7d369ef21a49e0bcfd7875d2e000a5c6bb592e00f305e139a188f40b3dc32249

Analysis

user interaction
yes
max time kernel
137s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/08/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Installer-1.1.0.exe
Size 9.8MB
Sample260820-tex2pafk21
SHA256 7d369ef21a49e0bcfd7875d2e000a5c6bb592e00f305e139a188f40b3dc32249
MD5 05f15a788b381191b0c021690ee60142
SHA1 f63593f46bbbff726733225869ce29a33eefc7ae
SHA512 488f9c1da95cf47f040d2de8f767fd26a28053b152177607f84ad43736bb2237f40f7e050e7a2bbe927fe9327cf1ffba30aa6e272ab63fa0af3bdca6978bc0f2
SSDEEP 196608:p72MJ9yZ9AsAxGpA4mdlHRTabZU8iUa+Ls1TX5d0fLjdFF5OoFaQtuJ0K3:Z2MJl8pApdtwiUa6YTX5+rF5O0awK3
TLSH
T187A6331AB7513AF1F1A7D3395046490AC3B1F4721B56A6E703A264FB6E237C4CF3AA05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3344	powershell.exe
3408	powershell.exe
3432	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
1228	MadiumInstaller.exe
1816	directx-redist.exe
4932	DXSETUP.exe

Loads dropped DLL 3 IoCs

pid	Process
1228	MadiumInstaller.exe
4932	DXSETUP.exe
4932	DXSETUP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	directx-redist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000035d00ca4488ad7d50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000035d00ca40000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090035d00ca4000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a35d00ca4000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d35d00ca4000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
1828	reg.exe
452	reg.exe
3204	reg.exe
4944	reg.exe
3132	reg.exe
1452	reg.exe
2548	reg.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
3344	powershell.exe
3344	powershell.exe
3408	powershell.exe
3408	powershell.exe
3432	powershell.exe
3432	powershell.exe
1228	MadiumInstaller.exe
1228	MadiumInstaller.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	3344	powershell.exe
Token: SeDebugPrivilege	3408	powershell.exe
Token: SeDebugPrivilege	3432	powershell.exe
Token: SeBackupPrivilege	3232	vssvc.exe
Token: SeRestorePrivilege	3232	vssvc.exe
Token: SeAuditPrivilege	3232	vssvc.exe
Token: SeDebugPrivilege	1452	taskmgr.exe
Token: SeSystemProfilePrivilege	1452	taskmgr.exe
Token: SeCreateGlobalPrivilege	1452	taskmgr.exe
Token: 33	1452	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1452	taskmgr.exe

Suspicious use of FindShellTrayWindow 30 IoCs

pid	Process
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe

Suspicious use of SendNotifyMessage 30 IoCs

pid	Process
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe
1452	taskmgr.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1228	MadiumInstaller.exe
1228	MadiumInstaller.exe
1228	MadiumInstaller.exe
1228	MadiumInstaller.exe
1228	MadiumInstaller.exe
3120	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1228	652	Installer-1.1.0.exe	80
PID 1228 wrote to memory of 3344	1228	MadiumInstaller.exe	81
PID 1228 wrote to memory of 4932	1228	MadiumInstaller.exe	83
PID 1228 wrote to memory of 1452	1228	MadiumInstaller.exe	84
PID 1228 wrote to memory of 3132	1228	MadiumInstaller.exe	85
PID 1228 wrote to memory of 4944	1228	MadiumInstaller.exe	86
PID 1228 wrote to memory of 3204	1228	MadiumInstaller.exe	87
PID 1228 wrote to memory of 452	1228	MadiumInstaller.exe	88
PID 1228 wrote to memory of 1828	1228	MadiumInstaller.exe	89
PID 1228 wrote to memory of 2548	1228	MadiumInstaller.exe	90
PID 1228 wrote to memory of 4928	1228	MadiumInstaller.exe	91
PID 1228 wrote to memory of 3408	1228	MadiumInstaller.exe	101
PID 1228 wrote to memory of 3432	1228	MadiumInstaller.exe	103
PID 3432 wrote to memory of 1816	3432	powershell.exe	105
PID 3432 wrote to memory of 4932	3432	powershell.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Installer-1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Installer-1.1.0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\MadiumInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\MadiumInstaller.exe" --from-sfx --first-install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3344
- - C:\Program Files\dotnet\dotnet.exe
    dotnet.exe --list-runtimes
    3⤵
    - System Time Discovery
    PID:4932
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed
    3⤵
    - Modifies registry key
    PID:1452
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed
    3⤵
    - Modifies registry key
    PID:3132
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed
    3⤵
    - Modifies registry key
    PID:4944
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed
    3⤵
    - Modifies registry key
    PID:3204
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
    3⤵
    - Modifies registry key
    PID:452
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
    3⤵
    - Modifies registry key
    PID:1828
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
    3⤵
    - Modifies registry key
    PID:2548
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
    3⤵
    PID:4928
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -Command "$sig = Get-AuthenticodeSignature -LiteralPath 'C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe'; if ($sig.Status -eq 'Valid') { exit 0 }; exit 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3408
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe
      "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe" /Q /T:"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1816
  - - C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe
      "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:4932

