quasar | 339c4d16c6a1f1fce85081ffe077cd30e35850d46fcdd7fd89d675fce3d8b7ab

Analysis

user interaction
yes
max time kernel
599s
max time network
600s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/10/2026, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Madium.exe
Size 3.1MB
Sample261014-2jsa1azz7k
SHA256 339c4d16c6a1f1fce85081ffe077cd30e35850d46fcdd7fd89d675fce3d8b7ab
MD5 25b4240e976e50d50efc733206b4729e
SHA1 5369412f34783705e988c9518421443478448c6c
SHA512 675aedee1b344d39c0a0f9cc7a7b062e5e28c1abfd733aa6947d7f4beecdee9e7df217f568f58e57e5e96c0ab3c03aa0ecf49546945ce9c7e2a5bc55c62b7227
SSDEEP 49152:nvblL26AaNeWgPhlmVqvMQ7XSKCGZjMc6vJCtoGdUTHHB72eh2NT:nvBL26AaNeWgPhlmVqkQ7XSKicv
TLSH
T13BE55A143BF85E32E16BE6B2D5B0501663F2F82AF363EB1B2181677E1C53B505C416AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

madium executor defense_evasion discovery execution quasar persistence spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Madium Executor

192.168.5.220:4782

Mutex

f743f709-3a0c-4898-ad83-a402ce24b696

Attributes

encryption_key
BCC536DAB57673EF8AC5DB2A5F7CDD0991AC2977
install_name
Executor.exe
key_salt
bfeb1e56fbcd973bb219022430a57843003d5644d21e62b9d4f180e7e6c33941
log_directory
MicrosoftKeyboard
reconnect_delay
3000
startup_key
Madium Executor Loader
subdirectory
Madium

Signatures

Family: Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral1/memory/4044-0-0x0000000000380000-0x00000000006A4000-memory.dmp	family_quasar
behavioral1/files/0x000e00000002a241-5.dat	family_quasar

Downloads MZ/PE file 1 IoCs

flow	pid	Process
29	892	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
1376	Executor.exe
5388	Executor.exe
4052	Madium.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	api.gofile.io
26	api.gofile.io

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Madium.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
892	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Madium.exe:Zone.Identifier	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5580	schtasks.exe
2400	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
2148	chrome.exe
2148	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4044	Madium.exe
Token: SeDebugPrivilege	1376	Executor.exe
Token: SeDebugPrivilege	5388	Executor.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe
Token: SeCreatePagefilePrivilege	6124	chrome.exe
Token: SeShutdownPrivilege	6124	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe
6124	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1376	Executor.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4044 wrote to memory of 5580	4044	Madium.exe	82
PID 4044 wrote to memory of 1376	4044	Madium.exe	84
PID 1376 wrote to memory of 2400	1376	Executor.exe	85
PID 6124 wrote to memory of 4836	6124	chrome.exe	90
PID 6124 wrote to memory of 5244	6124	chrome.exe	91
PID 6124 wrote to memory of 5244	6124	chrome.exe	91
PID 6124 wrote to memory of 892	6124	chrome.exe	92
PID 6124 wrote to memory of 4548	6124	chrome.exe	93
PID 6124 wrote to memory of 4548	6124	chrome.exe	93
PID 6124 wrote to memory of 3140	6124	chrome.exe	94
PID 6124 wrote to memory of 3140	6124	chrome.exe	94
PID 6124 wrote to memory of 3648	6124	chrome.exe	95
PID 6124 wrote to memory of 3648	6124	chrome.exe	95
PID 6124 wrote to memory of 5716	6124	chrome.exe	97
PID 6124 wrote to memory of 5716	6124	chrome.exe	97
PID 6124 wrote to memory of 2180	6124	chrome.exe	99
PID 6124 wrote to memory of 2180	6124	chrome.exe	99
PID 6124 wrote to memory of 3716	6124	chrome.exe	100
PID 6124 wrote to memory of 3716	6124	chrome.exe	100
PID 6124 wrote to memory of 1064	6124	chrome.exe	101
PID 6124 wrote to memory of 1064	6124	chrome.exe	101
PID 6124 wrote to memory of 560	6124	chrome.exe	102
PID 6124 wrote to memory of 460	6124	chrome.exe	104
PID 6124 wrote to memory of 460	6124	chrome.exe	104
PID 6124 wrote to memory of 3788	6124	chrome.exe	105
PID 6124 wrote to memory of 3788	6124	chrome.exe	105
PID 6124 wrote to memory of 4460	6124	chrome.exe	106
PID 6124 wrote to memory of 5756	6124	chrome.exe	107
PID 6124 wrote to memory of 5160	6124	chrome.exe	108
PID 6124 wrote to memory of 2060	6124	chrome.exe	109
PID 6124 wrote to memory of 4052	6124	chrome.exe	110
PID 6124 wrote to memory of 2148	6124	chrome.exe	111
PID 6124 wrote to memory of 5356	6124	chrome.exe	112
PID 6124 wrote to memory of 5356	6124	chrome.exe	112

