5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb

Analysis

user interaction
yes
max time kernel
107s
max time network
109s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260802-er876avakf
SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
MD5 81ee0f82e959c755bdcb29c510249fbe
SHA1 c6f9839f5452732af66b08a8ab9872f4f4bfc363
SHA512 5873121197183f06e492d46e90a73550de261494a1a1572d16b9f295ad094acdd0df1f2415d41127751847e11bfb1c5216a0cf71a0eeaff9d06e364936e33522
SSDEEP 98304:r+q6pQE5qQhw2AHVPVKKInBdw+gpiMQwySjcTc:rpYl9hw2AHVPVKKIQngwlj
TLSH
T11C76CF69A6BC00E9E466C1BCC2875223EB72B91517B153CF5A649AF60F23AD01F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
39	5656	Madium-Bootstrapper.exe

Executes dropped EXE 2 IoCs

pid	Process
5640	Madium.exe
1360	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191836b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	Madium.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	Madium.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe
5640	Madium.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3420	msedgewebview2.exe
2568	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5640	Madium.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 3420	5656	Madium-Bootstrapper.exe	89
PID 3420 wrote to memory of 1560	3420	msedgewebview2.exe	90
PID 3420 wrote to memory of 1820	3420	msedgewebview2.exe	92
PID 3420 wrote to memory of 1820	3420	msedgewebview2.exe	92
PID 3420 wrote to memory of 1820	3420	msedgewebview2.exe	92
PID 3420 wrote to memory of 1820	3420	msedgewebview2.exe	92
PID 3420 wrote to memory of 5368	3420	msedgewebview2.exe	93
PID 3420 wrote to memory of 3740	3420	msedgewebview2.exe	94
PID 3420 wrote to memory of 3740	3420	msedgewebview2.exe	94
PID 3420 wrote to memory of 3740	3420	msedgewebview2.exe	94
PID 3420 wrote to memory of 2596	3420	msedgewebview2.exe	95
PID 3420 wrote to memory of 2596	3420	msedgewebview2.exe	95
PID 3420 wrote to memory of 2596	3420	msedgewebview2.exe	95
PID 3420 wrote to memory of 2596	3420	msedgewebview2.exe	95
PID 3420 wrote to memory of 2596	3420	msedgewebview2.exe	95
PID 5656 wrote to memory of 5640	5656	Madium-Bootstrapper.exe	98
PID 5640 wrote to memory of 2568	5640	Madium.exe	99
PID 2568 wrote to memory of 5712	2568	msedgewebview2.exe	100
PID 2568 wrote to memory of 1088	2568	msedgewebview2.exe	101
PID 2568 wrote to memory of 1088	2568	msedgewebview2.exe	101
PID 2568 wrote to memory of 1088	2568	msedgewebview2.exe	101
PID 2568 wrote to memory of 1088	2568	msedgewebview2.exe	101
PID 2568 wrote to memory of 4796	2568	msedgewebview2.exe	102
PID 2568 wrote to memory of 4216	2568	msedgewebview2.exe	103
PID 2568 wrote to memory of 4216	2568	msedgewebview2.exe	103
PID 2568 wrote to memory of 4216	2568	msedgewebview2.exe	103
PID 2568 wrote to memory of 4456	2568	msedgewebview2.exe	104
PID 2568 wrote to memory of 4456	2568	msedgewebview2.exe	104
PID 2568 wrote to memory of 4456	2568	msedgewebview2.exe	104
PID 2568 wrote to memory of 4456	2568	msedgewebview2.exe	104
PID 2568 wrote to memory of 4456	2568	msedgewebview2.exe	104
PID 5640 wrote to memory of 1360	5640	Madium.exe	105

