37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf

Analysis

user interaction
yes
max time kernel
91s
max time network
78s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/08/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer-1.0.6.exe
Size 12.0MB
Sample260804-vtp53awbkf
SHA256 37bf42ea69b77a3d13426f3c271bd51e0f32d58a0ad6d05b3fe90f66605837bf
MD5 82834a737ed33e0357711784d973255e
SHA1 f7c90d63e77ea58bad7fbebe88a451d9f6c03031
SHA512 19743f246415d57c578d15bb5f22548bb2f164f3be57e42bb7c0f8de0c0871e947554bab7384c6b3e52cf834a1db0f9143db190c58c232069e67db74fe632a6f
SSDEEP 393216:+b27r5L0PrKAdEVoALL3sAW0YmmccyTxhAN+x:+bc5L0jbdEVoALQAW9F6
TLSH
T112C6332351FA6836FAB89372B171D2818966B167372BC3FF2649C86508139DC1F36B17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1264	powershell.exe
3624	powershell.exe
1744	powershell.exe
4344	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
592	MadiumInstaller.exe
124	directx-redist.exe
2520	DXSETUP.exe

Loads dropped DLL 3 IoCs

pid	Process
592	MadiumInstaller.exe
2520	DXSETUP.exe
2520	DXSETUP.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	Installer-1.0.6.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	directx-redist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
728	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ae741e68cfe5c5110000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ae741e680000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ae741e68000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aae741e68000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dae741e68000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
3980	reg.exe
936	reg.exe
5044	reg.exe
576	reg.exe
3400	reg.exe
4812	reg.exe
3996	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1744	powershell.exe
1744	powershell.exe
4344	powershell.exe
4344	powershell.exe
1264	powershell.exe
1264	powershell.exe
3624	powershell.exe
3624	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1744	powershell.exe
Token: SeDebugPrivilege	4344	powershell.exe
Token: SeDebugPrivilege	1264	powershell.exe
Token: SeDebugPrivilege	3624	powershell.exe
Token: SeBackupPrivilege	820	vssvc.exe
Token: SeRestorePrivilege	820	vssvc.exe
Token: SeAuditPrivilege	820	vssvc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
592	MadiumInstaller.exe
592	MadiumInstaller.exe
592	MadiumInstaller.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 1744	3832	Installer-1.0.6.exe	81
PID 1744 wrote to memory of 592	1744	powershell.exe	84
PID 592 wrote to memory of 4344	592	MadiumInstaller.exe	86
PID 592 wrote to memory of 728	592	MadiumInstaller.exe	88
PID 592 wrote to memory of 4812	592	MadiumInstaller.exe	89
PID 592 wrote to memory of 3400	592	MadiumInstaller.exe	90
PID 592 wrote to memory of 576	592	MadiumInstaller.exe	91
PID 592 wrote to memory of 5044	592	MadiumInstaller.exe	92
PID 592 wrote to memory of 936	592	MadiumInstaller.exe	93
PID 592 wrote to memory of 3980	592	MadiumInstaller.exe	94
PID 592 wrote to memory of 3996	592	MadiumInstaller.exe	95
PID 592 wrote to memory of 1428	592	MadiumInstaller.exe	96
PID 592 wrote to memory of 1264	592	MadiumInstaller.exe	108
PID 592 wrote to memory of 3624	592	MadiumInstaller.exe	111
PID 3624 wrote to memory of 124	3624	powershell.exe	113
PID 3624 wrote to memory of 2520	3624	powershell.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe
"C:\Users\Admin\AppData\Local\Temp\Installer-1.0.6.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoLogo -NoProfile -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass -File bootstrap.ps1
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\MadiumInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\MadiumInstaller.exe" --from-sfx --first-install
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:592
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4344
  - - C:\Program Files\dotnet\dotnet.exe
      dotnet.exe --list-runtimes
      4⤵
      System Time Discovery
      PID:728
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed
      4⤵
      Modifies registry key
      PID:4812
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed
      4⤵
      Modifies registry key
      PID:3400
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed
      4⤵
      Modifies registry key
      PID:576
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed
      4⤵
      Modifies registry key
      PID:5044
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
      4⤵
      Modifies registry key
      PID:936
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
      4⤵
      Modifies registry key
      PID:3980
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
      4⤵
      Modifies registry key
      PID:3996
  - - C:\Windows\System32\reg.exe
      C:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
      4⤵
      PID:1428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -Command "$sig = Get-AuthenticodeSignature -LiteralPath 'C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe'; if ($sig.Status -eq 'Valid') { exit 0 }; exit 1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1264
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3624
    - - C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe
        
