Overview

overview

8

Static

static

3

Madium-Boo...er.exe

windows10-2004-x64

8

Madium-Boo...er.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    114s
  • max time network
    117s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/08/2026, 20:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Madium-Bootstrapper.exe
  • Size 6.9MB
  • Sample260802-y39slsfc28
  • SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 41 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 61 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    PID:1328
    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1328.3932.13044980374704142885 /pfhostedapp:117d921b0283a227de72e068dbc66793a136a1e9
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of WriteProcessMemory
      PID:4880
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView /prefetch:4 /pfhostedapp:117d921b0283a227de72e068dbc66793a136a1e9 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x160,0x188,0x18c,0x184,0x194,0x7ffae0e65fd8,0x7ffae0e65fe4,0x7ffae0e65ff0
        3⤵
          PID:1684
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1792 --field-trial-handle=1796,i,11058311033152593431,12725139826963554268,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:117d921b0283a227de72e068dbc66793a136a1e9
          3⤵
            PID:532
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1796,i,11058311033152593431,12725139826963554268,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:117d921b0283a227de72e068dbc66793a136a1e9
            3⤵
              PID:1268
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2164 --field-trial-handle=1796,i,11058311033152593431,12725139826963554268,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:117d921b0283a227de72e068dbc66793a136a1e9
              3⤵
                PID:928
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1796,i,11058311033152593431,12725139826963554268,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:117d921b0283a227de72e068dbc66793a136a1e9 /prefetch:1
                3⤵
                  PID:1568
              • C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
                "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
                2⤵
                • Executes dropped EXE
                • Checks whether UAC is enabled
                • Modifies Control Panel
                • Modifies registry class
                • Modifies system certificate store
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SetWindowsHookEx
                • Suspicious use of WriteProcessMemory
                PID:4348
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4348.4424.17786903906511245012 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                  3⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                  • Suspicious use of WriteProcessMemory
                  PID:4332
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffae0e65fd8,0x7ffae0e65fe4,0x7ffae0e65ff0
                    4⤵
                      PID:5704
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,13615180844470760833,13027049795724338738,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                      4⤵
                        PID:1652
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1764,i,13615180844470760833,13027049795724338738,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                        4⤵
                          PID:4560
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1764,i,13615180844470760833,13027049795724338738,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                          4⤵
                            PID:2760
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3488 --field-trial-handle=1764,i,13615180844470760833,13027049795724338738,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
                            4⤵
                              PID:4468
                            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4532 --field-trial-handle=1764,i,13615180844470760833,13027049795724338738,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
                              4⤵
                                PID:2796
                            • C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                              "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
                              3⤵
                              • Executes dropped EXE
                              PID:3776
                        • C:\Windows\system32\taskmgr.exe
                          "C:\Windows\system32\taskmgr.exe" /7
                          1⤵
                          • Checks SCSI registry key(s)
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          • Suspicious use of SetWindowsHookEx
                          PID:2680

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              Madium.exe
                              • Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
                              • Size 13.5MB
                              • SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              luau-lsp.exe
                              • Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
                              • Size 16.1MB
                              • SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              editor.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\editor.json
                              • Size 426B
                              • SHA256 6aa74a67c01373cfb79483dcdb9c330512518458df91128ec8501d3f1612ae84
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 35B
                              • SHA256 61f3ed23a2be21fb973f6b5a8f84295085120ee3c98775c415e6ff10234b3baf
                              • MD5 SHA1 SHA512
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 39B
                              • SHA256 1d7d4e09ef38b5ee654d44295fe4a38173381dc595a4543f565685d757e3e634
                              • MD5 SHA1 SHA512
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 37B
                              • SHA256 cef88d0bd38288c97f86a5235aff7497714fb1b48e31de35e84d58dea5eac43c
                              • MD5 SHA1 SHA512
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 37B
                              • SHA256 7c6552729881310751b8081e5b1eed41704070f949ed09114fd50c3a104df1f0
                              • MD5 SHA1 SHA512
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 36B
                              • SHA256 432b1b0905da045cf89763944864a902757ad3a16fa38c49e2ce9eb97a29fd9c
                              • MD5 SHA1 SHA512
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 35B
                              • SHA256 d1c89106aeac4779658a5ca0b7240ab2b4c1219ff6eda1eac7b9c4a1b6a115a8
                              • MD5 SHA1 SHA512
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 34B
                              • SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
                              • MD5 SHA1 SHA512
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 38B
                              • SHA256 1551db0cdbe38874970124f6800fda88692f64e7a52fa5ad4159ee98e7b1915d
                              • MD5 SHA1 SHA512
                              Submit Download

                              ui.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
                              • Size 36B
                              • SHA256 c8d89df060705d2971c39f7338698d24d0e0ecb3f7537e9f541cb66fb2fbea20
                              • MD5 SHA1 SHA512
                              Submit Download

                              docs.json
                              • Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
                              • Size 44KB
                              • SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              8abba92b-a7a7-442f-9042-e2003ca33515.tmp
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\8abba92b-a7a7-442f-9042-e2003ca33515.tmp
                              • Size 16KB
                              • SHA256 c07aa8eac55b21667047296df51128c786d0993891bfdf203cbe22980b3f11f8
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 f4171839d4d22337ba95932f8fe2d2c2b7726539dc9119bea45cc9d92931b6bb
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 f6baef506607886e15e670a6f044057ee77bfdbbd1d4e7e017d19dc4c0028305
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              69db487c-dd31-4a96-9b4a-50d776b36f80.tmp
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\69db487c-dd31-4a96-9b4a-50d776b36f80.tmp
                              • Size 6KB
                              • SHA256 4e6b0b07eefab4f52e69c52cd982395aaaac07586cfffad48106696d84a4f4c1
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              index
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index
                              • Size 24B
                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                              • Size 240B
                              • SHA256 a5e9dea94ef980264a6768fec6d91c26a1b4cc2a772d1509d74db010d97b5f37
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              the-real-index~RFe59d75b.TMP
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59d75b.TMP
                              • Size 48B
                              • SHA256 7a8dbc7234fc18150d8c65a4bc2afd9416c6f70e6608d417a87b80bee91aad08
                              • MD5 SHA1 SHA512
                              Submit Download