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3232

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3660

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:3120

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe.download

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe.download
Size 12.0MB
SHA256 6d6de8ce543029fb7fac8f940241975c4e1862b63b948d94af411dd9bb04c2e8
MD5 4f71599a9d0ad49325d337e27e3e04ea
SHA1 e80e8fa52b8f109ad14bd1ea7b44dbade4c5281e
SHA512 89bfed0c869c0febfbfe3c387882bd14d8a0f003ccb1d712a705a072c3f94d982bcf375356fc74984170508489b216cc4a5d5e9602e71b300b47cd54fd422e8d
SSDEEP 196608:vnXGTgw4cxwaE0DQk57BImaXRDpn+yEwT+:vWTgw4cKEQkdBImaXRDR+yEJ
TLSH
T178C6AE07F240C1F4C4AEC279C36B9636EA32B889452472AF17E45B512F2BE606F1D79D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cab

Path C:\Users\Admin\AppData\Local\Madium\INSTAL~1\temp\deps\DIRECT~1\dxupdate.cab
Size 94KB
SHA256 e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed
MD5 d495680aba28caafc4c071a6d0fe55ac
SHA1 5885ece90970eb10b6b95d6c52d934674835929e
SHA512 a25c647678661473b99462d7433c1d05af54823d404476e35315c11c93b3f5ece92c912560af0d9efe8f07e36ae68594362d73abf5d5de409a3f0a146fe31a10
SSDEEP 1536:JvknxJRHNYzrAzRstaRGk0jzphvXdy57XwwnNb+vnaI1eYpIKxozNlmn6F5x:JvknxJpNYAzRstaRkz0BwwnNbSa+vp58
TLSH
T1BA9302EC875DCF93D5622DADA168EA0B7DBEF98E891CD42580B5F20418627DCB2F444C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DSETUP32.DLL
Size 1.5MB
SHA256 fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
MD5 d8fa7bb4fe10251a239ed75055dd6f73
SHA1 76c4bd2d8f359f7689415efc15e3743d35673ae8
SHA512 73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
SSDEEP 24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf
TLSH
T166759D31B1D40332EA7103B177128AB7F63EEB9DE119DA257DAE82552182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe
Size 505KB
SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
MD5 bf3f290275c21bdd3951955c9c3cf32c
SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
TLSH
T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dsetup.dll

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\dsetup.dll
Size 93KB
SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
MD5 eb701def7d0809e8da765a752ab42be5
SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
TLSH
T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ps1