        "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe" /Q /T:"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:124
    - - C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe
        
        "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe" /silent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2520

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1036

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe.download

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe.download
Size 12.0MB
SHA256 efd75eba74c4e6ff9eabf11f68036283f869ca5457eefb437638f1181392c279
MD5 7c35c2e67c3eef0c6e72b65a83025406
SHA1 3d8c26649f79457bf25482af348a845380a6a810
SHA512 38356630638c6c454661636c9e3af9101a1485ecc0e2aa7a92ac17d18659a48f211b8be365768bbdcaee3c2aacd26fd29cab4de6b307985da1e30cbc52f11a70
SSDEEP 196608:2s9GT85PF80DWSwa+HDM7YKb7Bmyn+v3fw:h5PF8EW9HDM7YSBmq+v3f
TLSH
T192C6AE07F644C1F4C4AEC278836B9636EA32B889452471AF1BE45B112F2BF606F1D79D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadiumInstaller.exp

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\MadiumInstaller.exp
Size 836B
SHA256 8fc56228ccf1eab527c30de992491c94ef499de6db4f0c93a17d29169f450273
MD5 1819e6afe8314f4369a45d02d4b1b120
SHA1 aa04d948209ba9878deb67414aa4708f915f99c5
SHA512 5cefa38dc65fcdb06ad726ced1bf7dc8d3dcb7daeddcb1e01ef976977616d2dcc482a2ddb7d41ec7c6a8b45fe7d4c2ce13a7e60e913649ded24deadcbb5a4a3e
TLSH
T1E5011010E3E25C12F6204C3E83AB67796083FD95C85063139B80130ABD0B6E9C8208D3
MD5 SHA1 SHA512 TLSH

Submit Download

MadiumInstaller.lib

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\MadiumInstaller.lib
Size 1KB
SHA256 1e2998f883ecaf4726628900f791e5a114ee9af80184dca4c6abc3dd286079b6
MD5 d36b5c5903a7b1c4cf390481483dcca9
SHA1 814485782b54b29a1060c9639d6444efbe3613fa
SHA512 23606b0f6f1d9397a425f9b2d4e27158b85e5fa92819428cc4e68f263e40e49af94f333ae7d5322b718035214c54d2294c493de44b8b836493af5ac0e138d745
TLSH
T11A41D2716DA21463E639D637935BAD74242C300A9326FFFF3C9D06D543865CCD6A2983
MD5 SHA1 SHA512 TLSH

Submit Download

bitsdojo_window_windows_plugin.lib

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\bitsdojo_window_windows_plugin.lib
Size 571KB
SHA256 e30c3b143bf064f7a2f8438247ae46ce7eada3850536ad0ea415952b3100c87b
MD5 c7e97a58ca8c875c5b97828290ae4cf3
SHA1 b6cd1aac71c892a7c8d2775740d5cb74095b0ee1
SHA512 d7810575de81352512c179617d5d1609e4abba3aa05f13c29254fb74a231805422e9f8d696b09772611d2ea74b5a86a565c3fce71651d7a4b5a8a94c238a10f9
SSDEEP 12288:P66m66K66K6FK66EFFH6FS66q66w66jFFSDDMW66m66q66gVFomDD2qSw66F66TO:P66m66K66K6FK66EFFH6FS66q66w66jY
TLSH
T14FC4445DE7868783F434EE3B88AD05F256A6EE512443FB0792FD23251F03A5E56BB120
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NOTICES.Z

