01481a2cc1889fafb83b734421f7a5d0a76e11d254349859ab2058de2db87eb2

Analysis

max time kernel
150s
max time network
91s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/02/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sup.msi
Size 164.6MB
Sample260205-ce1n5sdv3g
SHA256 01481a2cc1889fafb83b734421f7a5d0a76e11d254349859ab2058de2db87eb2
MD5 502ac6dac1c6639ecf5961c502d1c5b7
SHA1 c68d79e7d3fe787e8fee65ec62d2bfeb8c7adc03
SHA512 c4b4d3a117bbadb9b81d51c7d306b1ff9e84418cf9d5a693742c754b466da5ad8258ceec74e61ebc72d6ebc55551b4a9fd75f546ee8eb90b10ea1fc970a42935
SSDEEP 3145728:7AT+8pIgQGq9gy9BLgY802LHsgMTJWjvrVpHiXShnILp2+UQ:8T+MqgyQY96uVW7hpHiXSmnUQ
TLSH
T152883308FC29CEB3DB5A903DE6A23B584F3D8C73460240416EF5F59E5E7D5AA17A8183
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
3780	superintendent.exe
2796	superintendent.exe
2860	superintendent.exe
4448	superintendent.exe
6088	superintendent.exe
220	superintendent.exe

Loads dropped DLL 10 IoCs

pid	Process
4448	superintendent.exe
4448	superintendent.exe
4448	superintendent.exe
4448	superintendent.exe
4448	superintendent.exe
220	superintendent.exe
220	superintendent.exe
220	superintendent.exe
220	superintendent.exe
220	superintendent.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-650218026-1419908266-2856590055-1000\Software\Microsoft\Windows\CurrentVersion\Run\HyperPackQuickCoreator = "C:\\Users\\Admin\\AppData\\Local\\MegaMaxion\\superintendent.exe"	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5838ce.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAB9BA764CA2EB4AF.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{021B2F19-5A23-49B4-B355-0AB35869B2AD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI406F.tmp	msiexec.exe
File created	C:\Windows\Installer\e5838d0.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBEBC181C07941FA7.TMP	msiexec.exe
File created	C:\Windows\Installer\e5838ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4AB1794DE16FF2F9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF53ED3494A27A8747.TMP	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5132	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000a09cc7b9ddbd1cc00000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000a09cc7b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900a09cc7b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aa09cc7b9000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1da09cc7b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5028	msiexec.exe
5028	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5132	msiexec.exe
Token: SeSecurityPrivilege	5028	msiexec.exe
Token: SeCreateTokenPrivilege	5132	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5132	msiexec.exe
Token: SeLockMemoryPrivilege	5132	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5132	msiexec.exe
Token: SeMachineAccountPrivilege	5132	msiexec.exe
Token: SeTcbPrivilege	5132	msiexec.exe
Token: SeSecurityPrivilege	5132	msiexec.exe
Token: SeTakeOwnershipPrivilege	5132	msiexec.exe
Token: SeLoadDriverPrivilege	5132	msiexec.exe
Token: SeSystemProfilePrivilege	5132	msiexec.exe
Token: SeSystemtimePrivilege	5132	msiexec.exe
Token: SeProfSingleProcessPrivilege	5132	msiexec.exe
Token: SeIncBasePriorityPrivilege	5132	msiexec.exe
Token: SeCreatePagefilePrivilege	5132	msiexec.exe
Token: SeCreatePermanentPrivilege	5132	msiexec.exe
Token: SeBackupPrivilege	5132	msiexec.exe
Token: SeRestorePrivilege	5132	msiexec.exe
Token: SeShutdownPrivilege	5132	msiexec.exe
Token: SeDebugPrivilege	5132	msiexec.exe
Token: SeAuditPrivilege	5132	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5132	msiexec.exe
Token: SeChangeNotifyPrivilege	5132	msiexec.exe
Token: SeRemoteShutdownPrivilege	5132	msiexec.exe
Token: SeUndockPrivilege	5132	msiexec.exe
Token: SeSyncAgentPrivilege	5132	msiexec.exe
Token: SeEnableDelegationPrivilege	5132	msiexec.exe
Token: SeManageVolumePrivilege	5132	msiexec.exe
Token: SeImpersonatePrivilege	5132	msiexec.exe
Token: SeCreateGlobalPrivilege	5132	msiexec.exe
Token: SeBackupPrivilege	444	vssvc.exe
Token: SeRestorePrivilege	444	vssvc.exe
Token: SeAuditPrivilege	444	vssvc.exe
Token: SeBackupPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeBackupPrivilege	872	srtasks.exe
Token: SeRestorePrivilege	872	srtasks.exe
Token: SeSecurityPrivilege	872	srtasks.exe
Token: SeTakeOwnershipPrivilege	872	srtasks.exe
Token: SeBackupPrivilege	872	srtasks.exe
Token: SeRestorePrivilege	872	srtasks.exe
Token: SeSecurityPrivilege	872	srtasks.exe
Token: SeTakeOwnershipPrivilege	872	srtasks.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe
Token: SeTakeOwnershipPrivilege	5028	msiexec.exe
Token: SeRestorePrivilege	5028	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5132	msiexec.exe
5132	msiexec.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 872	5028	msiexec.exe	83
PID 5028 wrote to memory of 3780	5028	msiexec.exe	85
PID 3780 wrote to memory of 4448	3780	superintendent.exe	88
PID 3780 wrote to memory of 2860	3780	superintendent.exe	89
PID 3780 wrote to memory of 4448	3780	superintendent.exe	88
PID 2796 wrote to memory of 6088	2796	superintendent.exe	90
PID 2796 wrote to memory of 220	2796	superintendent.exe	91
PID 2796 wrote to memory of 220	2796	superintendent.exe	91

