0f9de1348ae8631769a4a59ed17aba91e83fdc251af35b8334f5982bdec57e3f

Analysis

user interaction
yes
max time kernel
128s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cracked/RUNTHIS.exe
Size 6KB
Sample260806-xej2lsybme
SHA256 0f9de1348ae8631769a4a59ed17aba91e83fdc251af35b8334f5982bdec57e3f
MD5 052315b2b90d36ea7c81149caee90541
SHA1 740333b21d6af28653cfe8e6449d48594b7f00a5
SHA512 fcfd81033ef65061ada88a1618a1c24099a0d2a50fd907189badd70cc7d9bb56f857873ad8c7292098b4333deadb2a1d3cd599c6790549b058f4fdb740610911
SSDEEP 96:3GZjaEEISl7Wwlg2xNlEJ5YAyW0PGhGaa5iS+NbzNt:IjaJISNlJxNlQ5YAd0PGhGzMDN9
TLSH
T1F9D1FA119BF84712E1FF8B7C1EB303202772F623953A878F68C8629A6D127940675BF1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
492	luau-lsp.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_562041104\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1444602471\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_562041104\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1444602471\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1444602471\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_562041104\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1444602471\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1181028207\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe
5796	Madium.authspoof.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4636	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5796	Madium.authspoof.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 5796	5848	RUNTHIS.exe	89
PID 5796 wrote to memory of 4636	5796	Madium.authspoof.exe	90
PID 4636 wrote to memory of 5860	4636	msedgewebview2.exe	91
PID 4636 wrote to memory of 4204	4636	msedgewebview2.exe	92
PID 4636 wrote to memory of 4204	4636	msedgewebview2.exe	92
PID 4636 wrote to memory of 4204	4636	msedgewebview2.exe	92
PID 4636 wrote to memory of 4204	4636	msedgewebview2.exe	92
PID 4636 wrote to memory of 4792	4636	msedgewebview2.exe	93
PID 4636 wrote to memory of 4760	4636	msedgewebview2.exe	94
PID 4636 wrote to memory of 4760	4636	msedgewebview2.exe	94
PID 4636 wrote to memory of 4760	4636	msedgewebview2.exe	94
PID 4636 wrote to memory of 2852	4636	msedgewebview2.exe	95
PID 4636 wrote to memory of 2852	4636	msedgewebview2.exe	95
PID 4636 wrote to memory of 2852	4636	msedgewebview2.exe	95
PID 4636 wrote to memory of 2852	4636	msedgewebview2.exe	95
PID 4636 wrote to memory of 2852	4636	msedgewebview2.exe	95
PID 5796 wrote to memory of 492	5796	Madium.authspoof.exe	96
PID 4636 wrote to memory of 3004	4636	msedgewebview2.exe	101
PID 4636 wrote to memory of 3004	4636	msedgewebview2.exe	101
PID 4636 wrote to memory of 3004	4636	msedgewebview2.exe	101
PID 4636 wrote to memory of 5660	4636	msedgewebview2.exe	102
PID 4636 wrote to memory of 5660	4636	msedgewebview2.exe	102
PID 4636 wrote to memory of 5660	4636	msedgewebview2.exe	102
PID 4636 wrote to memory of 5296	4636	msedgewebview2.exe	103
PID 4636 wrote to memory of 5680	4636	msedgewebview2.exe	104
PID 4636 wrote to memory of 5680	4636	msedgewebview2.exe	104
PID 4636 wrote to memory of 5680	4636	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\cracked\RUNTHIS.exe
"C:\Users\Admin\AppData\Local\Temp\cracked\RUNTHIS.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Users\Admin\AppData\Local\Temp\cracked\Madium.authspoof.exe
  "C:\Users\Admin\AppData\Local\Temp\cracked\Madium.authspoof.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5796.1608.13500171152377190199 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView /prefetch:4 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc18c65fd8,0x7ffc18c65fe4,0x7ffc18c65ff0
      4⤵
      PID:5860
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1708 --field-trial-handle=1712,i,8143108707976862663,6915017757193832188,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:4204
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2000 --field-trial-handle=1712,i,8143108707976862663,6915017757193832188,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1712,i,8143108707976862663,6915017757193832188,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2884 --field-trial-handle=1712,i,8143108707976862663,6915017757193832188,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521 /prefetch:1
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4396 --field-trial-handle=1712,i,8143108707976862663,6915017757193832188,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:3004
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=1712,i,8143108707976862663,6915017757193832188,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5660
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4572 --field-trial-handle=1712,i,8143108707976862663,6915017757193832188,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView" --webview-exe-name=Madium.authspoof.exe --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4512 --field-trial-handle=1712,i,8143108707976862663,6915017757193832188,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:4ada4ec5f41badf2c164a7ee26988a4239b31521
      4⤵
      PID:5680
- - C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
    "C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe" lsp --definitions:@roblox=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
    3⤵
    - Executes dropped EXE
    PID:492