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\data\flutter_assets\NOTICES.Z
Size 102KB
SHA256 bdb492de2b031ec16101eede4cd2f26feefcd75c16a09239fa471a9cc552fcca
MD5 79e3b032d03665232fb84f194fc934bd
SHA1 cd30f816703e3d15a6c5d3f7c986005c044f7425
SHA512 4d2f906c47e088e8e8256063fa21425e8989e97a0ac94230ca1650177f68b332f65dcd800be281b12295596aa56d022cc88d444fa27a8cdf12e23206e7550323
SSDEEP 3072:n7tECDp05eSkCmIQ+P/sKr/bw+hoh5H3/P:n7tEC8e+o+H28oh5H3/P
TLSH
T125A3127E6A2C044171BC119D23498B64FEA6FBC630C94EFEB43352B41D7A889712D572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ink_sparkle.frag

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\data\flutter_assets\shaders\ink_sparkle.frag
Size 21KB
SHA256 1fe8436a743884cb65078fe8c7b38e18f5365f2a2961270916f426fd13c604af
MD5 0a8f4531af1d1a54aee8c7d23e640d2d
SHA1 0e13f340acb6eab5ddfcf70df99d06e3fabbb454
SHA512 e93fe163ebddb759a7f53c611eedb560fce18c5f5536b8a19781a3c5c3aabb0c0fcd65159b24d60c5113f3c542bf417132f3e8aa5b9b996b5b546cdb34683b51
SSDEEP 384:TThcP2xBwl0yU6iMRRLkgpXlp+TrlI+6QkopXlp+TrlIPLmNlkf/M+c3Vp3P9KP:TdcP2xBwl0yUNeRwoL+TrlIPzgL+Trly
TLSH
T121A23348D2E60E22DD166B3D556B21043F3EF09BAB67D2033748BA547F87327468A6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stretch_effect.frag

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\data\flutter_assets\shaders\stretch_effect.frag
Size 17KB
SHA256 62a899ff4e168ac6ca888ce7c2f40e5d3fbf8ca20a1c3ded781a116a6d7907e2
MD5 4acf2167e56d604e5acd1928ac03f0cf
SHA1 38c5e7d5b2583906cc67f5c018c06c5b43bdd120
SHA512 097a61ba8ea49c29dd06c92358094a423c9baec14027f2fed616d8da24bb91beb9c82bfdb3fe42de2c1610028a2ae6dbe01ae3636a813c7f0d6fa55369e140f2
SSDEEP 192:8sVNLhNETx5kgIDkHs9tmogoxjaDViqNi6O9aNiqgiSuKRqDi64BaXiqGiaaZdBf:8Mph6Tx59HUtXYDc2/boE/
TLSH
T1FC821254D6730897CC5BA37D4E4F0218AB34C087968687037E4DF224AF8676A4AA9FD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DSETUP32.DLL
Size 1.5MB
SHA256 fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
MD5 d8fa7bb4fe10251a239ed75055dd6f73
SHA1 76c4bd2d8f359f7689415efc15e3743d35673ae8
SHA512 73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
SSDEEP 24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf
TLSH
T166759D31B1D40332EA7103B177128AB7F63EEB9DE119DA257DAE82552182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe
Size 505KB
SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
MD5 bf3f290275c21bdd3951955c9c3cf32c
SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
TLSH
T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\dsetup.dll
Size 93KB
SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
MD5 eb701def7d0809e8da765a752ab42be5
SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
TLSH
T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ps1