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Downloads MZ/PE file
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5656.4880.15930033890735014130 /pfhostedapp:156f0c9a5f0a56f7b7bdce1fc41c77d57682d000
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3420
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView /prefetch:4 /pfhostedapp:156f0c9a5f0a56f7b7bdce1fc41c77d57682d000 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc81fa5fd8,0x7ffc81fa5fe4,0x7ffc81fa5ff0
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1724,i,3757922193800717476,8252865845666938356,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:156f0c9a5f0a56f7b7bdce1fc41c77d57682d000
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1724,i,3757922193800717476,8252865845666938356,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:156f0c9a5f0a56f7b7bdce1fc41c77d57682d000
    3⤵
    PID:5368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2476 --field-trial-handle=1724,i,3757922193800717476,8252865845666938356,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:156f0c9a5f0a56f7b7bdce1fc41c77d57682d000
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3496 --field-trial-handle=1724,i,3757922193800717476,8252865845666938356,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:156f0c9a5f0a56f7b7bdce1fc41c77d57682d000 /prefetch:1
    3⤵
    PID:2596
- C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
  "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5640.3636.16981812207950168900 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x164,0x19c,0x7ffc81fa5fd8,0x7ffc81fa5fe4,0x7ffc81fa5ff0
      4⤵
      PID:5712
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1840 --field-trial-handle=1844,i,2087873884159406257,14511973718029484677,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:1088
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1844,i,2087873884159406257,14511973718029484677,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:4796
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2440 --field-trial-handle=1844,i,2087873884159406257,14511973718029484677,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:4216
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1844,i,2087873884159406257,14511973718029484677,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
      4⤵
      PID:4456
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:1360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
Size 13.5MB
SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
MD5 23e1b97c9b104e4a6d0432a8c8000496
SHA1 75eaa7184853f7aff363befcec625e1302f62940
SHA512 9f666471148d909b17a00a51374d834fb880a8777df74485d3091757d61cae6972d67b54be1f448d4012afa9bc38246326261ef86e6687c6c0ea06a323ac692b
SSDEEP 393216:nwfBqWTa3LqxWB04nJIslV0PTmP+00EVkJu:wJClxlW0lV3
TLSH
T15AE6CF07F64081F8C4AEC278C37B9536EA72B889452072AF57E45B112F2BB706F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 531B
SHA256 357b03705356c04f0d3d82c26a0847b50e0782b4c0966cc935ad6aaff58cec3d
MD5 11115935405ae0c287327e97298432ec
SHA1 ca0134b72ca1b9a87b078f2a6552fc97fe2d6a98
SHA512 9e1d41b00ce6588ee0d3a4f498215bc855651e5cb6c9260ef05ca0628cd8bef718761e210120aea6866cad31a51c1ea17fd62df1cebe4196412d1f7360269030
TLSH
T1ABF0597E9C022376AEA2E24688C4714386746116EB72C0ACC3F59C2C82F7169686BC93
MD5 SHA1 SHA512 TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 442B
SHA256 fbfe2135ee15c7d3ead57d2f61548e0372cfc36c4a9d26cc75a00b34985c504d
MD5 7f2c229ae61a251ba5808532f35f310e
SHA1 a5a440302bd5f239d0d70bef05b50b65f7b7ab70
SHA512 a025549ebd989d199bcc82cbf9d9f2ab3c68723f158c5fce83d2365aff5b8520ee25f0c016f6277cdca98b273d8a8c728f683f4030df226357dfed2a26de5cd8
TLSH
T110F02B7E5C072372ED91E20698C9724355786212FB3651ACD3F55C2C42F72AD28ABC93
MD5 SHA1 SHA512 TLSH

Submit Download

editor.json

Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
Size 431B
SHA256 58b07e6fce2489664fb82b547ec460b740c821677e0d3e5397fdacb87e6c1cdd
MD5 13a263b7aa4331491ac8ccc8de0f5c1d
SHA1 07276613be64d326598959e0697e72fb87d19525
SHA512 6e7e4133ccc3228e9b35826b6c1b0f0b000e9d35516c504a145c4cff939aaa1f8de56ebf437d264d795c07ebd4d76b5c1e228c4d2094c4f1efaca330d4a64c13
TLSH
T19EE02B7E5C022372ED81E30284C8720385B86112FB25816CD3F55C2C42E71A9296BC93
MD5 SHA1 SHA512 TLSH