                              Network Persistent State
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
                              • Size 2KB
                              • SHA256 f2e78f07d033cb57f2c732affb3a9a01e96494ae0ab0333a5524690eadd6fcf3
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Network Persistent State~RFe5a98c7.TMP
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State~RFe5a98c7.TMP
                              • Size 59B
                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              TransportSecurity
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity
                              • Size 524B
                              • SHA256 fb22d87c83361adb5eed27417385429b8a6621dc81a34231f1abf8d3157ac5a2
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              TransportSecurity~RFe59e296.TMP
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\TransportSecurity~RFe59e296.TMP
                              • Size 356B
                              • SHA256 950f77f24eacc94c64a7c2f1339f605bac5e25834b5d6db0adbc21417e97265a
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                              • Size 2KB
                              • SHA256 29935e8c28e51175d5160d8c0b813a802ad7cbb0eaeea1d3040762e89ff6b40f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                              • Size 3KB
                              • SHA256 670cef65071c96ec4c4a2904b6ba8a306efe7817b201635792f9c12a2e0d6d52
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                              • Size 15KB
                              • SHA256 9b9440d174cfe2e3747e2695582319607aab959b19e6991b95c2d3c6f8553576
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
                              • Size 15KB
                              • SHA256 0a8a1d4ed75fa89c25c5e78b2a1536334c04ac7fbe456669b609d97fff43d51c
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State~RFe5981d8.TMP
                              • Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe5981d8.TMP
                              • Size 1KB
                              • SHA256 a0cf4a32e33cfe9732e7cd792d0e00dbdc9fbfc5f9a6b375b21a398673d83f87
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 1a6a4083fb6bbffda2a56ca8bd04f269bda94f961f8c668e1ecba2d3b1533868
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 a82115e9ef9df0e881a1d736793ff033c625af0a3f2d9fb13ee79d9d13275f6d
                              • MD5 SHA1 SHA512
                              Submit Download

                              throttle_store.dat
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Crashpad\throttle_store.dat
                              • Size 20B
                              • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                              • MD5 SHA1 SHA512
                              Submit Download

                              SCT Auditing Pending Reports
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512
                              Submit Download

                              CURRENT
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
                              • Size 16B
                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                              • MD5 SHA1 SHA512
                              Submit Download

                              MANIFEST-000001
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                              • Size 41B
                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                              • MD5 SHA1 SHA512
                              Submit Download

                              data_0
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\GraphiteDawnCache\data_0
                              • Size 8KB
                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_1
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\GraphiteDawnCache\data_1
                              • Size 264KB
                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_2
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\GraphiteDawnCache\data_2
                              • Size 8KB
                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_3
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\GraphiteDawnCache\data_3
                              • Size 8KB
                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Local State
                              • Size 2KB
                              • SHA256 e5b79f27d3941344609f68b72f942fdb3390eec12dfec437a6c62c5fcb013124
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Local State
                              • Size 3KB
                              • SHA256 caebaf544dbf4a1231dddfda3b063fff234b80275f3ace20df1055462cd5b8ea
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Local State
                              • Size 3KB
                              • SHA256 1227e4fc28f0ff60c0f7ff748b05732de0a7c53ef4d17880b52b74e5d1aa324b
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State~RFe5967b9.TMP
                              • Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{59CC2EC8-1246-48E8-A55F-C90A416B7578}\wv2\EBWebView\Local State~RFe5967b9.TMP
                              • Size 1KB
                              • SHA256 ed7381722d16861fbeb6302b3b24f085783122eaa555676fb2c27ded3b0d221d
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Madium.lnk
                              • Path C:\Users\Admin\Desktop\Madium.lnk
                              • Size 2KB
                              • SHA256 66a8a7468c1665d46bc8f59c1dece11db73cb3da2f4465ad3148c7b5ae0720ea
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/532-317-0x0000021080DF0000-0x0000021080E1F000-memory.dmp
                              Download

                              memory/532-59-0x00007FFB02CE0000-0x00007FFB02CE1000-memory.dmp
                              Download

                              memory/1568-114-0x00007FFB02CE0000-0x00007FFB02CE1000-memory.dmp
                              Download

                              memory/1652-508-0x0000020781F50000-0x0000020781F7F000-memory.dmp
                              Download

                              memory/2680-667-0x0000018A63290000-0x0000018A63291000-memory.dmp
                              Download

                              memory/2680-668-0x0000018A63290000-0x0000018A63291000-memory.dmp
                              Download

                              memory/2680-670-0x0000018A63290000-0x0000018A63291000-memory.dmp
                              Download

                              memory/2680-661-0x0000018A63290000-0x0000018A63291000-memory.dmp
                              Download

                              memory/2680-665-0x0000018A63290000-0x0000018A63291000-memory.dmp
                              Download

                              memory/2680-666-0x0000018A63290000-0x0000018A63291000-memory.dmp
                              Download

                              memory/2680-669-0x0000018A63290000-0x0000018A63291000-memory.dmp
                              Download

                              memory/2680-659-0x0000018A63290000-0x0000018A63291000-memory.dmp
                              Download

                              memory/2796-745-0x00007FFB02500000-0x00007FFB02501000-memory.dmp
                              Download

                              memory/2796-744-0x00007FFB02B30000-0x00007FFB02B31000-memory.dmp
                              Download