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1
Size 2KB
SHA256 7f7eb8cf4fba079948705a83f968f52937c9f1733e752eda436ba6319cd5bece
MD5 6b839d23be8eb3f524a742bf0ab52299
SHA1 3416d874e28f19d2ed45ad94b085af7d9ca30c57
SHA512 104f4fdab5f5b78133ebb81763e81399c5ab25ddd4d5830dd11ebad806582e08a571f926418399545bb99751bed3f2b71a33dc2852e304e9d826b414d020c04d
TLSH
T17241320579F271A246F42A3319894245662B941AC10D6E103CBEC3C5FFE28BF9FEC756
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 d58a1d0c3f055f840f3150c1a7a7bccfc7310c5da798e5d7be4dfe461c9fbf86
MD5 0da01e7cad3f015edac57bfb506196de
SHA1 b64a3f596958ac57c1350e487c4dcd8de9936fbf
SHA512 cfbd53267cce19ee77b70aaa5ca6be93bd1f6cb01dd5995b4748a1182bdb4a76aa61da877f6181c861c4900b95caa704dd77c80d0d2052c5e1bb850033e9180b
TLSH
T1E371DF3533B5F0D9CC263F46192C1AC463BF435AEA54AF48B258620EE92654BDF122F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 6fdeec2f92eb76481d3ed9ecda14ac10fbaed3a2e7b79177cb21d61bfdd72eae
MD5 7e926679e99e8c4855b4cd56504c907b
SHA1 e08cd854fba24aa284c75ca4e2022e5ec3f0556c
SHA512 3286d0021c360c863c0dec1686af478c0f5a6fc040539640579969cb947ec8c768662ed9c1ed2258447480cdde81eac3dc34409df3e2fdd95d3ff1a14ab4c7bf
SSDEEP 1536:KflJdfh4iUx4YklMRbfKQOUpeEdqMdDa5wcNC+jH0IMZMFYoeLV3CNBQkj2QOdBg:KflJdfqiU4YklMRbfKQOUpeEdqMdDa5x
TLSH
T116538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4b6361fc31040f83c1a2a7cb7d8101a1b6e49850e4a8f2a66a7257d370683b47
MD5 bd5798f99bf54e51e133b26a05e79ce3
SHA1 ffe181a4c589af93da3660d898cdc776e18a7c3d
SHA512 dbd2e0d37dfae5d1789e433bd1e0d2e1e06e2fb6acb6120c992b5cd0127f3aea79cc8aeea6cb5780e5a364e6465901d61c45819c7058560b93c276b6d81b84bc
TLSH
T109115533B79CC524C8D9117A1088AD01B1B5C3CB449EDE8B7B84C519A57F99AEB942E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1020B
SHA256 11afcce56de813d4efd067285964ac9284fe5eb0e2e743b3c4ae6104e84f88d9
MD5 d8d6f1d956837e98432588f671b4485b
SHA1 afee350df331af4f4e5e009919af3a0c849eb46a
SHA512 3082c57a23e9b4f23c5b16ae2e17b977fa6d98a123e76fab3a2e7e11baeb4b400970ea8107d9e951f13fc0101664742a985806a7b976749712bc86eb9f93958c
TLSH
T1B1115933B78CC134C8A5057A1088AD01B5B0C3C7009FDD8B7A84C115E57F88ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

bootstrap.ps1

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\bootstrap.ps1
Size 1KB
SHA256 e94f4f3efcbe350f34cc5d0a4481e32f9d8cbe554faefa741821fa618798d0eb
MD5 136886518d85e01aff60db54d56bad90
SHA1 25fe6604325b69ac1f50da2c3844526350070a81
SHA512 895aaf9dece99f9074811534d5f80d53d0a82efe3d4c71b85bfb310c8ed36bbc61d565991aa3a3df03b28cc650b607588fac52b6bacc1ac8af135b3e0eed9c07
TLSH
T1D621C5252A15107119F6537BDA1A45F0CB0E746F8075476039AF8149CFB64EE0FC6FE5
MD5 SHA1 SHA512 TLSH