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 61f3ed23a2be21fb973f6b5a8f84295085120ee3c98775c415e6ff10234b3baf
MD5 6d946a685bf8aaadcfa863364abb3fbc
SHA1 75c5e878634d581ad8b2a341249f9aa550f80bf5
SHA512 59e165eb60008fa5d19d3882a7bad4e01e4d62a8154e639be31cf1e21dadf9c28e63e2a1899a26dbd48074cc6bcaf80108f47288015ad4500aedc7ff0781ec4b
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 39B
SHA256 1d7d4e09ef38b5ee654d44295fe4a38173381dc595a4543f565685d757e3e634
MD5 1db4a98e52be5450f7ee1de11316547f
SHA1 1b1305fc04bc19e7093b13f1e29eccb93259c629
SHA512 1e1518f79d2776cc7ea40fcf37dcaab7061c8019b0e3c9a06d6fc8941ff0c380cbbf879ca75762a3aa1e9b81b8ec2b647bced51bf7f761769a8c1d97dcef3326
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 cef88d0bd38288c97f86a5235aff7497714fb1b48e31de35e84d58dea5eac43c
MD5 95cb793063cb17e3ddbbcad9f9190d0c
SHA1 cc9ccb6da8f89f3ae06292224e21b8532129c5ee
SHA512 e0bdc4bae597cca4eb41e8ae335bfe9e8e7ada73789d82855b0ca7f8305ac756babd6bc0f13410299585da5ca803e2fe2993e211b12edb7a30979c1d7406c9bc
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 37B
SHA256 7c6552729881310751b8081e5b1eed41704070f949ed09114fd50c3a104df1f0
MD5 3ee773cf234dc95e2326810c803b297b
SHA1 6982e0fad3b2f4fba812474873d7670bbfd853f1
SHA512 2d957996e7c092d7223addafcaefb19c42d8afc3e5a5221760fb44f2b73d5cb2b40425888e3bb5960cf750e174e9e3a66fe12f78e5ea0162eef4fe0659fa9095
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 36B
SHA256 432b1b0905da045cf89763944864a902757ad3a16fa38c49e2ce9eb97a29fd9c
MD5 005c26f3d60e7b6924f813eca528cf33
SHA1 012e9d2b4bc7cd9f1f71cbe88d51a6ecd17c15eb
SHA512 76e46f16df58aec4a1a410b6cd8662347b1a73fe05ee2831ec67016afffc58ad7a960660005aa3f0f5bf23302af468b9205f5759135985a6ad84ca27560a3330
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 35B
SHA256 d1c89106aeac4779658a5ca0b7240ab2b4c1219ff6eda1eac7b9c4a1b6a115a8
MD5 940ecc7e1b2b944bc8d7fc452d1ce0f3
SHA1 171e4ccf3a812d87cf5f361deb35a020b1a4c1e0
SHA512 216ae8904358a4e2367518f582e8d1f20adbd8ad9f94efadf80234fe1caf5ac79235f263606a0a6d846f9ab2e58ab272a5d93efabec108b41fd474db8b1b0704
MD5 SHA1 SHA512

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 34B
SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
MD5 e588022031c7c2cc71418c3c8ed68c5b
SHA1 77ea752c8e2b17792e48c6a45a0fdde81a9a665c
SHA512 33f84dcf3d236bb844b27a8926e190c3ca0fb2359ccf3fd781f939db752772b57c3f2dd208caf4eaaa1e21604882300aa60d4776e13a2c25ff64652ca2c457aa
MD5 SHA1 SHA512

