5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb

Analysis

user interaction
yes
max time kernel
9s
max time network
23s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260804-vv729stscy
SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
MD5 81ee0f82e959c755bdcb29c510249fbe
SHA1 c6f9839f5452732af66b08a8ab9872f4f4bfc363
SHA512 5873121197183f06e492d46e90a73550de261494a1a1572d16b9f295ad094acdd0df1f2415d41127751847e11bfb1c5216a0cf71a0eeaff9d06e364936e33522
SSDEEP 98304:r+q6pQE5qQhw2AHVPVKKInBdw+gpiMQwySjcTc:rpYl9hw2AHVPVKKIQngwlj
TLSH
T11C76CF69A6BC00E9E466C1BCC2875223EB72B91517B153CF5A649AF60F23AD01F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1588	Madium.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3652	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1588	Madium.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 3652	5956	Madium-Bootstrapper.exe	89
PID 3652 wrote to memory of 2428	3652	msedgewebview2.exe	90
PID 3652 wrote to memory of 1764	3652	msedgewebview2.exe	91
PID 3652 wrote to memory of 1764	3652	msedgewebview2.exe	91
PID 3652 wrote to memory of 1764	3652	msedgewebview2.exe	91
PID 3652 wrote to memory of 1764	3652	msedgewebview2.exe	91
PID 3652 wrote to memory of 4200	3652	msedgewebview2.exe	92
PID 3652 wrote to memory of 2692	3652	msedgewebview2.exe	93
PID 3652 wrote to memory of 2692	3652	msedgewebview2.exe	93
PID 3652 wrote to memory of 2692	3652	msedgewebview2.exe	93
PID 3652 wrote to memory of 2416	3652	msedgewebview2.exe	94
PID 3652 wrote to memory of 2416	3652	msedgewebview2.exe	94
PID 3652 wrote to memory of 2416	3652	msedgewebview2.exe	94
PID 3652 wrote to memory of 2416	3652	msedgewebview2.exe	94
PID 3652 wrote to memory of 2416	3652	msedgewebview2.exe	94
PID 5956 wrote to memory of 1588	5956	Madium-Bootstrapper.exe	96
PID 1588 wrote to memory of 5648	1588	Madium.exe	98

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5956.2952.2118007458702668510 /pfhostedapp:82b07437d6437cfacf84556c6848e2eeddffafa4
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView /prefetch:4 /pfhostedapp:82b07437d6437cfacf84556c6848e2eeddffafa4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x140,0x194,0x7ffd37225fd8,0x7ffd37225fe4,0x7ffd37225ff0
    3⤵
    PID:2428
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,11835066570463047712,2766849924405721894,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:82b07437d6437cfacf84556c6848e2eeddffafa4
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1776,i,11835066570463047712,2766849924405721894,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:82b07437d6437cfacf84556c6848e2eeddffafa4
    3⤵
    PID:4200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1776,i,11835066570463047712,2766849924405721894,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:82b07437d6437cfacf84556c6848e2eeddffafa4
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3572 --field-trial-handle=1776,i,11835066570463047712,2766849924405721894,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:82b07437d6437cfacf84556c6848e2eeddffafa4 /prefetch:1
    3⤵
    PID:2416
- C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
  "C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1588
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1588.5824.7699411854794758138 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    PID:5648
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x50,0x7ffd37225fd8,0x7ffd37225fe4,0x7ffd37225ff0
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1928 --field-trial-handle=1932,i,784969192963454514,464604682819870950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:272
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2596 --field-trial-handle=1932,i,784969192963454514,464604682819870950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2604 --field-trial-handle=1932,i,784969192963454514,464604682819870950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5584
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3532 --field-trial-handle=1932,i,784969192963454514,464604682819870950,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
      4⤵
      PID:3912
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe
Size 13.5MB
SHA256 1f95d78d653b1333731aa860598475a7532037d2e9f803c83f75b6eadc66dfa5
MD5 23e1b97c9b104e4a6d0432a8c8000496
SHA1 75eaa7184853f7aff363befcec625e1302f62940
SHA512 9f666471148d909b17a00a51374d834fb880a8777df74485d3091757d61cae6972d67b54be1f448d4012afa9bc38246326261ef86e6687c6c0ea06a323ac692b
SSDEEP 393216:nwfBqWTa3LqxWB04nJIslV0PTmP+00EVkJu:wJClxlW0lV3
TLSH
T15AE6CF07F64081F8C4AEC278C37B9536EA72B889452072AF57E45B112F2BB706F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ui.json