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Madium.exe
"C:\Users\Admin\AppData\Local\Temp\Madium.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks" /create /tn "Madium Executor Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Madium\Executor.exe" /rl HIGHEST /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5580
- C:\Users\Admin\AppData\Roaming\Madium\Executor.exe
  "C:\Users\Admin\AppData\Roaming\Madium\Executor.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Madium Executor Loader" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Madium\Executor.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2400

C:\Users\Admin\AppData\Roaming\Madium\Executor.exe
C:\Users\Admin\AppData\Roaming\Madium\Executor.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd211c728,0x7ffdd211c734,0x7ffdd211c740
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,6488620609094777410,9134610302111210003,262144 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,12568090874521527045,6929807826579406283,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2248 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,132783402463218436,9798416605250790588,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2556 /prefetch:13
  2⤵
  PID:4548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,4996557237426635202,17393982013889773171,2097152 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,15100400924272488194,3758088511780694574,2097152 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4368,i,13683689145686083186,5127932651652488456,2097152 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3220 /prefetch:9
  2⤵
  PID:5716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4748,i,6787686406023638512,5360290786926534783,2097152 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4928,i,6298086476489248065,10625797150254894360,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:3716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5088,i,8622453740234308420,10234436075164133827,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5100 /prefetch:14
  2⤵
  PID:1064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5680,i,10638413678087622800,4656911342432824946,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5864,i,13823028936535111455,1643979788055066106,2097152 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4784,i,6541075768535945279,17515144591382824315,2097152 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3448,i,10274786806451767449,18163861430128281400,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3640 /prefetch:14
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4812,i,12026434580222721270,1845627903586282214,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  PID:5756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3620,i,890595875117674521,1580234165047915152,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3588 /prefetch:14
  2⤵
  PID:5160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3584,i,6224597165079297046,597903203217197713,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3656 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2060
- C:\Users\Admin\Downloads\Madium.exe
  "C:\Users\Admin\Downloads\Madium.exe"
  2⤵
  - Executes dropped EXE
  PID:4052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1168,i,18244687530680569167,2695150201784164414,262144 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3620 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=1528,i,13614961444977039253,2624182534943946453,524288 --field-trial-handle=1936,i,6088859339752539691,14346436746656346951,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4624 /prefetch:14
  2⤵
  PID:5356