Submit Download

docs.json

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
Size 44KB
SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
MD5 d8609297ff0b94a60784d9e94f0f841e
SHA1 4ed3bcc553171e45cdd86c6af1055911b5ccf5ce
SHA512 95a91986d33bad0f3d394ae5c3230e9f49ffcdb367919df3ba92282a39e288465b258109e42948f5d9c44b13b37db91bc617074d3ec727345f52b4a68b0781f4
SSDEEP 384:Mk6zWVCu6tqYXKNK3cSZc4ImuNclknkpf+qZFHzYI:Mk6zWSso647QclDpfJZNYI
TLSH
T12813EFE37FD545030EDA12837536E258A43ED0EDF48E5C6ABCECBD18C6488AE1627647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau
Size 751KB
SHA256 dca06de17994c51bdd3f5f9fe8610fd38277a14b95a88a09527104392d317c86
MD5 42f0071399e252b89d592e911c6e6347
SHA1 b8cda9cf07f5259de8b5549f654c3083a0933cd2
SHA512 b80de9626f3cf5acca511873b41d0710ac9a60a5966200d36ce5bf74f6a63b99e37a5c61d9158ec0116cca91b1a2387ee448d08f7c6b0b40820baee04539d00d
SSDEEP 6144:UhFsApJtIZaXnoQOeugC4BNKoLJplUStDHb2YxcHmz8fyfJ7qSiqCFydNH/AaJOF:ZaXnoQOeugC41DHvzJCqI
TLSH
T171F4661DB609B1700D8F73F6A9BF8844A8759281911850FCA0F8F78A177F87D2396ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bce970a96622ce83964840b664b3a3bd375bf29061534bb286ab40a1651b6dfe
MD5 6a442af052dfa7a9ad0168ffdf2a150e
SHA1 fca25fcd46069f6b66ec97cbce68d338b9039cdb
SHA512 718baeaa0d46b35e5f1032699e5dc495af9b4d20000623ef6a8e6d25af127bf1dc06ac633eddbfeebd96c8adb160bdcd94ed1dd606824ed3862f6be7629f761e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 039dea44107229161c325db089689232e113d827a1e4200827f8630e34343195
MD5 bb90a73e603541fe69df2ebe742d5b69
SHA1 558828bda819ee09a336e1271611cf6193a2dde6
SHA512 0094ef6418532645140bb1fd5022ee838cd5087d376571821ae8d567b8ecb07cd6e80f4e3ba148180fc973bc0da453a18a17574464b57e7fe6bd2e03579caa05
TLSH
T142D0122677010534C43020330182660C2800D91F41054114643C991E1A181600912C51
MD5 SHA1 SHA512 TLSH

Submit Download

8786512e-7eea-47fa-82fa-4089b011eb75.tmp

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\8786512e-7eea-47fa-82fa-4089b011eb75.tmp
Size 6KB
SHA256 0d95f1ae8706c4e318f92c8086442ff4ac05e3d01f1e70aee26a3f0927e34eda
MD5 e435e37b7bc81b618da85475ff4d0db6
SHA1 28e605ff17427c65c203827b5cfdd049f51e9b09
SHA512 e575ff2e0ccf861e7e90b8bc53d7d759503551b579fe3665d90b7da52e2d7c8a3f433b36c5e14a19753dd1bd221b07a6a7c4fd131e7a7a8931853c5793a10e2e
SSDEEP 96:stj/d1EWmb9lk9o5h16Z08s7/x+6MhmuecJ7hSMFNjeJK+gT28XM1C7K:stbjSKon8sV+Fd7w2j/dG6K
TLSH
T179D196025E28B97B4CCAE509BA39BB17E3F5603260D51D68EBF8462C05DB6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 a92f7720a32864d724df3bef24a175be4322a32a51e3a3a80c4916942f8c4057
MD5 526cca795c9229bac4b2074408b94819
SHA1 75e8388353d05392df69b6f7ad7113309f730cc2
SHA512 0feabbf57cee273b034c14301f38027a4fcf35607307a2832d5730dfad034fe56a2a4fdf617edb3ec233119204a0c68df351e3e64bb7ba43d552dbd0092fbeea
TLSH
T19AD08CAB32F08120CF540931A2F3102578F04454C2831FF3C4E414719B807FA0060E01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9a8c.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a9a8c.TMP
Size 48B
SHA256 cf66f7169c7e64674ad4805079acaed0d3595c902a299ffe5b6910d140a08cb1
MD5 6ca0b751d32ed8d7f96251a68b2e07c9
SHA1 3edf819f6746859e08e389491bc2f3add97b202b
SHA512 70eb79781c7fa515c10024cb5e87a74c698fbcf3cd3adc6ee7147919478c456075f54fe50a9e56327c9caf9bb9362febead4f702d3254f2ba361a7ab7a5fce8c
MD5 SHA1 SHA512

Submit Download

6a7b83cc-7b2d-4c61-942b-c0ae62b7493f.tmp

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\6a7b83cc-7b2d-4c61-942b-c0ae62b7493f.tmp
Size 524B
SHA256 2199af0da324edd68f1901f110de9d69a5b6a1dec8212106b6856084e69e0b0f
MD5 fd80a23930f7d104fd0e69c0c69ebfdf
SHA1 6592804b55410096d2ff71c3b64a3c9d1fffbba5
SHA512 f67798c987068fd0a8e602b6c023d963cdbcd4f22f4c00d3549f64231811a1f749717a1206644caa064411191de530d8898b3a9751a152219e8fe958c802ed8a
TLSH
T131F024AB413EB4A720B90AB63E487C4216BAF53E415238E0CB43403CA0956B38642522
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5aa365.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity~RFe5aa365.TMP
Size 356B
SHA256 b2908e6b4a57ff9f2329d50d6af3545dd208a84d9ef99c377c2571d1480fc991
MD5 d688ae5049516ac6ecb5f370dd632a12
SHA1 dd7bdd55a17bd94084312c3eb042d001f40fa1d5
SHA512 ac7a5e6cb4b21ee63488d00e70d9b5c8e37215a7265996457f56e78c66051e4cc797f0e564aa44d33a639ce774ffc9c5e38ace417037f6211c736cacf247906f
TLSH
T1EAE0D8F6507FA17730E809762D447D915A7DB53A155168F4D643447DA0415B74E02463
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 5dfcbda9ee37fa413daad7cafd21de205da737bea04bbe9b43ea69aaa92d4d7a
MD5 b062709472adddac2604a209a07fbfd2
SHA1 69b37ae5adabe49feb140c0a2a39dc51014d218b
SHA512 307d1f8d886be2ccba25084e26168bedb7a5aa1c247114e7b997f3dc071f2513b9c6c2c4fd89eae591d7e6256079a29ada4eb3bb4dffff0439de60e70f6f502b
TLSH
T130516973B8206B378AE647057B462B23DF7950A196611F609ADD1B1902D766C1346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 15KB
SHA256 666443a802596d36b50736e796a72fdb9e884eb66dc3e01d2496201872eb4e2c
MD5 f5cd2dd476abe1b124c47bbb93c2ac9f
SHA1 c6f358337be283bab2e55726c6720c0404f33990
SHA512 ed33f9dc74b16c967d97648c162f4f1706ece140ddc7bd16530636f9a8d9b1cc0c9d7ec274b00ebe89b51529ec252840c4207c3a08e65d13ebb046fcee588902
SSDEEP 384:X+aQikB+z/xvxjg/qhEwNBSPntaGxhAVdpiqR9zL:m/UxvxjgC+ntaQhUiqRFL
TLSH
T11C729F27A4793E3799F7EA057E4D078BDBB884B254816DB44AAD5F0E07D73E80342816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 e76b73dfcf84743e1f157ca1013925acfbafbda4f3f4fd733543a0bd4e45b608
