5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium-Bootstrapper.exe
Size 6.9MB
Sample260805-hdeyyafa36
SHA256 5e6f74e8c460c747e6cd94cea8fa21271a83734b791e31a6e3c4d4e5f693efcb
MD5 81ee0f82e959c755bdcb29c510249fbe
SHA1 c6f9839f5452732af66b08a8ab9872f4f4bfc363
SHA512 5873121197183f06e492d46e90a73550de261494a1a1572d16b9f295ad094acdd0df1f2415d41127751847e11bfb1c5216a0cf71a0eeaff9d06e364936e33522
SSDEEP 98304:r+q6pQE5qQhw2AHVPVKKInBdw+gpiMQwySjcTc:rpYl9hw2AHVPVKKIQngwlj
TLSH
T11C76CF69A6BC00E9E466C1BCC2875223EB72B91517B153CF5A649AF60F23AD01F7F740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Madium-Bootstrapper.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
736	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303855558457333"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1688	msedgewebview2.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe
Token: SeShutdownPrivilege	1304	chrome.exe
Token: SeCreatePagefilePrivilege	1304	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe
1304	chrome.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1688	1788	Madium-Bootstrapper.exe	85
PID 1688 wrote to memory of 624	1688	msedgewebview2.exe	86
PID 1688 wrote to memory of 2300	1688	msedgewebview2.exe	87
PID 1688 wrote to memory of 2300	1688	msedgewebview2.exe	87
PID 1688 wrote to memory of 2300	1688	msedgewebview2.exe	87
PID 1688 wrote to memory of 4024	1688	msedgewebview2.exe	88
PID 1688 wrote to memory of 2120	1688	msedgewebview2.exe	90
PID 1688 wrote to memory of 2120	1688	msedgewebview2.exe	90
PID 1688 wrote to memory of 1132	1688	msedgewebview2.exe	91
PID 1688 wrote to memory of 1132	1688	msedgewebview2.exe	91
PID 1688 wrote to memory of 1132	1688	msedgewebview2.exe	91
PID 1304 wrote to memory of 2528	1304	chrome.exe	111
PID 1304 wrote to memory of 1048	1304	chrome.exe	112
PID 1304 wrote to memory of 1048	1304	chrome.exe	112
PID 1304 wrote to memory of 736	1304	chrome.exe	113
PID 1304 wrote to memory of 3884	1304	chrome.exe	114
PID 1304 wrote to memory of 3884	1304	chrome.exe	114
PID 1304 wrote to memory of 3544	1304	chrome.exe	116
PID 1304 wrote to memory of 3544	1304	chrome.exe	116
PID 1304 wrote to memory of 3800	1304	chrome.exe	117
PID 1304 wrote to memory of 3800	1304	chrome.exe	117
PID 1304 wrote to memory of 2140	1304	chrome.exe	118
PID 1304 wrote to memory of 2140	1304	chrome.exe	118
PID 1304 wrote to memory of 2064	1304	chrome.exe	119
PID 1304 wrote to memory of 2064	1304	chrome.exe	119
PID 1304 wrote to memory of 1548	1304	chrome.exe	120

C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe
"C:\Users\Admin\AppData\Local\Temp\Madium-Bootstrapper.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium-Bootstrapper.exe --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=1788.3900.2088837169750337360
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffaa73fb078,0x7ffaa73fb084,0x7ffaa73fb090
    3⤵
    PID:624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,7600378407368631600,12576605063321865412,262144 --variations-seed-version --mojo-platform-channel-handle=1740 /prefetch:2
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2056,i,7600378407368631600,12576605063321865412,262144 --variations-seed-version --mojo-platform-channel-handle=2072 /prefetch:3
    3⤵
    PID:4024
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2360,i,7600378407368631600,12576605063321865412,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:8
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView" --webview-exe-name=Madium-Bootstrapper.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3672,i,7600378407368631600,12576605063321865412,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
    3⤵
    PID:1132