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f146a34-7d5d-4848-95e4-9499c7afa309.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\0f146a34-7d5d-4848-95e4-9499c7afa309.tmp
Size 268KB
SHA256 65c493539a1ad74c0e4b938635104c7997160e8f745f993d852e1d9eb6da6616
MD5 41a85ba4247ba70e9945657ca6b5a7ee
SHA1 9ed54803aef7850f612cebdf4b1591cfa820e51c
SHA512 a58da2b26431c8be63190cb320139c01818199c32f39a40430571c91a6d5ea7e8b6229b0dffe390a5700442ceb884b416712438a9c857a5d5164a9a3eeedb824
SSDEEP 6144:gG6x0ogEbPaLM8k1du2FgnPHUt4fLJ0L6nGJxi3bzqapJjC:Ux0pWaw8VQSPHUWXUx8zvpJ+
TLSH
T10D4412F0D2A04C7A977AD90549BA2E148FB293D394CAFF2415C8CE5D4509EEB172BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c662593-18bc-4bbd-baa5-debacca526ad.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1c662593-18bc-4bbd-baa5-debacca526ad.tmp
Size 267KB
SHA256 e6c9eeb66b770e1a6c0ccdd4a4ac963351f2da334398fe395cb79f7316f53a94
MD5 36dd705b17b00296ccb2eb1623a9d66f
SHA1 e52683ef7d85e8f165421417b5eb5031a3630037
SHA512 9e9b24e29a2920379dffb5389df06a5aa0679b7d12a90a036bf312caa7be770f7de358b93210515204f250bedf9f1b4ddc3c8de3a221ac81f30c21a974bf68ed
SSDEEP 6144:NWG6x0ogEbPaLM8k1du2FgnPHUt4fLJ0L6nGJxi3bzqapJjC:N+x0pWaw8VQSPHUWXUx8zvpJ+
TLSH
T1CA4412E0C7E04C7AD77AD90949BE2E188FA293D185C6BF2405C8CE5D4509EEB172BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c46b8a5-311b-40da-8a47-bf74ba6b9ce5.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\2c46b8a5-311b-40da-8a47-bf74ba6b9ce5.tmp
Size 268KB
SHA256 335c04fe37fe21dcf850d18cb677c601e693a8b3777479fb61adc816105fd410
MD5 2949a25cde79b9db249fe0ca3591a2f7
SHA1 433f4823762b83f2de201b342071151f85e7ef1b
SHA512 42c99be133f1464a637146f1ec4a740a579e7195a85fcccae1b4e816dff14f83c96b6861f5fc6636ac6d07a0bf4317b4ec49ea4f6a690691d06a4316d99511c3
SSDEEP 6144:cG6x0ogEbPaLM8k1du2FgnPHUt4fLJ0L6nGJxi3bzqapJjC:wx0pWaw8VQSPHUWXUx8zvpJ+
TLSH
T1C54412F0D2A04C7A977AD90949BA2E148FB293D3D4C6BF2415C8CE5D4509EEB172BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4008eac3-4af7-47c1-be56-e44c0de99a07.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4008eac3-4af7-47c1-be56-e44c0de99a07.tmp
Size 130KB
SHA256 ebf2029106bf4d199f82e95394448798b02ad98551f599e2a67c6293e56e639f
MD5 c9874ba04fcde8312464b496f0f986d7
SHA1 f6474476275173ce5c2ec607b2b6acd969f05a1c
SHA512 f584e9ffc7523c471595a63d8ee30e94fd1cf000e6204bc26a2ef0c0bbcbbeb838301bca38d65c854ca7d00dee0f1ff77a2381dbe4eb73747bf47855b9efcde6
SSDEEP 3072:sH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJjk:Ut4fLJ0L6nGJxi3bzqapJjk
TLSH
T1DBD312F0D5A06C7ACBF7EE4145756E948F71D5C289CDBE2009F9881816CEA344E13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9324c102-18a9-4961-8c25-52457c40d30f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9324c102-18a9-4961-8c25-52457c40d30f.tmp
Size 267KB
SHA256 4b51306b20217266abf3d54e5cab71eb27c8de4afd3420f3d8b1bb51c76e07e7
MD5 faf25fbb453f9f1fc3ad80fe544d1a78
SHA1 8ac2ed5a20867d801f9db57421aa5791ae1af9ec
SHA512 b5742218bcba7332511912c27f473d94a785b5ace91129612b630ca6d77f3b7df670be3060af4915d294a6c58767f2b3547902e08b9f264bc0c47c94fc406c0e
SSDEEP 6144:cWG6x0ogEbPaLM8k1du2FgnPHUt4fLJ0L6nGJxi3bzqapJjC:c+x0pWaw8VQSPHUWXUx8zvpJ+
TLSH
T1D24412E0C7E04C7AD77AD90949BE2E188FA293D185C6BF2405C8CE5D4509EEB172BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2db81c56-c468-4d4e-b0e5-930eddf89098.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2db81c56-c468-4d4e-b0e5-930eddf89098.tmp
Size 13KB
SHA256 8d96f2cb95bf4d2cfe5bdbd8e5ed78acf1b7d05a3e075ac3f837aa3277fc4a5a
MD5 83b812d6421248428cf4721028f62739
SHA1 1ea93cf6358891c3b811e98db897856c55c85802
SHA512 5e9490c9c409063ddc917fe3f2146d35dbe10830614b512e8792edce56603f706e7aff327363ff019ff6c4db317d5543043282e7fd8b114144a287dc7a41bcb3
SSDEEP 192:XRbYnxTYdFv7bhJPRpFXRlX9/Hsb+WNn3E3jg2rHtZAzH+VyIsnAUgraJ:XRbY81PXXFbtwU827te2e
TLSH
T13652C52EE9046A3BACDBD629F9557B53E7F5202160902E84AAFCC93C15E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