MD5 883912c18e2863f04e3faa5d8d0ba159
SHA1 0222dae2eba052897bf5e3e6a323660c8df50415
SHA512 a34de54032fb1414ffd7301da9dd5892c60702f99529f242f3348cdac07e8534169b8ac24e1e27210b2befcea1f401d574d6f1742525719c0d294eb876e6d179
TLSH
T1A5618637B970AA374EF68605BA862717B7A55063E5913F64CAED1F0D02D739C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a47c8.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe5a47c8.TMP
Size 1KB
SHA256 f98e44a181bac895005639cf65110c6fa297f4bd3c5c91f3aeba2ab2e245611f
MD5 9647c25c8c0bc8d00f7b757bbac2bc85
SHA1 c606a979c980cc8c019b002e04829163f5ffe001
SHA512 241591b628739c85f04455e025f9c0ea4be7474a29d925846598d90347d9aa5b344ccbef9f6868b6ea072f13098765aae42e4837ced3cd43d3858597264d31e7
TLSH
T1632172B3F4701F32ADD6534737022717AF7450A791204E00A5CE5A0A03E726C575A832
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 df69fc4fbc6076105136c192eafd669e88f4078012ef6823af08301cfe75d9aa
MD5 ab0efde45252d0a4876860e877cdee83
SHA1 4065afbaa8734de9b39dbb14e42ae8e7aaa70109
SHA512 97a4c3777bdc04e5ada8fbafc9709fe112febe58b30b6a0ebca95bd3e22673fd00a76b9b93654cc8a62dbee0601da2b82174a473ea8a2ad873978c08ea8a7b7c
TLSH
T1FDD02BB322350530CB10313740C1F2495900C11F400F88002F35FD2C2A410E60D82942
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e9a09bd730fccd988454961febc165e5ad492743ca3999e40f0964cdbeb62ec4
MD5 3abd4db464d7dfb3c94745cb002bf280
SHA1 57c866b9c1ecf3ea5e6d710fbab5af0929da87f4
SHA512 345538c28c5443b64050449ff08f9e9618ce31a11fc3a84acf8c4c170c4bc4fb1c2035cbbe3717002e11d77a8fa1ae97bce5f8a8d02ca010c609d4a38b330957
TLSH
T1A7D0112332220238C82028332082B20A0E00C20B800F8800AC38CA2E3A080A80E038A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 36b2ab4697b7bc6d5a7b7d3c8776bd4245ac712c4ec56da337338522c933c87e
MD5 3439bdf6deb70382660e4fa91508700a
SHA1 ce8704d936576ae19e6ef4da87191514586d987e
SHA512 51ca6a8c53d79243ce28cdd9bc7f1c0ee05f4155175a4b42f4261ddf526ce74cd0448072a1dfca74ea8a99abc1c20d667b52432faca6bd6f8215631c269501d3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0fccfb16-37b0-4da5-a6f5-100a81517a42.tmp