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1
Size 2KB
SHA256 7f7eb8cf4fba079948705a83f968f52937c9f1733e752eda436ba6319cd5bece
MD5 6b839d23be8eb3f524a742bf0ab52299
SHA1 3416d874e28f19d2ed45ad94b085af7d9ca30c57
SHA512 104f4fdab5f5b78133ebb81763e81399c5ab25ddd4d5830dd11ebad806582e08a571f926418399545bb99751bed3f2b71a33dc2852e304e9d826b414d020c04d
TLSH
T17241320579F271A246F42A3319894245662B941AC10D6E103CBEC3C5FFE28BF9FEC756
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ad5cee6a519e17c8c3cda09d78e0e9f9cc04e539a2273532b5e07c9ddc6a9252
MD5 b1a170a0a91ff0ac6ab4b905ed455843
SHA1 14c4bcf81daac31a2011afe52518a1d42cc03854
SHA512 82f3d5dbae07b729faee003fc09ae23f94eb803132d17002d58f953eb18e8a325f8b3b6337b1298469a245fef599a84adc4968e02f1b62020c837caf38e5e074
TLSH
T1CA21A833B7ACC234C8D911BA2088AD01B2B5C3C7449ECECB7B84C508A57F99ADF641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 28d069a1bed10ff144caecc94e7fdf29503d1491ccf64302a809db238414a42e
MD5 6f4e41b3fa8b7d795dffaf17d9d89926
SHA1 17164e792390a7c78fb95f4c76a55dd42144f3bd
SHA512 2d1a9efdcc97f98988a7555b564e0e5ac72421f2fb8370eb54f21b4875f099a85678a22152a5ed6e5507dff00e50b316ec4e5fe36771b797dfe487a1539bc9d0
TLSH
T1AA218933B79CC135C8C9117A108DAD01B2B5C3C7449E8E8B7B84C518A57F89ADE641A4
MD5 SHA1 SHA512 TLSH

Submit Download

MadiumInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\MadiumInstaller.exe
Size 204KB
SHA256 4ccd3c14651d1842b201c02084730fcc3b674758a75754c4c69bf64f1a7cda4b
MD5 7c786540ea668f83551dbc27c021afc1
SHA1 d15ba52aea36aecf441cd6f70600dec57ff1197a
SHA512 d3519b21f19c51d65be4b12ce6cb4dc2314e5a239a56b23bb9fc46b117c81430969da89d3e13021577081f4bb5585701ff81891a72cc4700418601ec53673083
SSDEEP 6144:OwhojjTxItRyKO/XL5n6XD+vpFtO5r1DZQ80sEC:4T55n6XajtO5rBZQvi
TLSH
T178248E1BF79410F9E167C57CCE928A41EB72B896076197CF0B500BB60F27AD85E3AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\app.so
Size 5.4MB
SHA256 d40a6c1b6bb279aa9e9a6ce542aa4f7a160193126b3ad1de0035dd10c4ef2f53
MD5 7dd589717b264d9e86e482b8b01399de
SHA1 8980a35b4de339d306ee5762cd0cded2b83a5fde
SHA512 325bd207f7d5f876212e1717b6b7d898b86b3f6e13d9f58c48dbd1a6a5c88b62a77b26854761eeb761b41030a0351a67a742d90a562bbcca1898d8f8903f3c7d
SSDEEP 49152:DwzugA7PW80vZALX2PUonsFhClYHJUjFepf28vfOzWc4KsJ/JtoHsL0OzTlDPa+G:DwzugjdzeKc/JyHm0SiO90
TLSH
T15446FA4BC0E48364D472E772B75F36B5AE2438CC4E74B64606C4575A3E9ACE08ACF672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\flutter_assets\AssetManifest.bin
Size 2B
SHA256 f566cc6fccc657365c0197accf3a7d6f80f85209ff666ff774f4dcbc524aa842
MD5 0b0a3415aad49b6e9bf965ff578614f9
SHA1 db5b55a9b215f744db82517864984d073f2e8f8c
SHA512 0404c26467d39c9394c15c26d360cb48cc474aeefe2bae5fd5d46b72b5e9ebb8f1497d561dfed5a21942db92b648bab8167d8e02f5f19880a77e3afdc68526f8
MD5 SHA1 SHA512