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2360

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffab3d2c728,0x7ffab3d2c734,0x7ffab3d2c740
  2⤵
  PID:2528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1720,i,11308688520013192454,11310310856387012611,262144 --field-trial-handle=1976,i,1380852644671487809,15424499284607496398,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1620,i,3029540476269272897,17523588702100859705,524288 --field-trial-handle=1976,i,1380852644671487809,15424499284607496398,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2420,i,15858003981106625705,590319803983776462,524288 --field-trial-handle=1976,i,1380852644671487809,15424499284607496398,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,9889754953902376669,872568837122798822,2097152 --field-trial-handle=1976,i,1380852644671487809,15424499284607496398,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3560,i,9122139532304712760,1318354055941474054,2097152 --field-trial-handle=1976,i,1380852644671487809,15424499284607496398,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:3800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4132,i,13931919218549294755,471192842935409142,2097152 --field-trial-handle=1976,i,1380852644671487809,15424499284607496398,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4128 /prefetch:2
  2⤵
  PID:2140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4644,i,16629133237525958520,1641537220517089698,2097152 --field-trial-handle=1976,i,1380852644671487809,15424499284607496398,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,4079160253621783360,3862940857902904224,524288 --field-trial-handle=1976,i,1380852644671487809,15424499284607496398,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1c664ee0423df3feeb7f97f391cc673e19c72a4393d3010e845da903edfcd10d
MD5 fdc339d150370480b4db449ead00258d
SHA1 fa058bd9c64d460c85250bdc9cef62b7bbffee53
SHA512 fa0fd7341d5294f4e46bf60e782857ef732af0f1616db5565f2245b365e8b04f6874fcc886bfb8a32c3a5e9d1eaca026df7a67aa93710e8525b034d53381ab26
TLSH
T122E02BA9C825BC2718FD071950144646E751139B2E80655F363D510CCFB062641C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 49da916253f63556097f570396b8f6bd82d955b0ad4dafa83e0b84166f4af6e9
MD5 bcdb38b9ec582c5ef1bf76e3c4399d95
SHA1 6219f3ca555d6022b1fca82fc04183f936f935e2
SHA512 e8b9c65297d5b4b57e87c475fc87a56cb319c5820aa0544f88eab69846532ba7750497d466a1055ddbd0d38a2fe13535a0e9fdc386ebc9be90f9d722557122ba
SSDEEP 192:dRUjYtV4TWFv7shAPRp22F9wHsb+WNnpO0KAC2tTdVuVyIsnAUgtaJ:dRUjw1Y8X/FKwc0S2tu8
TLSH
T18642C83EBA14693B5CDBC22AF9227B57DBF5202131D42E94E6FC892C15EB5CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 e68fd76e3d8b69ab7156a8c081413b0093394f292c845484e0df721313ca76ca
MD5 612541aa1da4ffb080047b0d33dba376
SHA1 6145ac1952aadaa07ea928883819d479c316883f
SHA512 e4a02207d2af91cbe6c78e465cc2c4d48f7b833ce0ee26f0f8030fdada5c62533904b23bf038554a99d5a9c036c7b01feb04faf84ceb043010216c40120b2956
TLSH
T11BB0120080029501C08603B0218A24CAB3145F10AB0A1F0153E06926DC29561C62D060
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1d3e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a1d3e.TMP
Size 96B
SHA256 e9413a19eb308edd7be5d571116fdba9bf057e2a80f02cb290a8395990db0740
MD5 af3fd76fc2e038316ebed767602b619a
SHA1 f232ddf8f9ac4811fb682d404d44ddbd23cbd45b
SHA512 5cb418cb7f52f1df1ccabf43987960514916a5e4bd8ea7b3746a95c3779c5294f8d340ee59a4f629e8801a046083b5ebbf8e71ffbadd1622602328b58b7fc953
TLSH
T184B022ECC2023203C003C3F03080AAC830B0CF28CA03A22282E00ABACC3023000300B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 01bc9e7219822c1f9a1940154d2d4c7fdcb99e3b77d1a502aab4418727244e40
MD5 10672d20bb29578c9661e8c524225e4b
SHA1 6a61737dec895546633a72d16d0fb134351182e1
SHA512 4c1e29fe6fc39ad78c35ec0e49501abe93b5151cb1697297cb87451efdb476a96fd6fde2481dca9ee5fc76a066d6168d9d76d3216f2b5d83049280344594e187
SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:4m7Rkm1tYpBeh2BAoK
TLSH