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

luau-lsp.exe

Path C:\Users\Admin\AppData\Local\Madium\Bin\lsp\luau-lsp.exe
Size 16.1MB
SHA256 9e85ce9370f208c97f1dfc1b8fcf7185fe64386f23130a65fc834f5323a0d653
MD5 0e14d186ed05911115868aec341ca13c
SHA1 525708cd63fbcaa2bd68225aa2411b0f46c3e9fb
SHA512 e3acd3aad750e35cf9993384fc274db9ffdfd18099d4fd90a39ad0c039410d4e451baa6a2e1a5b1fd2658281bed8d33a2a3d2403675ef3976f10322ec5d5d029
SSDEEP 393216:E4BgLVggOglggqgTgXi17gCFggqgggocgQgejM9gggggdvFBggggjCggggoggggg:KBggOglggqgTgXi17gCFggqgggocgQgP
TLSH
T188077B3A21AC10DCF1BBD0BD8BCB9E47D6B2340903319ADF0591569A1E1BDED4A7E721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

docs.json

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\docs.json
Size 44KB
SHA256 0a44d5ed4ab0da89ee2e80fe7369c399ad1f3c3c2c181a7f95b22f69036ca54e
MD5 d8609297ff0b94a60784d9e94f0f841e
SHA1 4ed3bcc553171e45cdd86c6af1055911b5ccf5ce
SHA512 95a91986d33bad0f3d394ae5c3230e9f49ffcdb367919df3ba92282a39e288465b258109e42948f5d9c44b13b37db91bc617074d3ec727345f52b4a68b0781f4
SSDEEP 384:Mk6zWVCu6tqYXKNK3cSZc4ImuNclknkpf+qZFHzYI:Mk6zWSso647QclDpfJZNYI
TLSH
T12813EFE37FD545030EDA12837536E258A43ED0EDF48E5C6ABCECBD18C6488AE1627647
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Local\Madium\Tools\lsp\globalTypes.d.luau
Size 751KB
SHA256 dca06de17994c51bdd3f5f9fe8610fd38277a14b95a88a09527104392d317c86
MD5 42f0071399e252b89d592e911c6e6347
SHA1 b8cda9cf07f5259de8b5549f654c3083a0933cd2
SHA512 b80de9626f3cf5acca511873b41d0710ac9a60a5966200d36ce5bf74f6a63b99e37a5c61d9158ec0116cca91b1a2387ee448d08f7c6b0b40820baee04539d00d
SSDEEP 6144:UhFsApJtIZaXnoQOeugC4BNKoLJplUStDHb2YxcHmz8fyfJ7qSiqCFydNH/AaJOF:ZaXnoQOeugC41DHvzJCqI
TLSH
T171F4661DB609B1700D8F73F6A9BF8844A8759281911850FCA0F8F78A177F87D2396ADD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c59d81e3c4381a74b24bb50c9c9e3e4b063fc3f57cc407e4b3048cc84f918b24
MD5 a30a16332011a1f0f4d3255d34601d7f
SHA1 0eb736601917c078226eb503c53a677de45119e2
SHA512 9afe5f77e9e1e3155c4bf73e860576947eec2c61536f82af34100a2692c29501e7ecaaab81a0856fe8f6bf1cd11d7a52a8cf54776cef66f3be2ea9ff295573cb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5b89725e4c6b4e0cc207566e004f50802b4d581fcb641bc4fdef8a1f3e324d1e
MD5 6a3bb62d82e1f923b861b87f79829940
SHA1 7faeb0c2e2ae67452b1e04547eaf204bb08929d8
SHA512 ecef37e92fa6de91cf7317e305a832f4a6980cc986c18ffa050509813f1973744d8462c8df03f1164b2c2063bcfd0549508bad2cb7ae3dfb8bd3fac2f73838d7
TLSH
T1D4D0112A3202C3BCC02020332083A2080C02CB0BA00E8008A83ACE2E2B880A02E22882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 240B
SHA256 daa294e610e9bae7f2baa926aa0d295fbb065e9c44714db85d41078f66fc3e23
MD5 b9885c1f07c2b7e2f872fad413428b13
SHA1 9254627afdcbd80dc98af67076081b366ca41e4d
SHA512 a4bcc1381fe419d9f58ee65e0fea067a8c8c15e31d44350d3781e5a8d4698942435064aa7e8345bfa0a2a8a3cc018afd41adb332896b9008f2833bb13eb0cbac
TLSH
T1D0D08C2003782C42CBA726B120C0135530B9C8C00F434CF24041A0B0DDC5341872FAD0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c1c0.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59c1c0.TMP
Size 48B
SHA256 c3e4b11b22fee96052663e5517d38e8d75ba8a19a04bb4da865367ec179130a1
MD5 31d8ecc9c0317770ba1d57117fe920a9
SHA1 c490da8f04feee190bc5e5c791ac75df564dede4
SHA512 bc5440101e1364a4d266c7c3fedb591ec97b64b24a787a476564d32d99a8578437eefbe86ba367fd6659668bae508d1b9e5981009242f3392ef64c8745438a27
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 302ea2fb4f68400e803d78c5685db640f48ee4f2d34014e7c67f19ae5fda2cb1