Submit Download

payload.zip

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\payload.zip
Size 11.8MB
SHA256 672c80bc9a37fd04e46679772a91cb60b696d76c6d84f6853fcfd88a494701f5
MD5 6146888492aa259e261844c8fd73e482
SHA1 7ef84e8941266a27496fc7ff159bad8e4407c156
SHA512 9ec57be3f360c761f2688ac83b23927a053b1bf0af8edf92b23e3d1767b1cb09bb37dcd6ba91e2cbae9c4f9d5fb84112614704cfbb9fbe162869a6322589d071
SSDEEP 196608:j9vfDrVf/hcNqmMH0Ozbl7PWr0l1UsnoOsuMfZ74z56EwHddX4kqj0RkI0/eprh8:FDrDc8fblSrSZofVh74cE8dxA0KI0/sO
TLSH
T1CCC633A2A03BDD3A6FBD56F7B021D200818B8299A61FC7FB324615416C67FDE1F1650B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadiumInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\MadiumInstaller.exe
Size 201KB
SHA256 613678d816cfccd88a0f4dc506f5f63bbfa6eb222bb4f215217cca6e5395287e
MD5 b7442b75184293a49d6f7d67cf04e92d
SHA1 9302d28c6169e6636dee63da7de7350268e921cd
SHA512 81521602aacf2828647c7dc774c65e2e7dd8d0edca34cb51bdfe2c2114766168c51a6ee94283484afb916da851f46e889199482722e8c418c3691172e9eafcae
SSDEEP 6144:x/6h0bqhOCz3hu01iXdfditfnOO5rEH9pJfsEC:BsLPoi9nOO5rc9p1i
TLSH
T129147E16FA6500F9E25AD5BC8D534A02EB73F896073197CF17804A7A0F27AD85E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\data\app.so
Size 5.3MB
SHA256 1ff379c029f8b24bbe86a34b61e633d32d41c88049ea50fe93e062465b89e210
MD5 eb5eaf14de56e59da68a5848d455cfdc
SHA1 ff31b5df0cd138fe4dab7e66a4f7ebe35224d0e6
SHA512 d9e3e0e75a9f1cc694c4aa3ee4624f1ef46cb15f9bd6181184e31fa360f19f82773ab7e0799d8846f467c182badca3266b6575a9cf8d31de6d66ff8d2fc5c3cb
SSDEEP 49152:RfVy+f06kKz2ELkfcGjChmcUWpIf3o2/yAhByBRSRpe0V8BxV/zNyzB570gKHoZE:RxUf57RpSBxV5yd57b5UT
TLSH
T19546F897C0E48770D572E772B75F26A55E2438CC4E70B68607C86B563E9ACE04ACF272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\data\flutter_assets\AssetManifest.bin
Size 2B
SHA256 f566cc6fccc657365c0197accf3a7d6f80f85209ff666ff774f4dcbc524aa842
MD5 0b0a3415aad49b6e9bf965ff578614f9
SHA1 db5b55a9b215f744db82517864984d073f2e8f8c
SHA512 0404c26467d39c9394c15c26d360cb48cc474aeefe2bae5fd5d46b72b5e9ebb8f1497d561dfed5a21942db92b648bab8167d8e02f5f19880a77e3afdc68526f8
MD5 SHA1 SHA512

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\data\flutter_assets\FontManifest.json
Size 82B
SHA256 28b1eb2b3d2e1ad60b8c8b0f9100b1ccbf492f7fa97f5bebb51ea97e73926e7d
MD5 7b2a36307916a9721811788013e65289
SHA1 f83d716c83a8a1cdf2a5c7b5fa387e9a62f2d49d
SHA512 0659dbdc8042768ce6e75c5e36fef1f93fde820dced5e2cf07f0949e59b25f87c01607f97c1926a792dbda28ebd7e4334ad942dfef3782e5ceb61de893f8df67
TLSH
T141A0120F005405D540CD9045F0957051E040284B000BC4CAD164064493E2130033C307
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

