfe5a3b81ac0a86a05410c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 35KB
                                                                                                                                                • SHA256 eb3cbf00a01ad42ebfe0ff64ee460998481bbfbc448d8b637d44f588e98544ae
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 39KB
                                                                                                                                                • SHA256 e87cb590ef78f203e010080265910647ef2a00d5e275f17cf7a8655bcf75b5aa
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 44KB
                                                                                                                                                • SHA256 d165030376a6e03c5b419fc2505b42415adb9349ff356a0fa58d192ae629b04e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 44KB
                                                                                                                                                • SHA256 089974caa8b59df3d6cacd83b3bfd308a5a5eba4c62d364cb3e5ea1eb401be59
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 38KB
                                                                                                                                                • SHA256 3b11af76168118dd2d3b5eeb347125e7d3cd436aa6ccd34170a40bfe53460c90
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                • Size 38KB
                                                                                                                                                • SHA256 d5728c643cbe522be8b4b78537862fc8ddc02cb46279df0560a2619fd20e1445
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                RevisitationBloomfilter
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                                                                                • Size 392B
                                                                                                                                                • SHA256 0ed5eb1df8ad025bdd56ed76b82994323c8569e92eac42987472c8bf546c1fba
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                RevisitationBloomfilter~RFe62c704.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe62c704.TMP
                                                                                                                                                • Size 392B
                                                                                                                                                • SHA256 66b2525368fc254fbc7fb2b5e7633278caf064bfd34a3245e6d25d082fd249fc
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                metadata.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                • Size 252B
                                                                                                                                                • SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                metadata.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                • Size 372B
                                                                                                                                                • SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                • Size 153KB
                                                                                                                                                • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                f80f74f1-27c0-4c88-bb2a-e84788c3a8b9.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f80f74f1-27c0-4c88-bb2a-e84788c3a8b9.tmp
                                                                                                                                                • Size 13B
                                                                                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                metadata.json
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                • Size 132B
                                                                                                                                                • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                                                                                                                                                • Size 595B
                                                                                                                                                • SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 962aeb3ed690002bf669f1de8ea47e82dd8bb68122e57fe88d95e622c7210fc0
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 85367c2d6b34754898c86bbe3407058a526d6b6f5fe61ed539b0e268c9949deb
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                settings.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Crashpad\settings.dat
                                                                                                                                                • Size 280B
                                                                                                                                                • SHA256 7e06e64eec858d21798535ffb0007de008eeaf374de71cb59cd3a1215a0b2487
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                throttle_store.dat
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Crashpad\throttle_store.dat
                                                                                                                                                • Size 20B
                                                                                                                                                • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                2a17b10f-1794-43d1-9d9f-9ca42767db15.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Default\2a17b10f-1794-43d1-9d9f-9ca42767db15.tmp
                                                                                                                                                • Size 5KB
                                                                                                                                                • SHA256 500aae0decfa71c7d30834dbac053c82e45a031ae999a5aa261220f21523ef9c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                CURRENT
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Default\Extension Rules\CURRENT
                                                                                                                                                • Size 16B
                                                                                                                                                • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                MANIFEST-000001
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Default\Extension Scripts\MANIFEST-000001
                                                                                                                                                • Size 41B
                                                                                                                                                • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Default\Network\Network Persistent State
                                                                                                                                                • Size 111B
                                                                                                                                                • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Network Persistent State~RFe5aa1b0.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Default\Network\Network Persistent State~RFe5aa1b0.TMP
                                                                                                                                                • Size 59B
                                                                                                                                                • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                SCT Auditing Pending Reports
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                • Size 2B
                                                                                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                data_0
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\GraphiteDawnCache\data_0
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                data_1
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\GraphiteDawnCache\data_1