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\flutter_assets\FontManifest.json
Size 82B
SHA256 28b1eb2b3d2e1ad60b8c8b0f9100b1ccbf492f7fa97f5bebb51ea97e73926e7d
MD5 7b2a36307916a9721811788013e65289
SHA1 f83d716c83a8a1cdf2a5c7b5fa387e9a62f2d49d
SHA512 0659dbdc8042768ce6e75c5e36fef1f93fde820dced5e2cf07f0949e59b25f87c01607f97c1926a792dbda28ebd7e4334ad942dfef3782e5ceb61de893f8df67
TLSH
T141A0120F005405D540CD9045F0957051E040284B000BC4CAD164064493E2130033C307
MD5 SHA1 SHA512 TLSH

Submit Download

NOTICES.Z

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\flutter_assets\NOTICES.Z
Size 102KB
SHA256 bdb492de2b031ec16101eede4cd2f26feefcd75c16a09239fa471a9cc552fcca
MD5 79e3b032d03665232fb84f194fc934bd
SHA1 cd30f816703e3d15a6c5d3f7c986005c044f7425
SHA512 4d2f906c47e088e8e8256063fa21425e8989e97a0ac94230ca1650177f68b332f65dcd800be281b12295596aa56d022cc88d444fa27a8cdf12e23206e7550323
SSDEEP 3072:n7tECDp05eSkCmIQ+P/sKr/bw+hoh5H3/P:n7tEC8e+o+H28oh5H3/P
TLSH
T125A3127E6A2C044171BC119D23498B64FEA6FBC630C94EFEB43352B41D7A889712D572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

MaterialIcons-Regular.otf

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ink_sparkle.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\flutter_assets\shaders\ink_sparkle.frag
Size 21KB
SHA256 1fe8436a743884cb65078fe8c7b38e18f5365f2a2961270916f426fd13c604af
MD5 0a8f4531af1d1a54aee8c7d23e640d2d
SHA1 0e13f340acb6eab5ddfcf70df99d06e3fabbb454
SHA512 e93fe163ebddb759a7f53c611eedb560fce18c5f5536b8a19781a3c5c3aabb0c0fcd65159b24d60c5113f3c542bf417132f3e8aa5b9b996b5b546cdb34683b51
SSDEEP 384:TThcP2xBwl0yU6iMRRLkgpXlp+TrlI+6QkopXlp+TrlIPLmNlkf/M+c3Vp3P9KP:TdcP2xBwl0yUNeRwoL+TrlIPzgL+Trly
TLSH
T121A23348D2E60E22DD166B3D556B21043F3EF09BAB67D2033748BA547F87327468A6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stretch_effect.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\flutter_assets\shaders\stretch_effect.frag
Size 17KB
SHA256 62a899ff4e168ac6ca888ce7c2f40e5d3fbf8ca20a1c3ded781a116a6d7907e2
MD5 4acf2167e56d604e5acd1928ac03f0cf
SHA1 38c5e7d5b2583906cc67f5c018c06c5b43bdd120
SHA512 097a61ba8ea49c29dd06c92358094a423c9baec14027f2fed616d8da24bb91beb9c82bfdb3fe42de2c1610028a2ae6dbe01ae3636a813c7f0d6fa55369e140f2
SSDEEP 192:8sVNLhNETx5kgIDkHs9tmogoxjaDViqNi6O9aNiqgiSuKRqDi64BaXiqGiaaZdBf:8Mph6Tx59HUtXYDc2/boE/
TLSH
T1FC821254D6730897CC5BA37D4E4F0218AB34C087968687037E4DF224AF8676A4AA9FD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-EF0FAFD6-F02A-481A-B18E-7BA37C6CEADC\flutter_windows.dll
Size 20.3MB
SHA256 67db13c69a0ce93242d11c2f99dd86ccbabce18ea9de613f126e9e31817d6de6
MD5 a3a9bc0880d2166c7718120b86f5b54e
SHA1 ca12a77b625fad404ad57b6335b7bd6d014d461d
SHA512 583dab60fa9be1c58b280e700cb5298d4b56bc5f5dc8c8e0e94e400925f553fe6bdd664d54b4ea10b4e71cfe6ff4453a7a037398249a59e7f4e2f05d632b6c0a
SSDEEP 98304:x24Wmz6AP8+AmlPps4yoz95mYjH1x0q1KiROOUsMuZSxAwg5mByfcdrNh7k/WV49:xt8omoxj1IWEjEw9+BZ5vStib5Hc/
TLSH
T145276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_zzamqzq4.p5o.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zzamqzq4.p5o.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 475B
SHA256 e8bb990186eaa394d25456a35f305c197fb7b12fe46f6384bd3730101d8799d6
MD5 03b70cec4b6b95b0cca1a0063d98f581
SHA1 27399c870db7a8487883c3bcd716da00cfcf9ae2
SHA512 f47133c3355e2477c112eeb1ff1c14df2f1fb731f93ace7b0d53e75da8d61b19f9e450ba4508d6c984a9784e864c4c5ea4d3955190c661c8281f95d484460413
TLSH
T176F03086AAFF00CD75056C07996B9CD3A89C202B9BEAD27E325412D0612361DCF2562E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1228-25-0x000001D17BF30000-0x000001D17BF31000-memory.dmp