494ed363-97a2-4300-bdde-2120b0a6d6a7.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\494ed363-97a2-4300-bdde-2120b0a6d6a7.tmp
Size 13KB
SHA256 fda0a209a4a6d8e1996ee9f83d903a6a070a9be2e1e8badb0a95d8ae9c18c938
MD5 856ae5db2800e4b3f0ca7ebf21212977
SHA1 64cbee468b3e7335f2ffd53b0a97d9ebd067d288
SHA512 1fbcc2a1f165ead541210d4d82e049e38151f8532f9ed5d674509b13a3f90e37357a83d7f9f806e031615aa4d15ccee62fca80edc5029de26e5267812bebb8f9
SSDEEP 192:XRbYMxTYdFv7bhAPRp2XRlX9/Hsb+WNn3E3jg22HtZAzJ+VyIsnAUgraJ:XRbYJ1P8X+btwU82Yty2e
TLSH
T13752C42DF9046A7BACDBD629F9567B53E7F52021A0802E84AAFCC93C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b1cb057-7c43-48c5-bc28-8c6a3f08914d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\6b1cb057-7c43-48c5-bc28-8c6a3f08914d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

72af83ac-bd64-40d9-885c-5f2202b85f10.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\72af83ac-bd64-40d9-885c-5f2202b85f10.tmp
Size 17KB
SHA256 de13521758ef1bfcb2d2450b3cf0a7a99cd0970c06b92340bd4289551bfc2ad6
MD5 b0928f3b5aacd381a50cb79484995d2d
SHA1 ba2f982a9d1dd6c557ee7a37adadea8daab8b737
SHA512 af3e8c9148f12d0e4fb4988464bd2a8f2df2e47ea7c5f1cab56fe717533c7f2da51919aeb6a09e6a8b95119e5735947b80bbd19844feb7e8ffa58cbd1ddf81e1
SSDEEP 384:Q2j8z7KxkXqKf/pUZNCgVLH2HfgslO07pLuLceSe/XOD8P+ErU3fKHGFwjj9B:Q28z7KxkXqKf/pUZNCgVLH2HfgsI07p+
TLSH
T1E47209676C4C997B0F98CACCCC267A4FADB5024B65E9886443FA5C2903D4ACF110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96346edc-2643-4873-a317-8440d642959b.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\96346edc-2643-4873-a317-8440d642959b.tmp
Size 12KB
SHA256 e9994cd9610e6492983cffd200f40445d1612521eaa601c29f8cb825711aaab5
MD5 6ed8faf3a90b76b955cc2ed341d3ad9b
SHA1 2f2d55a60769e26e3adb976969cea9ae4857340c
SHA512 60d6e071e0ad0e852e4687a2cc5437f4b02a464eaf3f7a05c48cc0fb5bc647f085066f91f9585c093efc0802e21d0914076ce6e3cf408299e01ff9f6ad6dc3d5
SSDEEP 192:XRWcMxTY6Fv7bhAPRp2XL9/Hsb+WNn3E0cHtZAzk+VyIsnAUgtaJ:XRWcW1P8X+LtwU0utH28
TLSH
T15942C42DED147A3B9CDBD629F9627B53DBF52021A0902E84EAFC893C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 a3379522acd43bdceb25d7a528b23dfcd3a91dcd8015651db2b6977e7d14cd09
MD5 c4325c6a40db2802c3a7349fc5e01c3b
SHA1 62bc38997d6d6a8dbb23e74872fe682acdc95434
SHA512 f4766880f494b94915e31b5edd61ae35fa35fb8301658dd9aeeddfbd74b82878539af71e0e8a192e7377255c2a656aa075a7413e228bae9debff6018b7a0bd17
TLSH
T18A2197E7A23414ADC7AC737069C082BC7AF65F93784B2EA7814539BA5605F8777390A0
MD5 SHA1 SHA512 TLSH