T1AFC3123B5D75E8779979A70EB08E0B1F1EF149A2D920DE92C8D86A0437F97C90A44D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 044043a11fc917384f4d6ca8491ad9c45697e9d9760258dc56d0b3cec33eaea2
MD5 67a3dcd8401e8657a5da9238ee96c971
SHA1 d7660ef3177f7149a82cd6b7eab2c37ea903bf78
SHA512 427e1bde9ce2caae64d613a6ed0a220073866e35c888a3fae17ab315f8c6a63c28bf06e60dd6a2cf549621aa89bc2e08d535a39a1da646cf8e2c3f10aab529fe
SSDEEP 6144:5DyU0gy2g9XWty7WK9Qm7Rkm1tYpBeh2BAoz:pTvg5Wtm9j9oBGcAoz
TLSH
T10B3412373DBABE37499C6B79E04E1B2E3EE14936C594DEB381E4A50467B9BC91600D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 84363a9d16712a813816a8842e91bb72b3831ec69dbadc2d76e72345b1d82804
MD5 abbacf85411ef2d96010861d6ee9ff70
SHA1 0162c1fbb912e6ba8bb86a7238dde14f57d04568
SHA512 034460c868111bebe6e95a0c05d1b68da020dab2b86442b9f2544f6267be46ec019b6112f0c2f34cf1de01fb7395576ab983dd99388e3caaaed8cffc4fd0a096
TLSH
T1E1D0122272224134C0102033058272491800C51B404640005438E91D1F244900D02552
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6f7642ce8cb309b8f2938788b22a0e5f6507ec355c2cefd3945af998dbe3c633
MD5 baec4232de23ed0fd93e0079cf907148
SHA1 2bf927f77499f73c2cce1e502fbf787b05be3c6d
SHA512 3252541029bc72ecede91a1b7694d085e0350cb46e28cb68a623d68756b91a8aff1ac4c395b447ba45d7329d3414f3c05d7aa3f45b89dfdec32261040ed92ba3
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Local State
Size 1KB
SHA256 12c674971b2e44fc74ad5605110f8edbe0f63f5b9617b5e3abb1b1b9a16cb989
MD5 ef4c5a1f23b7a4524b4d636b7ba073bf
SHA1 6f91c29b0b1f22899d90921994c14758895658c8
SHA512 660a569c9e7a229cf2e3d27a1ca07b16eeceaf4582434f792841240ea5e468a8569693f9ceee1bca49061f18de4f9c82d5cb0287b93046541f5f5a16a765798f
TLSH
T1183182B2E4982B376C9225C6B1127B57AD32B03AD2545E4CA5EF1B0C02E71CC692AC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Local State
Size 2KB
SHA256 33392eb10c57750b347e6a59fc7baaf43015b7c48b8744958566f8a54165793f
MD5 4b3a58c6328722422c1fe719412058e3
SHA1 326658f6be93404ed123bfd7df8c2cfb043b1dfc
SHA512 a68b84349a2e575fb33ef04ad5d00cc1761dfa5c291f34bcfa285b20e937c3a705c40c07c5304a12673b98e0f56f61ce0dbfc7272b20de3e2ab87d0987c9bbca
TLSH
T13D51C773B808673B49E35589B9493F12EE32A171E7A52F5499DE2B0C01E729C3306C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Local State
Size 3KB
SHA256 86aa0c01794a38c5c6cfe88badfb1f2e2e9f2fbc80b9570575950d000d978185
MD5 ecaa47838ce0c22ecbf040b9f40fe8c8
SHA1 fca42ea7b87c14c22f4ce027ca28b2f5d17af6af
SHA512 a3dee30842bdb1a401df39ce147cc03817378d27ae1734bd0eef952a4e8ab85757bbaf5387003eb75982ca1f43f58776916405a289502cfe384cf1e114b1cc10
TLSH
T10671C972A864A63B4DF39945B8853B06BA626137E6D53F98C9ED1F0C01D73C82342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Local State
Size 16KB
SHA256 25a0bb9581ee9335b8ce2e44c1f96dd91c41674beeb2691d641b354dbc16897a
MD5 6ba48facd1961eeddb7ba068b8807f93
SHA1 31058c628bb8eb2708fa5d7ae474bfb534d7ae05
SHA512 a7d93468bd20cb1b7ad7a841e89f24b335f91f71227329b631e7594cc5d926f3cc8ab9aaabe25c658f4f1622dff6f42687b018c606990fff038517efedb23700
SSDEEP 384:zF+aQikB+z/xvxjg/qhEm3NbNoCARTJVLM9z7:8/UxvxjgC+mp2TJhMF7
TLSH
T12F729E2754683B2798F3F9457A4D0B5BDAB99472D1C26EB84AEE6F0D06C73D81342C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe57f608.TMP

Path C:\Users\Admin\AppData\Local\Temp\MadiumLottie-{1B463CD0-CED6-4856-8C7D-A9ACDF799FD8}\wv2\EBWebView\Local State~RFe57f608.TMP
Size 1KB
SHA256 deedf80107f5c0cb22f16484945795370f6fb043a0b4894c1ab7b7f134e3d106
MD5 9d8d320334ad96638e453915ee98511f
SHA1 759b9b688c655db0ea4637cbe3449fa6fddf0173
SHA512 42095d5a0c7a60d17c71a5349e67a9683281a86097cea21d0256470f93a0f6553c20245df574752efc128a4770738156888e699e8f5874d62dbf0d72f41c67d0
TLSH
T1BE2165B3D4983B7B689614D6B112BB466D21B03AE2545D0CD5DF170C03E70DC5A2BC77
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1132-127-0x00007FFAC18B0000-0x00007FFAC18B1000-memory.dmp

Download

memory/2120-79-0x00007FFAC3460000-0x00007FFAC3461000-memory.dmp

Download

memory/2120-80-0x00007FFAC3140000-0x00007FFAC3141000-memory.dmp

Download

memory/2300-29-0x00007FFAC18B0000-0x00007FFAC18B1000-memory.dmp

Download