Path C:\Users\Admin\AppData\Local\Madium\Config\ui.json
Size 34B
SHA256 34faf35078debf5f4b594e7e62fda4f2cfe5a1569e9125320e0ef9e2ef61404a
MD5 e588022031c7c2cc71418c3c8ed68c5b
SHA1 77ea752c8e2b17792e48c6a45a0fdde81a9a665c
SHA512 33f84dcf3d236bb844b27a8926e190c3ca0fb2359ccf3fd781f939db752772b57c3f2dd208caf4eaaa1e21604882300aa60d4776e13a2c25ff64652ca2c457aa
MD5 SHA1 SHA512

Submit Download

docs.json

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
Size 44KB
SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
MD5 d8609297ff0b94a60784d9e94f0f841e
SHA1 4ed3bcc553171e45cdd86c6af1055911b5ccf5ce
SHA512 95a91986d33bad0f3d394ae5c3230e9f49ffcdb367919df3ba92282a39e288465b258109e42948f5d9c44b13b37db91bc617074d3ec727345f52b4a68b0781f4
SSDEEP 384:Mk6zWVCu6tqYXKNK3cSZc4ImuNclknkpf+qZFHzYI:Mk6zWSso647QclDpfJZNYI
TLSH
T12813EFE37FD545030EDA12837536E258A43ED0EDF48E5C6ABCECBD18C6488AE1627647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 00d4b48c89b6b468d7ad72406939e3ba060eba14b62287551ebd25b35f08ed1b
MD5 81777e202782d9a34bcc23e77760e6eb
SHA1 f98256bd7ed945bf5b56fbe9884d35394f6614df
SHA512 ebd99a325cdb8c8b1727d2319cb9663d304f90c853a1b73ab6f199fc33f7274344a48048d5ce58cf34d09ad202b3e8912a8a2ecc334752e72d696e664d82fdf7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 55063955e674b06d47ab3398e67fed2f60570ab960db25dd5774283ec759c845
MD5 59b5f8d96785f0012af02a0d81c57d14
SHA1 be4d36e0ca253286b94fd9c86edc096e9f45dd48
SHA512 6ac4fb167c1299b864c82bcb0f48fc0a6c260d1195d2d6d976e39cedeed582a09ad685f9dcc04bd79afef6c0927a21cdfc5162cf45a929a5b1330b456fcbfadf
TLSH
T12DD0241333111134C43031731313F15C1540D51F4005C105743CCF5D1F040D41D07C53
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Network Action Predictor

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network Action Predictor
Size 4KB
SHA256 9827429749037198cb3d19a851ccff2adafad344fbade7220aa022d3c9e2fa85
MD5 9088df5de5b8306c52e744141a100532
SHA1 0aea85a36ef3ddc53df198227fcaf212139ae1db
SHA512 96c0c8ee90bd8aec34ea905f48e76ed7dc370d24f64efaeadf36e9b59b9ff01856ed837b5169241ef2bd4a6b8fe2ee77de443b09b9ee604e39f9ba57929859e8
TLSH
T15C819285F7C02420DA346EF3A4824BBD5E72CA82A5124B93097002D0FCA74ECCC796AA
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 15KB
SHA256 b0128f998af4787e359cfbabcf7759989da17f27894afb76c2e4329a421bc2fe
MD5 29fdddae6739dae10d1a772fa45a89ca
SHA1 99e232e649fa83064bed09c33f39c143aaf6e844
SHA512 cf4d2bca1e8b55b9f9f24676bac34d54594493cc2bf58b5d9c5bab6f8580803ecc58df8c8237a0a1baf255a0f5c483ca052964352d9c27d826d0ce9a39b4dab7
SSDEEP 384:8+aQikB+z/xvxjg/qhEwNBSOKE3hd627j9zs:b/UxvxjgC+n8P627jFs
TLSH
T17F72AF2B957D7E3395F7EA057999079BCBB9A4B290816AB849ED2F0C06C33D81302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 ed95c933bfae9b67f52dc326bb2eb15ca3145f12bc37ebfe4c4d0f62805987be
MD5 5520a54c5a76fdd88c070bde39334de9
SHA1 8ba576b822e01a114d49ac12b5e897b8ff541668
SHA512 acb45ba5ce31adb6d022ea671a7b0994a424437b0928d027f6aa3d8ae2faa7d559f79c947c18ab4c6da4bb0b613931f0529005148038c4b9c9080db4620535b9
TLSH
T1AA518433A829673389B24615BD972B73DE7A60A5DA522F6496DD1F0C01C7A8C2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 e347e521d8ce9154a4f89f07c54abf7805772f383a74da5e462d91e782df679e
MD5 127696d048cc0d74c2def9f59cad660b
SHA1 084242a7bcc5d97038eeeb3669503ddb46ca01f8
SHA512 c9f1de86748d5accdba8c638eee0f7af6c172e6908dd8ab5b86d488f3a5b83246daf3983a2700d2757e650e0a996e265aca3763f2556f56ebf021d4b7e5386ac
TLSH
T1F76187366979A6374DF29A05B8C62713A7A66037D5813FA4D5EC1E0C01D778C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe593d0f.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe593d0f.TMP
Size 1KB
SHA256 b6a72fbeaf564c200f5ab7e4a70256ec1e56754111da26d0bd0df1f38a6ff454
MD5 f93b6772c243e45b9af269fd0606458a
SHA1 6241ec58beaf8461d632479a0e07a8a048a0a581
SHA512 944d782294b2bf9e687d7a282c91867697f465e701f3eb2fda372269cb6b21f80cfdc015358db87d377db8d330bf49cdfe29803aa1384c7bb4e088211d7253a5
TLSH
T1B82187B2E57D5B33AC91531765A37AB7AE2220BA85010F44A1DE1F1C03D768CA56BC33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4111142ee5b165fd0e6ac256b41e8d1d802d76720b37745c159d4b5e4363ce8d
MD5 faa5afba7554981d46cb3b70169c18a8
SHA1 94eed9e4301cba0e5e92c186dddbb5064c2fcf0c
SHA512 314773e92c5f87d703590caae41dc625201b7d2774a83854bbdbabf0db55a963663c8d37a15a01b8d8f0fa081043047c64bbdbd7dedca62be6b4639e92962e40
TLSH
T16CD0122372131138C02020370503B2180442C50F41454108A428952D1B040500903891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ba2a2dc54d2b3c13ac0b63cb40e569a97c2625df4e397acd2f1a9d4d7fbc5264
MD5 c1bc29adedf09c8c9dce4ad576f60b7c
SHA1 9b34103f645d996cedfd8f348e79e4d91ebd4c68
SHA512 c3cfb6438dce91ffa0f4bd2ac1e1b9e6bd66fc6a09c017d44227db442bb8001e792086345af13204ea59394cbbb5cafde51646d8c1de4278963dfb91e49a11d9
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fd612574-4398-4c00-8828-5ba94b58608d.tmp