                                                                                                                                                • Size 264KB
                                                                                                                                                • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                data_2
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\GraphiteDawnCache\data_2
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                data_3
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\GraphiteDawnCache\data_3
                                                                                                                                                • Size 8KB
                                                                                                                                                • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Local State
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 a9397bf66094a25f39c1c001185b52f4666d3972a1e669d29bf1cea757a25b99
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Local State
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 2fce75f35da7b3e29da9ad91267ed1cd316572a2a86fb1519a62504a9bb2a858
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Local State
                                                                                                                                                • Size 15KB
                                                                                                                                                • SHA256 2faba730e2e79677d4bc028ff19d1c2a5f57e2b747a07100b82b436ee8fdec70
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Local State~RFe599021.TMP
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{C7EB9503-C171-4D9D-9E4E-383037565FD8}\wv2\EBWebView\Local State~RFe599021.TMP
                                                                                                                                                • Size 1KB
                                                                                                                                                • SHA256 20ea420f068d9bfa9566779e8c647fb261d1f8a27803fa2d6b21721d85471161
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                f1823a4e-df1e-4338-9f50-b0dd656bfd18.tmp
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\f1823a4e-df1e-4338-9f50-b0dd656bfd18.tmp
                                                                                                                                                • Size 1B
                                                                                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Froststrap-v1.5.0.exe
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\madium-clients\froststrap\v1.5.0\Froststrap-v1.5.0.exe
                                                                                                                                                • Size 21.5MB
                                                                                                                                                • SHA256 9b97289dd8abcf8de40fb5f6d328ec7191c812b418511344c9eb0f5e60c74c93
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                content_new.js
                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5140_284850840\CRX_INSTALL\content_new.js
                                                                                                                                                • Size 10KB
                                                                                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                default.exc
                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
                                                                                                                                                • Size 2B
                                                                                                                                                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                Froststrap.lnk
                                                                                                                                                • Path C:\Users\Admin\Desktop\Froststrap.lnk
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 0abd7bd014454d309d7861f6652dc86f0f4f5323ce1cf342208b2c5bfdbc9537
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Madium.lnk
                                                                                                                                                • Path C:\Users\Admin\Desktop\Madium.lnk
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 48cfc95ef4a4c28391a47a44f2a8ad6544039277161c538b17478a1df8d1c9d4
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                MSIC6DC.tmp
                                                                                                                                                • Path C:\Windows\Installer\MSIC6DC.tmp
                                                                                                                                                • Size 392KB
                                                                                                                                                • SHA256 a28ed81b8594774c7e1e82f9bbe858c3b36f0d7a93067001387a5a872288231a
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                e61bf19.msi
                                                                                                                                                • Path C:\Windows\Installer\e61bf19.msi
                                                                                                                                                • Size 1012KB
                                                                                                                                                • SHA256 03eb33e8eb7746542febda19278dde1c7bd496396a69a9d625a05f9506a1c3ee
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                e61bf25.msi
                                                                                                                                                • Path C:\Windows\Installer\e61bf25.msi
                                                                                                                                                • Size 28.2MB
                                                                                                                                                • SHA256 4af98ab9168f319b9d026e01bd6e9df577799a222b04454579053a5a00abd555
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hyph-bn.hyb
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1329033415\hyph-bn.hyb
                                                                                                                                                • Size 703B
                                                                                                                                                • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hyph-mr.hyb
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1329033415\hyph-mr.hyb
                                                                                                                                                • Size 687B
                                                                                                                                                • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                hyph-nn.hyb
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_1329033415\hyph-nn.hyb
                                                                                                                                                • Size 141KB
                                                                                                                                                • SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                Staging
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2416_940819161\Mu\Staging
                                                                                                                                                • Size 36B
                                                                                                                                                • SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                manifest.json
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5140_1979834875\manifest.json
                                                                                                                                                • Size 43B