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Default\0fccfb16-37b0-4da5-a6f5-100a81517a42.tmp
Size 5KB
SHA256 178b76158eb10eec391565ae463dc89551cc1d125250498df07d67c2028c67a2
MD5 a86b4bd480ea3295b3ae2d9fa29d1ceb
SHA1 e70455a05d99bf632c67d9610f8db89a4d8e122c
SHA512 2faa5a5df9cb0a9c1faa7613991500ebd774b4c5901f7491e17580a14c115cb2d3def5f43a2e6453a67f303bb3ecb9c0e0150b1a95dbc9ce4821268522509210
SSDEEP 96:st4/dYecjdb9Rkbo5h16ZZs7/x+6MhmuecmjegK+gd+28XM1C7K:stc2z5So+sV+Fijs7+G6K
TLSH
T166C1A6025E68797B4CCBF549BA297A03E2F9603270D11E58E7F8462C09EB6DD2317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a3e43.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Default\Network\Network Persistent State~RFe5a3e43.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Local State
Size 15KB
SHA256 94b21d4f75e369d625bcdc133bfa39f70ce88c73b781264f59a3c2645f33e032
MD5 9e2f3c4f49ff7b602ed0b1b354271925
SHA1 53d87d091e1f4941b9765b119e1bfe0b5b44ed32
SHA512 bab4ff010d8d6aa37aaa28243a1b6cb737483d6991592de50514dabd67a7592e29fc86728efe46a1a2ed193ea5ba6327f438fd8353f394fb00a5a3b49f6007e3
SSDEEP 384:R+aQikB+z/xvxjg/qhEwNBS3sggQT1QAVdp4qS9zU:c/UxvxjgC+Ik1QU4qSFU
TLSH
T1CA729E2759692E2769FBEA04795D078BDBB894B350C12DB44ABE6F0E07D73E80342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Local State
Size 2KB
SHA256 8d8bf5e8e8ec2f9fcde31ad4ec6ada58aeb10f0ef1dca74e3efdf265132e2bb5
MD5 f7c69525029c4e31cef1f8047553bd96
SHA1 518d9e9240e16d1cd9954abc4e9fd51fcb328f57
SHA512 a229cf6d1b5a2728515cc4f49eb7db5b19591a2ba29d5afde8cbf4c167ea04f402cc125faa5b36cc1345de4d6d42240c2b6b8e88ce6b2e9e3decc50a8d9ced20
TLSH
T13651C7336D506B379DFB4644B9073F22DF34A0629AA22F6095DE1B1C02D725D1346C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Local State
Size 3KB
SHA256 a252e385585d948e2d114e02e69a9434ef39d1c463be31aff4936192c73e8198
MD5 897103566f5d3e16e49ae36447797b50
SHA1 ad0c5fc2f46df5b4d19251b4f9fbd9724c49321e
SHA512 8007a5b9b1c3171c785f37937675c6e1eb1d6d6454bd38da140f03be809b61f43cb9b4c1e718e34b56569d22a17ec20e7e01f696398d7bf9927a1bdad9f45ab0
TLSH
T1DC61723769A0AA3B4DE78A04B8463B12ABA49023E5913FA5D5ED1F0D02D73981342C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5980fe.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{15EC1D19-E7B0-412E-89CC-41808C9C95F5}\wv2\EBWebView\Local State~RFe5980fe.TMP
Size 1KB
SHA256 240a5c2a053b2e818b08917bbcdcfc9e623082363406851b069bc033324d9767
MD5 eb2c27879e6b7ef381832e84fde040c2
SHA1 31defdaf8bf1d1b89ef497c13abed4ddf5167ae7
SHA512 af7f144f3633ddb2ced085b2d75d8072b72c33522c3d2fa334207ac7c71f18988d99d1a877d7147f01291f60030108bb4cca1a2e46381f939b52caea8d8f4b6f
TLSH
T1D92195B3D9A11B336C9B5185B1133A176F30602781510E5051DE9B2E23E629E865A872
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1088-806-0x00000168BA4D0000-0x00000168BA579000-memory.dmp

Download

memory/1088-573-0x00000168BA4D0000-0x00000168BA579000-memory.dmp

Download

memory/1820-186-0x000001AFBB460000-0x000001AFBB509000-memory.dmp

Download

memory/1820-182-0x000001AFBB460000-0x000001AFBB509000-memory.dmp

Download

memory/1820-178-0x000001AFBB460000-0x000001AFBB509000-memory.dmp

Download

memory/1820-29-0x00007FFCA3FE0000-0x00007FFCA3FE1000-memory.dmp

Download

memory/2596-128-0x00007FFCA3FE0000-0x00007FFCA3FE1000-memory.dmp

Download

memory/2596-195-0x000001D3B0380000-0x000001D3B0429000-memory.dmp

Download

memory/2596-179-0x000001D3B0380000-0x000001D3B0429000-memory.dmp

Download

memory/4456-771-0x0000020189E60000-0x0000020189F09000-memory.dmp

Download

memory/4456-576-0x0000020189E60000-0x0000020189F09000-memory.dmp

Download