Submit Download

3b65f2f7-c726-4963-9302-88be8a76e655.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3b65f2f7-c726-4963-9302-88be8a76e655.tmp
Size 3KB
SHA256 23cb976db403fc7fe0784655d12878d32f53229d1e84ca4ee44e5168fc16f06b
MD5 bc93252b10392c34ecb9909ef1e71c04
SHA1 964a5a0992d7ccf64993e52e8382895902d98adb
SHA512 39b6456185f0aad2ee516d760766456359ac86e36d78001e07defd750278b86bc643a4b6f85e330fc695b38b8dd952d49038ae2399109af0b05b9314d88cf8c2
TLSH
T14E619DF7D3E8856D891196F49A217E2FCE6D0A14432C3C6689D4AE1B53F2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

3ffd0af5-7dbb-4163-af7b-9e191c8d429e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3ffd0af5-7dbb-4163-af7b-9e191c8d429e.tmp
Size 3KB
SHA256 e1adf66a6641548f963dade9a6fd2d0a0456ebf48cd01cdc458da29aae0e5fac
MD5 c670668ec5678823b043a41bf54f8cc2
SHA1 04cd4a7269430f3dad9d556035cf3f6f316d1d45
SHA512 a3afc7b83f7e105d033d29a60fc5af8ba09fceb9636e5169e79243cf0b3a74e97c3bd2e62e870246d39ff03ff2b17b463b97243c22e3f8c801203b9227b7723f
TLSH
T12261ADF7D3E4856D8911A6F4DB116E2FDE6D0924032C3C6689D4AE1B53F2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

4bbbac7e-f6be-4766-a5f7-6850c48ba365.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4bbbac7e-f6be-4766-a5f7-6850c48ba365.tmp
Size 3KB
SHA256 2bd5c52acac50f59146fd715287bce434467fe0c4f1b4d6b44645981352581e6
MD5 ecd22877d6d1c6064d2cf3200f6edf87
SHA1 313018598100659d7b776618dc27962f4ffa916e
SHA512 143ab624c40b8136e9096742049eabd0fd0b8529a60062f5f2b51effbc6e6dd6e2f0541ab29f881c46dc53c56b73ecfa52f57a78ff1baf9f0fcfd4152cbdc46e
TLSH
T1F7618CF793E8856E891196F49A216E2FCE6D0A14432C3C6689D4AE1B53F2972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

6ac2124b-cefe-4990-835f-27dffc3d2c4a.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6ac2124b-cefe-4990-835f-27dffc3d2c4a.tmp
Size 2KB
SHA256 817d535d93d10e81c8e56d4482b550d70b30ad3057ace823ebc96c4a28f3bc22
MD5 e32f0a4d0d9d473f3244605c7eb4011f
SHA1 c11a507829bd1f92a6ff86b1caee02b9119b3f4d
SHA512 df9d3957c84fcbebce10f53fa15f240ea322aaf07e7db8f65d038bc830f91591b99a195c0a10f79e105d6af4fc14477474040604078fe9f29b931de0187904ec
TLSH
T1B9518CF793E8856D891196F4DA216E2FCE6D0A24432C3C66C9D4AE1B53F3972D24078E
MD5 SHA1 SHA512 TLSH

Submit Download

805d558e-7d77-46bf-b67c-9e67f62217e4.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\805d558e-7d77-46bf-b67c-9e67f62217e4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 a6c196a28075fe46b238b4de450e0d14c027f675909cc1361e3d91e88483a56b
MD5 6713ad11d1703f2eafd8601bb0770633
SHA1 e7b640c38aa004b9ea8acef9aa7f8428d3a4725b
SHA512 da0c09426da380d3d5ab866ece67945d1f22f397164044c57b59258e0caf5f65c080b84d048e3ed85a5adbc458c9e71ffa08ce7af68d31b7f25b95e247eb3ff2
TLSH
T198B0120580416701C0C103B023A0A45433608F34D11213D642E02D4198315A1501B108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 92dd6b8245ee9a81261a0f845bb9b69aa7be4f5c0abe7f53833cec2e29047631
MD5 efa945b5a8581b5a5e066b8af5fc64df
SHA1 18aea9f885b3d86fc2f1d59c89628c9eaed23d71
SHA512 8ffa0c6554541f469b0d045bd61a970600840c5e91f51ac32d9ffdc91ec6d088650165c7c194187a5ef88128af459d05584d619c421e72635c53a8b5e22d2cbd
TLSH
T170B00255C143662AC44307B035E5A9DC7661EF25C6136212D2E01E67DC2D7778525161
MD5 SHA1 SHA512 TLSH

Submit Download

b1bf8928-fe9a-4fef-870c-f03e35b4ea4d.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b1bf8928-fe9a-4fef-870c-f03e35b4ea4d.tmp
Size 12KB
SHA256 1122b7088de4adde296ef21cf6c0a95c4dfcd984bbc19f0502d652e1e65952db
MD5 1a118e09ed78f0b9eb1cc8dc7d5f2f84
SHA1 9f4ebbd628742cf860612af355c8eef132fef5ec
SHA512 13bd68f183abbbc38095d6a11e6679312221cc78807c2f42b4882fc5a8ad9d8d0ad26c89427df3dda63c24e03423ca4b95306d633d046fcabb0066483ec3a9db
SSDEEP 192:XRWcMxTYgFv7bpAPRp2XL9/Hsb+WNn3E0cHtZAzk+VyIsnAUgtaJ:XRWcM1PUX+LtwU0utH28
TLSH
T1DD42C42DED047A3BACDBD629F9667753DBF5202160902E84DAFC893C24E79CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cc3c9e38-791c-4420-ab71-f5ac0d2ae085.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\cc3c9e38-791c-4420-ab71-f5ac0d2ae085.tmp
Size 13KB
SHA256 8253a7f3513f0bdb6bdb4834df59ed24cf9852c04784fcca7ab1e925bec5790b
MD5 3a79b09b5e95b13a7391b6de0a94f3cd
SHA1 20995d3cf7991c174ba7739969875a5f7ef61523
SHA512 36600fd45276a1524ea5659fd1d3a2f3a134906abc7efad3226eaaac872c366b3dfad8400ed26c33ecf54704ce9484418658ab7c50b34ea57f838998cd030e80
SSDEEP 192:XRWYMxTYdFv7bhAPRp2XRlX9/Hsb+WNn3E3jg22HtZAzJ+VyIsnAUgraJ:XRWYJ1P8X+btwU82Yty2e
TLSH
T18A52C52DF9047A7BACDBD629F9557B53E7F52021A0802E84AAFCC93C15E75CD221701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef45517d-2760-4b48-a55d-2b9986badbfe.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ef45517d-2760-4b48-a55d-2b9986badbfe.tmp
Size 414B
SHA256 551d8673f04830948fed920b3041d31f3ab64747936364af846479c1b0ab33cd
MD5 fcbeced5021979cdc3a22141752c3f96
SHA1 30f62c78b04991084da080356d82699dbf8d1981
SHA512 882258430bea58d9fe92bab7d242e8f4202b3e1ba3a92aa52dea297d825ab8bfcaa5c8db5550c84c67cfb7eac07e1cd84c3b622b11cf83b434a7fc17cfc52a0c
TLSH
T150E022A9C820FC3B09FA471C54544B4AEA5023672790895F3A3D822D8FB163B06DA92C
MD5 SHA1 SHA512 TLSH