Download

memory/1228-21-0x000001D1790E0000-0x000001D1790E1000-memory.dmp

Download

memory/1228-28-0x000001D17C600000-0x000001D17C680000-memory.dmp

Download

memory/1228-22-0x000001D17BF50000-0x000001D17C4B5000-memory.dmp

Download

memory/1228-29-0x000001D17C600000-0x000001D17C680000-memory.dmp

Download

memory/1228-24-0x000001D17BF50000-0x000001D17C4B5000-memory.dmp

Download

memory/1228-23-0x000001D17BF50000-0x000001D17C4B5000-memory.dmp

Download

memory/1452-494-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-487-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-488-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-489-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-493-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-499-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-498-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-497-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-496-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/1452-495-0x000002E129120000-0x000002E129121000-memory.dmp

Download

memory/3344-103-0x000001ED3C120000-0x000001ED3C12A000-memory.dmp

Download

memory/3344-99-0x000001ED3BF70000-0x000001ED3BF7A000-memory.dmp

Download

memory/3344-87-0x000001ED3BBF0000-0x000001ED3BC12000-memory.dmp

Download

memory/3344-95-0x000001ED3BE80000-0x000001ED3BE9C000-memory.dmp

Download

memory/3344-96-0x000001ED3BEA0000-0x000001ED3BF53000-memory.dmp

Download

memory/3344-97-0x000001ED3BF60000-0x000001ED3BF6A000-memory.dmp

Download

memory/3344-98-0x000001ED3BF90000-0x000001ED3BFAC000-memory.dmp

Download

memory/3344-100-0x000001ED3C130000-0x000001ED3C14A000-memory.dmp

Download

memory/3344-101-0x000001ED3BF80000-0x000001ED3BF88000-memory.dmp

Download

memory/3344-106-0x000001ED22E20000-0x000001ED238E2000-memory.dmp

Download

memory/3344-102-0x000001ED3C110000-0x000001ED3C116000-memory.dmp

Download

memory/3408-134-0x0000012AA3720000-0x0000012AA41E2000-memory.dmp

Download

memory/3408-136-0x0000012AA3720000-0x0000012AA41E2000-memory.dmp

Download

memory/3432-486-0x0000022745B80000-0x0000022746642000-memory.dmp

Download

memory/3432-481-0x0000022745B80000-0x0000022746642000-memory.dmp

Download

memory/3432-480-0x0000022745B80000-0x0000022746642000-memory.dmp

Download

memory/3432-479-0x0000022745B80000-0x0000022746642000-memory.dmp

Download

memory/3432-478-0x0000022745B80000-0x0000022746642000-memory.dmp

Download

memory/3432-476-0x0000022745B80000-0x0000022746642000-memory.dmp

Download