MaterialIcons-Regular.otf

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-9c3c8a1dfc354b9f9261dbeaad3f6624\flutter_windows.dll
Size 20.3MB
SHA256 a5c880a4218a04cfb3e58b103160334658122c5e43d3b818b3d9af5ab3e1fc0e
MD5 0c8c6ad1f023a515e37ab2bce12b4512
SHA1 d97f4ef98acc752a2ca6cd7fa89b605205f9cb24
SHA512 18445153a65b0641d85676cff4a17d736065822bd56a9bc712b3e61d96201cbc10e46f2e4fcf2568f7f29bd22ec15bce75bd7897c90773bf3cceb42d20c7c33f
SSDEEP 98304:B24Wmz6AP8+AmlPps4yoz95mYjH1x0q1KiROOUsMuZSxAwg5mByfcdrNh7k/WV4h:Bt8omoxj1IWEjEw9+BZ5vStib5HHe
TLSH
T1E2276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_hsuaxskj.bc1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hsuaxskj.bc1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 475B
SHA256 6fb5203de74bd7ff840450144d241cf62a9b5f5c4b2dc71f685a44f2577c2c58
MD5 3a615713027cfdd1e3f196c453d313b5
SHA1 671b3875fda71c654ecd1ba5e963718e87d2827e
SHA512 1555a806c8e65380ddc4e0c56c418c4e361c700df3621d94da72a0e5d6e4576641b8cb816f3215976deb86bf1ef9e201255b900e470ac9a1ed34f1ff10f70bf9
TLSH
T16DF0FEA429EB06C17D0654069A5F7450EEDD20AFEFFCE4BE32A413D0610161E4E0DC0A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/592-78-0x0000020D1C180000-0x0000020D1C200000-memory.dmp

Download

memory/592-74-0x0000020D1BAE0000-0x0000020D1C039000-memory.dmp

Download

memory/592-79-0x0000020D1C180000-0x0000020D1C200000-memory.dmp

Download

memory/592-75-0x0000020D1BA80000-0x0000020D1BA81000-memory.dmp

Download

memory/592-72-0x0000020D1BAE0000-0x0000020D1C039000-memory.dmp

Download

memory/592-71-0x0000020D1BA70000-0x0000020D1BA71000-memory.dmp

Download

memory/592-73-0x0000020D1BAE0000-0x0000020D1C039000-memory.dmp

Download

memory/1744-146-0x00000264D6310000-0x00000264D6320000-memory.dmp

Download

memory/1744-5-0x00000264D6310000-0x00000264D6320000-memory.dmp

Download

memory/1744-143-0x00000264D6310000-0x00000264D6320000-memory.dmp

Download

memory/1744-148-0x00007FF460F40000-0x00007FF460F50000-memory.dmp

Download

memory/1744-25-0x00000264F39F0000-0x00000264F3A02000-memory.dmp

Download

memory/1744-145-0x00000264D6310000-0x00000264D6320000-memory.dmp

Download

memory/1744-4-0x00000264D6310000-0x00000264D6320000-memory.dmp

Download

memory/1744-15-0x00007FF460F40000-0x00007FF460F50000-memory.dmp

Download

memory/1744-6-0x00000264D7C80000-0x00000264D7CA2000-memory.dmp

Download

memory/1744-26-0x00000264F3910000-0x00000264F391A000-memory.dmp

Download

memory/1744-13-0x00000264D6310000-0x00000264D6320000-memory.dmp

Download

memory/1744-24-0x00000264F39F0000-0x00000264F39FA000-memory.dmp

Download

memory/1744-23-0x00000264F3930000-0x00000264F39E3000-memory.dmp

Download

memory/1744-22-0x00000264F3910000-0x00000264F392C000-memory.dmp

Download

memory/4344-162-0x000001D34E880000-0x000001D34E89C000-memory.dmp

Download

memory/4344-167-0x000001D34E9F0000-0x000001D34E9FA000-memory.dmp

Download

memory/4344-166-0x000001D34E9C0000-0x000001D34E9C6000-memory.dmp

Download

memory/4344-165-0x000001D34E9B0000-0x000001D34E9B8000-memory.dmp

Download

memory/4344-164-0x000001D34E9D0000-0x000001D34E9EA000-memory.dmp

Download

memory/4344-163-0x000001D34E9A0000-0x000001D34E9AA000-memory.dmp

Download