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Default\Network\fd612574-4398-4c00-8828-5ba94b58608d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Local State
Size 2KB
SHA256 72c0b2a87d64a24b8e3d757991f3e4701988e0addd84a2d64b6df2f555d71ca9
MD5 ab90bd392ab9137b3c4812a5896b1269
SHA1 cb54939a0af843aa85386121e9b8e1b342a8a36a
SHA512 deb93b49c178f87f5bd5a1234dc121d5add9d604f425d9f8e5321d2b8180a7435c0c3487ee0b6175e90c1e33cb373d41dbad29102c9cbbe2cffb6eefb6a54dcf
TLSH
T1FB5174336C246A77A9F64A0479CA3F339E36A1B59A511F249ADC4B2C01D719D2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Local State
Size 3KB
SHA256 68b7c1b64a7e1515e1766d875c4fc77f810ce61834937a794321d957e77d8680
MD5 6999ff0f5760fd92caefaebd1b497263
SHA1 52fb7f08910f476288ecea916b902121aa9a0206
SHA512 b31e8e483786ebefa7625ace584ead0296773502c820f2f4bd3fdc4abcdc57d19ef8d96cd19142f88ee5b5f54218acb1fd61af336b3b837599941401e086e159
TLSH
T1D181B5226C74A9276DF69A04B9C63B17BB756173E5806FA8CAEC0F1C41D72CD1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Local State
Size 3KB
SHA256 7f2b5b9bdaf145c21560781d4fa0f99756bc117282ad0515a17fd82bb3f14507
MD5 97824d61472ce27b61e4cc53c5f60e13
SHA1 9dd0f0b1500ced7b180861dc58bb54cd92939803
SHA512 c7cea8d37f29d43c577322d4798caca46585be3716d9370e398fe0e1442889adf356f402080bcc72810133f6bd9efe0fa8a73dbba5c86318ef1d7700dfb8ca73
TLSH
T1536162266D34A97B6DF29A04B8C62B26A7A66177E5813F68C6EC0F1C01D72DC1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe591459.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{4277D585-6F3E-4E73-86AE-13529FF49CA9}\wv2\EBWebView\Local State~RFe591459.TMP
Size 1KB
SHA256 1bef3d6c19f1404a556cb89092949ed589731e4968711b6ea744765b0c081520
MD5 8fe6273b4ff42efd7208ec6cc9d13d4e
SHA1 c5519c91982f47394e9c327610800ff5e9a456fb
SHA512 4727ab5fa7816fab4e71078ec50280c1a313571b27d34051212cc710d613c178446c3520bdd4d2992b75f6da28e6b1199a48e080681532297d165d308e749f69
TLSH
T16E213572E8385B73BCD5264521C77B676E32A1BA83404E1495DD8B2D03D20DE665AC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1764-72-0x00007FFD58870000-0x00007FFD58871000-memory.dmp

Download

memory/2416-105-0x00007FFD58870000-0x00007FFD58871000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads