48f359326787a848b89d838a318d797c51fd7feeeee602fff5f46b9d3f7b53ce

Analysis

user interaction
yes
max time kernel
109s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/08/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$RYFZLDB.exe
Size 9.8MB
Sample260809-13skfawfqd
SHA256 48f359326787a848b89d838a318d797c51fd7feeeee602fff5f46b9d3f7b53ce
MD5 32e6c794181e84ec3ddb154ed5e65391
SHA1 9a6f359a8ba80338cc83200e8b6b0b06a9d4e290
SHA512 582171a6fa99246b4919f30c73e385aa26f55407dfab040188970aef9d7fb1ac12f1c3fd635efb8a5aebe484a0bc7c85be65a0ac2344ce8a95d4e1f64886425d
SSDEEP 196608:/CIlL/mwLN9H3eeYbuN3VdC61kyGxyzriAZOLqJt6dl:awL/mINZePbtyviOt6d
TLSH
T182A6330377A623F5D076C93EEC92120D277278725F64EEEB1768EAB10E661C48E3E154
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3280	powershell.exe
808	powershell.exe
2080	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
4820	MadiumInstaller.exe
1432	directx-redist.exe
5164	DXSETUP.exe

Loads dropped DLL 4 IoCs

pid	Process
4820	MadiumInstaller.exe
4820	MadiumInstaller.exe
5164	DXSETUP.exe
5164	DXSETUP.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\DirectX.log	DXSETUP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	directx-redist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DXSETUP.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1032	dotnet.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000009849ce13e51016660000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800009849ce130000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff0000000007000100006809009849ce13000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a9849ce13000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d9849ce13000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies registry key 1 TTPs 7 IoCs

Modify Registry

T1112

pid	Process
5944	reg.exe
3920	reg.exe
1500	reg.exe
5220	reg.exe
1748	reg.exe
2712	reg.exe
2928	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3280	powershell.exe
3280	powershell.exe
808	powershell.exe
808	powershell.exe
2080	powershell.exe
2080	powershell.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeDebugPrivilege	808	powershell.exe
Token: SeDebugPrivilege	2080	powershell.exe
Token: SeBackupPrivilege	5028	vssvc.exe
Token: SeRestorePrivilege	5028	vssvc.exe
Token: SeAuditPrivilege	5028	vssvc.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4820	MadiumInstaller.exe
4820	MadiumInstaller.exe
4820	MadiumInstaller.exe
4820	MadiumInstaller.exe
4820	MadiumInstaller.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4820	2504	$RYFZLDB.exe	80
PID 4820 wrote to memory of 3280	4820	MadiumInstaller.exe	81
PID 4820 wrote to memory of 1032	4820	MadiumInstaller.exe	83
PID 4820 wrote to memory of 5220	4820	MadiumInstaller.exe	84
PID 4820 wrote to memory of 1500	4820	MadiumInstaller.exe	85
PID 4820 wrote to memory of 3920	4820	MadiumInstaller.exe	86
PID 4820 wrote to memory of 5944	4820	MadiumInstaller.exe	87
PID 4820 wrote to memory of 2928	4820	MadiumInstaller.exe	88
PID 4820 wrote to memory of 2712	4820	MadiumInstaller.exe	89
PID 4820 wrote to memory of 1748	4820	MadiumInstaller.exe	90
PID 4820 wrote to memory of 5976	4820	MadiumInstaller.exe	91
PID 4820 wrote to memory of 808	4820	MadiumInstaller.exe	101
PID 4820 wrote to memory of 2080	4820	MadiumInstaller.exe	103
PID 2080 wrote to memory of 1432	2080	powershell.exe	105
PID 2080 wrote to memory of 5164	2080	powershell.exe	106

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\$RYFZLDB.exe
"C:\Users\Admin\AppData\Local\Temp\$RYFZLDB.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\MadiumInstaller.exe
  "C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\MadiumInstaller.exe" --from-sfx --first-install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; if ($null -eq (Get-Command Get-MpComputerStatus -ErrorAction SilentlyContinue)) { exit 0 }; $status=Get-MpComputerStatus -ErrorAction SilentlyContinue; if ($null -eq $status -or $status.AntivirusEnabled -ne $true) { exit 0 }; $p='C:\Users\Admin\AppData\Local\Madium'.TrimEnd('\'); $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { Add-MpPreference -ExclusionPath $p -ErrorAction Stop; $current=@((Get-MpPreference -ErrorAction Stop).ExclusionPath); $has=@($current | Where-Object { $_ -and $_.TrimEnd('\') -ieq $p }).Count -gt 0; if (-not $has) { throw 'Defender did not save the exclusion.' } }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3280
- - C:\Program Files\dotnet\dotnet.exe
    dotnet.exe --list-runtimes
    3⤵
    - System Time Discovery
    PID:1032
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed
    3⤵
    - Modifies registry key
    PID:5220
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x64 /v Installed
    3⤵
    - Modifies registry key
    PID:1500
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed
    3⤵
    - Modifies registry key
    PID:3920
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\VisualStudio\14.0\VC\Runtimes\x86 /v Installed
    3⤵
    - Modifies registry key
    PID:5944
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
    3⤵
    - Modifies registry key
    PID:2928
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKLM\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
    3⤵
    - Modifies registry key
    PID:2712
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\EdgeUpdate\Clients\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5} /v pv
    3⤵
    - Modifies registry key
    PID:1748
- - C:\Windows\System32\reg.exe
    C:\Windows\System32\reg.exe query "HKLM\SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full" /v Release
    3⤵
    PID:5976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -NoProfile -NonInteractive -Command "$sig = Get-AuthenticodeSignature -LiteralPath 'C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe'; if ($sig.Status -eq 'Valid') { exit 0 }; exit 1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:808
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoLogo -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2080
  - - C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe
      "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-redist.exe" /Q /T:"C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1432
  - - C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe
      "C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:5164

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5028

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Madium.exe.download

Path C:\Users\Admin\AppData\Local\Madium\Bin\Madium.exe.download
Size 12.0MB
SHA256 031e36ef302fcfc8527ec40cced1b9b6bfa2508493a8744932fd6403fc0edc51
MD5 2966c58c704d2bee7afef243b7869803
SHA1 2001497a15f0a0cbad893b95c095e76ce84330fa
SHA512 a02fb75e6e01763e3603d51d287f0c487cd5ffa662888c1fdd417e0a0b731d6b0b8a2aef687f4c868d07220e66c56bb634990a26c19ab08ec6ba0eacf83e1ca2
SSDEEP 98304:/a1SvjiiHzI+G715W7Z2u2cJ4M68ayxOfwkQy7ej/RfD68e6f1+jzAY8z8p+dQxE:jveUXkQy7ejRb6A0DYG7BBn+6wa1nw
TLSH
T11EC6BF07F64481F4C4AEC278C36B9636EA32B889453471AF1BE45B112F2BF606F1D799
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxupdate.cab

Path C:\Users\Admin\AppData\Local\Madium\INSTAL~1\temp\deps\DIRECT~1\dxupdate.cab
Size 94KB
SHA256 e18a5404b612e88fa8b403c9b33f064c0a89528db7ef9a79aa116908d0e6afed
MD5 d495680aba28caafc4c071a6d0fe55ac
SHA1 5885ece90970eb10b6b95d6c52d934674835929e
SHA512 a25c647678661473b99462d7433c1d05af54823d404476e35315c11c93b3f5ece92c912560af0d9efe8f07e36ae68594362d73abf5d5de409a3f0a146fe31a10
SSDEEP 1536:JvknxJRHNYzrAzRstaRGk0jzphvXdy57XwwnNb+vnaI1eYpIKxozNlmn6F5x:JvknxJpNYAzRstaRkz0BwwnNbSa+vp58
TLSH
T1BA9302EC875DCF93D5622DADA168EA0B7DBEF98E891CD42580B5F20418627DCB2F444C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Users\Admin\AppData\Local\Madium\Installer.new\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

DSETUP.dll

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DSETUP.dll
Size 93KB
SHA256 2a61679eeedabf7d0d0ac14e5447486575622d6b7cfa56f136c1576ff96da21f
MD5 eb701def7d0809e8da765a752ab42be5
SHA1 7897418f0fae737a3ebe4f7954118d71c6c8b426
SHA512 6ff8433c0dadc0e87d18f04289ab6f48624c908acbda506708f5e0f3c9522e9316e587e71f568938067ba9f37f96640b793fdfaa580caedc3bf9873dc221271f
SSDEEP 1536:Bc8tBKv1HCyODN2wjIqlLmqxY3AMVI4I9okOEvc0/c/sZRYltL26VVE2S+JJqsHy:BftQv1iyODswNLmqxY3AMV71Ev54EAxM
TLSH
T113937D107694D076D9D620BD718CD7715ABEA6B41F6880CBBB461BDA8C653C0BA3E30F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DSETUP32.DLL

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DSETUP32.DLL
Size 1.5MB
SHA256 fb0e534f9b0926e518f1c2980640dfd29f14217cdfa37cf3a0c13349127ed9a8
MD5 d8fa7bb4fe10251a239ed75055dd6f73
SHA1 76c4bd2d8f359f7689415efc15e3743d35673ae8
SHA512 73f633179b1340c1c14d0002b72e44cab1919d0ef174f307e4bfe6de240b0b6ef233e67a8b0a0cd677556865ee7b88c6de152045a580ab9fbf1a50d2db0673b4
SSDEEP 24576:CIQ+ddddddddddddddxOOOOOOOOOOOOOO2iWeXiWeXiWeXiWeXiWeXiWeXiWeXi+:CIQsOOOOOOOOOOOOOO2iWeXiWeXiWeXf
TLSH
T166759D31B1D40332EA7103B177128AB7F63EEB9DE119DA257DAE82552182B9CC37E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DXSETUP.exe

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\directx-files\DXSETUP.exe
Size 505KB
SHA256 8f47d7121ef6532ad9ad9901e44e237f5c30448b752028c58a9d19521414e40d
MD5 bf3f290275c21bdd3951955c9c3cf32c
SHA1 9fd00f3bb8a870112dae464f555fcd5e7f9200c0
SHA512 d2c354ee8b6977d01f23c6d2bb4977812bf653eae25e7a75a7d0a36b588c89fcdbdc2a8087c24d6ff687afebd086d4b7d0c92203ce39691b21dab71eafd1d249
SSDEEP 3072:Qi6LKKSPluzye9iHWptICTrbusJxDO9insyH6+PJTOramZap5XVeR4zW1mFD1gbH:8UHWDICTmUxDpEa04+GU
TLSH
T103B4B05036F4D926F2F32B743ABDE26158BA7E80A934C20D2501665D1BF3B40A96CF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

install.ps1

Path C:\Users\Admin\AppData\Local\Madium\Installer\temp\deps\install.ps1
Size 2KB
SHA256 7f7eb8cf4fba079948705a83f968f52937c9f1733e752eda436ba6319cd5bece
MD5 6b839d23be8eb3f524a742bf0ab52299
SHA1 3416d874e28f19d2ed45ad94b085af7d9ca30c57
SHA512 104f4fdab5f5b78133ebb81763e81399c5ab25ddd4d5830dd11ebad806582e08a571f926418399545bb99751bed3f2b71a33dc2852e304e9d826b414d020c04d
TLSH
T17241320579F271A246F42A3319894245662B941AC10D6E103CBEC3C5FFE28BF9FEC756
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 61KB
SHA256 4709689ec4049202b2f7a5c6495119ff138a9e8d35b1c610b5458b5c86ebfacd
MD5 da811caec0c86c21b4743eb6c08357c2
SHA1 09f46595c8902e534b17815dd95b678ead94257b
SHA512 f50981d6e00fa7d9027973cd0d239602f246bfa8710afbd8cb0eaa1935b80f04fd7a179073a33e8708aec3b528c1e9c4a72fc55570b23f3f334531ea026dd828
SSDEEP 1536:KflJdfh4iUx4YklMRbfKQOUpeEdqMdDa5wcNC+jH0IMGMFYoe5V3CNBQkj2KOdBS:KflJdfqiU4YklMRbfKQOUpeEdqMdDa5u
TLSH
T17E538392E9204E75E2E65F3EF15622627D30394690F8113211DC25EFA9879930B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f66dcfa4d243b9575b66da1fe2c62d2c8e2c4f154a127577be26a96b157180aa
MD5 285a864881f5152cce226844752093ca
SHA1 7cead409a5e24fe197e4bd2747902fef82c6337b
SHA512 5eb032566acd010c52d5fbbf738ad77b022f82291c4c3bf92452ca648965c6b4fd5c792a73199b51d0ddb4e2da96a64561fd158b03af516209878b681c554998
TLSH
T17F21A833B7ACC235C8D911BA2088AD01B2B5C3C7449ECECB7B84C508A57F99ADF641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 0cd81283d168fc891b184d052817ff13f641633e53a34e5a82e8b77971a3dea9
MD5 396d5bcfe920bc5eb8e66ab37f7ee1e7
SHA1 ec24ac9bbfb45b735685087ca6c5d62152b2e823
SHA512 b53bd14c09bfc83953fce9f47759ae404a7a7dca6ed478ebc9bac05f4d6fba3c4277ac735f91245e0d8c3e84da846420fd47abd707e6ad3f8e317129871d7ae9
TLSH
T1A821A833B79CC134C8C911BA108DAD01B2B5C3C7449ECE8B7BC4C528A5BF89ADF641A4
MD5 SHA1 SHA512 TLSH

Submit Download

MadiumInstaller.exe

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\MadiumInstaller.exe
Size 201KB
SHA256 6fd337856b578dcd62a24c5247ca5ba92de246acc0a2d95e03400dc954a97f1c
MD5 e9d216ac267648102c67fb1c9e424fc2
SHA1 b493db516a01022ca9c8c6e90b8060df7cfa5cd6
SHA512 f07f7bff35b56d4e2a5c0c95e7394c13e62a7740b55aa1d60db1f9084408c78e30497ebdc924d64102539489be593c457b325cc68985b549222c399d49f947c5
SSDEEP 6144://6h0bqhOCz3hu01iXdfditfn4O5rEH9pJfsEC:XsLPoi9n4O5rc9p1i
TLSH
T143147E16FA6500F9E25AD5BC8D534A02EB73F896073197CF17804A7A0F27AD85E3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\data\app.so
Size 5.3MB
SHA256 0f6f8ad3b139c34d223f57f799a84065ce42530de7d87a9123a62169d3eb04a4
MD5 a320110f47d768152340cc2f34181dd8
SHA1 793aedc2949b11b0db7e63280cb3000170a8b1d6
SHA512 ecd1212b47d91ccbc62f73f5865d4fecadae570c3d08c82dc7fc6f1326351e636d86253ef43bb0ac45534d3dee4990f99f4dedb14be52ff95cb0b3c3968454b8
SSDEEP 49152:SfVy5hF5ziF3mfcGjChmcUWo3f352/yMjByBRSRpe0V8BxV/zNyzB570gKHoZtXW:Sqf5IRpSBxV5yd57b5UT
TLSH
T13C46F897C0E48770D572E772B75F26B65E1438CC4E70B68607C86A563E9ACE04ACF272
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AssetManifest.bin

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\data\flutter_assets\AssetManifest.bin
Size 2B
SHA256 f566cc6fccc657365c0197accf3a7d6f80f85209ff666ff774f4dcbc524aa842
MD5 0b0a3415aad49b6e9bf965ff578614f9
SHA1 db5b55a9b215f744db82517864984d073f2e8f8c
SHA512 0404c26467d39c9394c15c26d360cb48cc474aeefe2bae5fd5d46b72b5e9ebb8f1497d561dfed5a21942db92b648bab8167d8e02f5f19880a77e3afdc68526f8
MD5 SHA1 SHA512

Submit Download

FontManifest.json

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\data\flutter_assets\FontManifest.json
Size 82B
SHA256 28b1eb2b3d2e1ad60b8c8b0f9100b1ccbf492f7fa97f5bebb51ea97e73926e7d
MD5 7b2a36307916a9721811788013e65289
SHA1 f83d716c83a8a1cdf2a5c7b5fa387e9a62f2d49d
SHA512 0659dbdc8042768ce6e75c5e36fef1f93fde820dced5e2cf07f0949e59b25f87c01607f97c1926a792dbda28ebd7e4334ad942dfef3782e5ceb61de893f8df67
TLSH
T141A0120F005405D540CD9045F0957051E040284B000BC4CAD164064493E2130033C307
MD5 SHA1 SHA512 TLSH

Submit Download

NOTICES.Z

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\data\flutter_assets\NOTICES.Z
Size 102KB
SHA256 bdb492de2b031ec16101eede4cd2f26feefcd75c16a09239fa471a9cc552fcca
MD5 79e3b032d03665232fb84f194fc934bd
SHA1 cd30f816703e3d15a6c5d3f7c986005c044f7425
SHA512 4d2f906c47e088e8e8256063fa21425e8989e97a0ac94230ca1650177f68b332f65dcd800be281b12295596aa56d022cc88d444fa27a8cdf12e23206e7550323
SSDEEP 3072:n7tECDp05eSkCmIQ+P/sKr/bw+hoh5H3/P:n7tEC8e+o+H28oh5H3/P
TLSH
T125A3127E6A2C044171BC119D23498B64FEA6FBC630C94EFEB43352B41D7A889712D572
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MaterialIcons-Regular.otf

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ink_sparkle.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\data\flutter_assets\shaders\ink_sparkle.frag
Size 21KB
SHA256 1fe8436a743884cb65078fe8c7b38e18f5365f2a2961270916f426fd13c604af
MD5 0a8f4531af1d1a54aee8c7d23e640d2d
SHA1 0e13f340acb6eab5ddfcf70df99d06e3fabbb454
SHA512 e93fe163ebddb759a7f53c611eedb560fce18c5f5536b8a19781a3c5c3aabb0c0fcd65159b24d60c5113f3c542bf417132f3e8aa5b9b996b5b546cdb34683b51
SSDEEP 384:TThcP2xBwl0yU6iMRRLkgpXlp+TrlI+6QkopXlp+TrlIPLmNlkf/M+c3Vp3P9KP:TdcP2xBwl0yUNeRwoL+TrlIPzgL+Trly
TLSH
T121A23348D2E60E22DD166B3D556B21043F3EF09BAB67D2033748BA547F87327468A6D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stretch_effect.frag

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\data\flutter_assets\shaders\stretch_effect.frag
Size 17KB
SHA256 62a899ff4e168ac6ca888ce7c2f40e5d3fbf8ca20a1c3ded781a116a6d7907e2
MD5 4acf2167e56d604e5acd1928ac03f0cf
SHA1 38c5e7d5b2583906cc67f5c018c06c5b43bdd120
SHA512 097a61ba8ea49c29dd06c92358094a423c9baec14027f2fed616d8da24bb91beb9c82bfdb3fe42de2c1610028a2ae6dbe01ae3636a813c7f0d6fa55369e140f2
SSDEEP 192:8sVNLhNETx5kgIDkHs9tmogoxjaDViqNi6O9aNiqgiSuKRqDi64BaXiqGiaaZdBf:8Mph6Tx59HUtXYDc2/boE/
TLSH
T1FC821254D6730897CC5BA37D4E4F0218AB34C087968687037E4DF224AF8676A4AA9FD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Users\Admin\AppData\Local\Temp\MadiumInstaller-1019E7AE-5A6D-4FCE-8FE4-BC4A57C6150B\flutter_windows.dll
Size 20.3MB
SHA256 a5c880a4218a04cfb3e58b103160334658122c5e43d3b818b3d9af5ab3e1fc0e
MD5 0c8c6ad1f023a515e37ab2bce12b4512
SHA1 d97f4ef98acc752a2ca6cd7fa89b605205f9cb24
SHA512 18445153a65b0641d85676cff4a17d736065822bd56a9bc712b3e61d96201cbc10e46f2e4fcf2568f7f29bd22ec15bce75bd7897c90773bf3cceb42d20c7c33f
SSDEEP 98304:B24Wmz6AP8+AmlPps4yoz95mYjH1x0q1KiROOUsMuZSxAwg5mByfcdrNh7k/WV4h:Bt8omoxj1IWEjEw9+BZ5vStib5HHe
TLSH
T1E2276C03E29640EDC059E179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_iqbiv1tx.lyp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_iqbiv1tx.lyp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DirectX.log

Path C:\Windows\Logs\DirectX.log
Size 475B
SHA256 123fad3fcd11382b4a4d88e846d4b484e6bbb66a6e8bcb8c718929da872aa061
MD5 99e1dfad11fe373c99dd442a1a4ed706
SHA1 36e1e258d7756538543162c8c4a4ad034f79c650
SHA512 a05b7da17d8ba8e36acf51dbdba6efa2981d044e27d6cdb6afe9ad82a9d8320e644d083e310036458baffea701208b2daab0a7e6a3c82193697de2db14aafe24
TLSH
T162F0F8A8AABB24C175056426D96BB890EEDE20239DFCD87E33581B92422271D8F0DC07
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3280-100-0x000002072E6E0000-0x000002072E6FC000-memory.dmp

Download

memory/3280-97-0x000002072E5D0000-0x000002072E5EC000-memory.dmp

Download

memory/3280-101-0x000002072E6C0000-0x000002072E6CA000-memory.dmp

Download

memory/3280-102-0x000002072EB90000-0x000002072EBAA000-memory.dmp

Download

memory/3280-103-0x000002072E6D0000-0x000002072E6D8000-memory.dmp

Download

memory/3280-104-0x000002072E700000-0x000002072E706000-memory.dmp

Download

memory/3280-105-0x000002072E710000-0x000002072E71A000-memory.dmp

Download

memory/3280-98-0x000002072E5F0000-0x000002072E6A3000-memory.dmp

Download

memory/3280-99-0x000002072E6B0000-0x000002072E6BA000-memory.dmp

Download

memory/3280-89-0x000002072E420000-0x000002072E442000-memory.dmp

Download

memory/4820-131-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-24-0x000002209DE20000-0x000002209E379000-memory.dmp

Download

memory/4820-120-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-119-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-139-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-83-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-22-0x000002209AFD0000-0x000002209AFD1000-memory.dmp

Download

memory/4820-26-0x000002209AFE0000-0x000002209AFE1000-memory.dmp

Download

memory/4820-467-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-121-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-25-0x000002209DE20000-0x000002209E379000-memory.dmp

Download

memory/4820-30-0x000002209DD80000-0x000002209DE00000-memory.dmp

Download

memory/4820-29-0x000002209DD80000-0x000002209DE00000-memory.dmp

Download

memory/4820-483-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-484-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-485-0x0000022098050000-0x00000220994D5000-memory.dmp

Download

memory/4820-23-0x000002209DE20000-0x000002209E379000-memory.dmp

Download