MD5 ad622abe96e0511bc9f839dbe9761103
SHA1 975f81caa9561ecd81e88f58afe3056561008dd1
SHA512 f4bd2dc96d682584627b8a090b25fb94994323ccdfd916e99e63fd50915cb866b2d5dc54463dfa8c330fd9fa57ab7bb78e8c7f23b74df170f9f0340bf50d469f
TLSH
T16D21C4A7C3E4C67D8A1167E027347917CD2E051992282D27CEDAFFEA67E1071E22160F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8416.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\Network Persistent State~RFe5a8416.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences
Size 6KB
SHA256 141b6a6c9eb5b13f6344a420c78b61a23b09b621ff1c5ab26ae7e6d7908fbf76
MD5 af3ebf00446103cb6fbc07405f91fdb4
SHA1 ee6b35e5f6fab4ee3c3730210ff8413968b20e7e
SHA512 1eeb057dabfdb0ef8c80f727f737ec7d7aabd3bd6c70a473c1f3d501e1595519bcb09b2229d1e423c0f42631083ae5021a11d1db9e688312ba723bd4af386315
SSDEEP 96:stpSU/dCawZ0Ca0mb98k0o5h16Z0Ns7/x+6MhmuecJoZ1ejeuK+g928XM1C7K:stAYDMxNTonNsV+FdoZQjCPG6K
TLSH
T1D1D1A7416E2479BB4CCBE509BA397B13D2F9A03265D51E58E7F8492C04DB6CC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59b6c3.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\Preferences~RFe59b6c3.TMP
Size 6KB
SHA256 218c4a9269c1af03dfc8b0f204fd02d8ef2126593e84432d2207e78a616d51b5
MD5 1adcaa8a124a14f747a4397fdebe43b9
SHA1 96496b44a77eaaaffcbfde548f90e570ff88a63d
SHA512 3445124a3b97d74a49036c702378f0ebc46633c3680537ab4d1df131504214ac5ef7cc152ee8d64c702177adc694b120ba097c3f5da432c6cc68751658df38ca
SSDEEP 96:rpSU/dCawZ0Ca0mb98kWdo5h16Z0Ns7/x+6MhmuecJoZ1ejeuK+g928XM1C7K:rAYDMxNdonNsV+FdoZQjCPG6K
TLSH
T189D1A5415A24787B4CCBE509BA39BB12D2F9A03275D51E58EBF84A2C04DA6CC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 119675fbda3434b961725245847272aa7e9e8c44a0c05df5f1388b40340a1902
MD5 1f6229169ce74e4d50b0dec5cc3f3b8a
SHA1 8077af752b242d0f8901b6a716ef5fbeb51241da
SHA512 00ed10232de2ee596eac87e1384d5d74f86a27b34ea277286c887fc74ab63995d03fcbaa8935c7c286eae02b506b6369cf13031a87607630fbf9913ea959b1ff
TLSH
T1CF8174666974A9774EF3DA057D463B13AB668063EA943FA4D6EC0F0D02D73890342817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 15KB
SHA256 1fc4ee379fbc9a2617d98b2a4cdaf7bdcad97b424498a7da226f90fad35b0a78
MD5 6d1f03f6560f4511ccfb189b28e3fb77
SHA1 ba6109c7a6ef8b041e876b2629f6b8e8c61ccb46
SHA512 d3c1021da58cbdc28ade5f0018bb972896ee515ec7109d5bd0910577aec10415fd9a93c6a39eeb23e481394d3f5042e110fe8e4cb29f718cdf9bf792a607ae5e
SSDEEP 384:2+aQikB+z/xvxjg/qhEwNBSKZEhC4GsuEt:B/UxvxjgC+2GCE
TLSH
T164729E2B18797E339AF7EA017D5E1757CAB984A295C27E748AED5F0E07C73880342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 2KB
SHA256 bdeced860eaef12c630ba9ae7a97bc7439cec1947d463a77ba109558b9df21ac
MD5 846d92d8f22349208309ca56a140997f
SHA1 7a50f2939f2597f1a904f20c078e352dd2d60b17
SHA512 7d12eae12a07043d2e46faac0edfa0d447b4649af72cbccfd63e9d047f954dbc01041d50a6612ed5c0b67ca01f1ab1bd7125c4f1a2bd2484c39c06e2b75620fe
TLSH
T11A5161727924AA778EE74A05795A3B339E3A80A2AF512F2096DD1B1D02C765C134283B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State
Size 3KB
SHA256 a749c4a2817315fe5d4c9e945962a389726c4ce8c71ac72855d60aa66d474896
MD5 806abe6f0c945bcc5f23c2577e1e4989
SHA1 021fff44b191548128e0fa4cca82d4162623011e
SHA512 b3b462d10db4c3c74ea64fedbd3bedd4e98dba4abb98c7e8a5642706609123a745237b83af250fbeb9aef8704f07363f15299e7701e5b4e63bc533871057cd2a
TLSH
T1216185766974A5378EE38A05B9863B26AB668063EA843F64D6EC1F1D02C739C0341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe596826.TMP

Path C:\Users\Admin\AppData\Local\Madium\WebView\EBWebView\Local State~RFe596826.TMP
Size 1KB
SHA256 daaa8c05a5917657f73980e69ca6962eeaa32cd057f030ea5fb783e1266b14cc
MD5 a9ed4c0a39c7b76009c9402b64f12c21
SHA1 3a4844bdbcfe8e59ef9ed34666df389f34c32e0b
SHA512 b5b21969261e5be666513399ea9b2c087ab17d30d6a34e8ee172a574e51e1ccc71bd02af96f3779752c3ab28f55a2126cdfd797fbab89bcad3892b64b130078a
TLSH
T1DB2165B2A4B45B33DEC7164625177B372E3640A783000F1091CD9B1E03D729D862A933
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2852-65-0x00007FFC3E640000-0x00007FFC3E641000-memory.dmp

Download

memory/3004-315-0x00007FFC3D6D0000-0x00007FFC3D6D1000-memory.dmp

Download

memory/3004-314-0x00007FFC3DC80000-0x00007FFC3DC81000-memory.dmp

Download

memory/4204-26-0x00007FFC3E640000-0x00007FFC3E641000-memory.dmp

Download

memory/5296-377-0x0000023759EE0000-0x0000023759EE1000-memory.dmp

Download

memory/5296-367-0x0000023759EE0000-0x0000023759EE1000-memory.dmp

Download

memory/5296-369-0x0000023759EE0000-0x0000023759EE1000-memory.dmp

Download

memory/5296-378-0x0000023759EE0000-0x0000023759EE1000-memory.dmp

Download

memory/5296-376-0x0000023759EE0000-0x0000023759EE1000-memory.dmp

Download

memory/5296-375-0x0000023759EE0000-0x0000023759EE1000-memory.dmp

Download

memory/5296-374-0x0000023759EE0000-0x0000023759EE1000-memory.dmp

Download

memory/5296-373-0x0000023759EE0000-0x0000023759EE1000-memory.dmp

Download

memory/5848-0-0x00007FFC1C67F000-0x00007FFC1C680000-memory.dmp

Download

memory/5848-3-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5848-1-0x0000000000E40000-0x0000000000E48000-memory.dmp

Download

memory/5848-2-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download

memory/5848-235-0x00007FFC1C4F0000-0x00007FFC1CE94000-memory.dmp

Download