Submit Download

Madium.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Madium.exe.log
Size 1KB
SHA256 5d8af3c7519874ed42a0d74ee559ae30d9cc6930aef213079347e2b47092c210
MD5 b4e91d2e5f40d5e2586a86cf3bb4df24
SHA1 31920b3a41aa4400d4a0230a7622848789b38672
SHA512 968751b79a98961f145de48d425ea820fd1875bae79a725adf35fc8f4706c103ee0c7babd4838166d8a0dda9fbce3728c0265a04c4b37f335ec4eaa110a2b319
TLSH
T1BF219A722372B1D489163F83085D568827FF8329B550ED0CB999724EED2B01B5B223F7
MD5 SHA1 SHA512 TLSH

Submit Download

Executor.exe

Path C:\Users\Admin\AppData\Roaming\Madium\Executor.exe
Size 3.1MB
SHA256 339c4d16c6a1f1fce85081ffe077cd30e35850d46fcdd7fd89d675fce3d8b7ab
MD5 25b4240e976e50d50efc733206b4729e
SHA1 5369412f34783705e988c9518421443478448c6c
SHA512 675aedee1b344d39c0a0f9cc7a7b062e5e28c1abfd733aa6947d7f4beecdee9e7df217f568f58e57e5e96c0ab3c03aa0ecf49546945ce9c7e2a5bc55c62b7227
SSDEEP 49152:nvblL26AaNeWgPhlmVqvMQ7XSKCGZjMc6vJCtoGdUTHHB72eh2NT:nvBL26AaNeWgPhlmVqkQ7XSKicv
TLSH
T13BE55A143BF85E32E16BE6B2D5B0501663F2F82AF363EB1B2181677E1C53B505C416AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1dcd9c2f-d0ba-4f1d-bb1d-38e24e420764.tmp

Path C:\Users\Admin\Downloads\1dcd9c2f-d0ba-4f1d-bb1d-38e24e420764.tmp
Size 3KB
SHA256 f7128af19046b119a8a6d132cc3fb258427bce22dff98b5dcb3aeb49e6eb1590
MD5 e0d5d2c9fa338a97c40b4dd36ba1139f
SHA1 fb62038c077f41b0660adf83f0eb13b68a69251c
SHA512 951fbe49998a9bfe65b4d06dc07fa7c9a91e8be9f6fb6938dcde8ec904c01c6cd9e535f4bf19ee9079a5e901a46fe37ac2f7f25e3784a1a4533259f53beee677
TLSH
T17C7133616F094803D32E46FC869636046BB09AFA3753D7CFCCD960E225577D2740A6D7
MD5 SHA1 SHA512 TLSH

Submit Download

Madium.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\Madium.exe:Zone.Identifier
Size 153B
SHA256 3610b01c0bd79a4ace4c15de98ecfadf7c342a90cfd2cb267c2f54607fcc45f7
MD5 31b753dd3172449dc1f9ff83ebfc60cd
SHA1 ed2269731675c4d23343e6829018888abe180fa7
SHA512 7e010464d8370a046f499d26397ddc5ebf3fde188ff8a69922e371fea194b9e3900bcf5b9f8813c0de89dad50f048bdeea39fbf02a633d4eb05222539dde3fe5
TLSH
T1DEC080F7800485A6030523C8129C445C744F651988BDC524A450815F5505554D5D4076
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1376-89-0x000000001DBE0000-0x000000001E108000-memory.dmp

Download

memory/1376-10-0x000000001D2A0000-0x000000001D352000-memory.dmp

Download

memory/1376-9-0x000000001D190000-0x000000001D1E0000-memory.dmp

Download

memory/1376-8-0x00000000024A0000-0x00000000024B0000-memory.dmp

Download

memory/4044-0-0x0000000000380000-0x00000000006A4000-memory.dmp

Download

memory/4044-1-0x000000001CB20000-0x000000001CB30000-memory.dmp

Download