                                                                                                                                                • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                Submit Download

                                                                                                                                                manifest.json
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5140_2131202295\manifest.json
                                                                                                                                                • Size 135B
                                                                                                                                                • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                protocols.json
                                                                                                                                                • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5140_2131202295\protocols.json
                                                                                                                                                • Size 3KB
                                                                                                                                                • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                BootstrapperApplicationData.xml
                                                                                                                                                • Path C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.ba\BootstrapperApplicationData.xml
                                                                                                                                                • Size 9KB
                                                                                                                                                • SHA256 b1eda1e98d843eef81232344754cdc0973d9dda1c1790a91a352c167c9a64ca5
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                DotNetLogo_256x.png
                                                                                                                                                • Path C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.ba\DotNetLogo_256x.png
                                                                                                                                                • Size 2KB
                                                                                                                                                • SHA256 0f571f95d8eab48dbc81b0ec5e9f7225e349e26ef50868bfaab556f3c2443b01
                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                Submit Download

                                                                                                                                                dotnet.ico
                                                                                                                                                • Path C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.ba\dotnet.ico
                                                                                                                                                • Size 44KB
                                                                                                                                                • SHA256 61a2cbd12868cb9b359e0c78961d409b7875f072eb8e53ea88d3e6bfe2961a18
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                thm.wxl
                                                                                                                                                • Path C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.ba\thm.wxl
                                                                                                                                                • Size 7KB
                                                                                                                                                • SHA256 b00edd703dd8a475119d0e4dd70a3aaa47f0e95361af290e76d367a8edef3432
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                thm.xml
                                                                                                                                                • Path C:\Windows\TEMP\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.ba\thm.xml
                                                                                                                                                • Size 11KB
                                                                                                                                                • SHA256 dfee8e2d075087227f19c835c145c5bb8e72a46880ea24080bb2472fd3a521be
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                wixstdba.exe
                                                                                                                                                • Path C:\Windows\Temp\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.ba\wixstdba.exe
                                                                                                                                                • Size 431KB
                                                                                                                                                • SHA256 2b1cee5e3e24593247854eb7a7c4308937b9c607754ed2fb83520a8706c26f1e
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                                                                • Path C:\Windows\Temp\{100E66D6-E6D3-468F-80FB-127CCFEE5CCF}\.be\windowsdesktop-runtime-10.0.10-win-x64.exe
                                                                                                                                                • Size 967KB
                                                                                                                                                • SHA256 47b74e25c31fceb862dcc4496af4dcce01823094997aba1e88eb936013ffc2f8
                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                Submit Download

                                                                                                                                                memory/2896-93-0x00007FFE116F0000-0x00007FFE116F1000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3108-599-0x00007FFE123F0000-0x00007FFE123F1000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3108-598-0x00007FFE11BF0000-0x00007FFE11BF1000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/3636-106-0x00007FFE116F0000-0x00007FFE116F1000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5136-717-0x0000029F84600000-0x0000029F84601000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5136-715-0x0000029F84600000-0x0000029F84601000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5136-711-0x0000029F84600000-0x0000029F84601000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5136-709-0x0000029F84600000-0x0000029F84601000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5136-720-0x0000029F84600000-0x0000029F84601000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5136-716-0x0000029F84600000-0x0000029F84601000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5136-719-0x0000029F84600000-0x0000029F84601000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5136-718-0x0000029F84600000-0x0000029F84601000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5972-1176-0x0000021B001E0000-0x0000021B002E0000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5972-1192-0x0000021B02E20000-0x0000021B02F20000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5972-1223-0x0000021B02D40000-0x0000021B02D60000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5972-1189-0x0000021B02900000-0x0000021B02920000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5972-1175-0x0000021B001E0000-0x0000021B002E0000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5972-1174-0x0000021B001E0000-0x0000021B002E0000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/5972-1237-0x0000021B041E0000-0x0000021B04200000-memory.dmp
                                                                                                                                                Download

                                                                                                                                                memory/7128-2749-0x0000000000860000-0x0000000000926000-memory.dmp
                                                                                                                                                Download