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\sup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5132

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe
  "C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3780
- - C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe
    "C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\superintendent" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2192,i,6937810763816744611,15403820947372365963,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4448
- - C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe
    "C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\superintendent" --field-trial-handle=2192,i,6937810763816744611,15403820947372365963,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
    3⤵
    - Executes dropped EXE
    PID:2860

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:444

C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe
C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe
  "C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\superintendent" --field-trial-handle=2292,i,3625443356364164138,424693444063001507,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:6088
- C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe
  "C:\Users\Admin\AppData\Local\MegaMaxion\superintendent.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\superintendent" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2292,i,3625443356364164138,424693444063001507,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5838cf.rbs

Path C:\Config.Msi\e5838cf.rbs
Size 1.3MB
SHA256 59e0f1177f2bdaf901b97b5254d737a0406e1f5f0575e63e602b51746088db39
MD5 02379df360ced323b6464f7664d2a3f8
SHA1 46342604a379f36a23d065183203b96ec636a9ce
SHA512 f62fbfabec62f9c23a94489c575e1d2c14c8a89e0c0027e1d113c626ef1716ccdbc4bd2895ffd7229778bb62d6bba31b7a934e3b6af0a7986e5855742c4c53d9
SSDEEP 6144:miuv4r4OuT9UVbRVFuK61UvidLiCVEamCZK6E45gaUBQrA8u1EffyOCWOJ0RD1Wq:7mUVhcLyaHZK6n1HyOCJJ0dYR0N
TLSH
T1B555BC9344BF757E6925116B23E2721DC67F0621FB4B7E8C823D8B1C6AD35A6F4CA408
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\MegaMaxion\chrome_100_percent.pak
Size 144KB
SHA256 6ce0ccf6a0cc4ea8be11262d168a344bc3ee78a4a6365d755ffb5570bc48d6d5
MD5 facae785097b1c688da1dd683207b47e
SHA1 ac937080ebeb034a8cefa4f1c62442a30ef1c38b
SHA512 18daee712567e7ec259d3c4fccbb32ced1b2a51cee6f3a3466943d3828ab417456b752c27b5ba27339568086fdb7187356a354dc1430014ac7f044c8878cf3cb
SSDEEP 3072:iz8rCGIQRTwsWr8o9RHi/T9P1L2o418Gb0+VRLf0ld0GY3cQ3ERVh2I:iz8DI2TOr8EC/T95K18Gb0OV8ld0GecH
TLSH
T17EE3E0D3B3F4ED7DD79716B7A2160072ECF3466906A1424B168AD8712A76B88CCC47D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\MegaMaxion\chrome_200_percent.pak
Size 215KB
SHA256 68e92cde2557d68eddcf8df21ce4d1ef7a85581fb28cd5ab93db20812217e073
MD5 3c2498da8019596dfd760412e71e019c
SHA1 40c8d082822dcaba3f67d3533a1e19fe53df4cf4
SHA512 9ad9fe63673b3bae1a6dc17c056896f21baf4781a20a415734be978dc5ed00617b334375fda42b0e18890925520b5a45ae4d5bd5a1c919d01fef1e8290bd6234
SSDEEP 6144:LDQYaBN6svyAEWnIEb7r8EC/T9ugx5GMRejnbdZnVE6Yoppx4:4fBN6svyA1F4B79a6edhVELoXx4
TLSH
T16824F1C7B3F89D3DC5630AB7622601F1FCB211390AB6554B17CBEC747996AC989C9283
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\MegaMaxion\d3dcompiler_47.dll
Size 4.7MB
SHA256 af7b99be1b8770c0e4d18e43b04e81d11bdeb667fa6b07ade7a88f4c5676bf9a
MD5 a7b7470c347f84365ffe1b2072b4f95c
SHA1 57a96f6fb326ba65b7f7016242132b3f9464c7a3
SHA512 83391a219631f750499fd9642d59ec80fb377c378997b302d10762e83325551bb97c1086b181fff0521b1ca933e518eab71a44a3578a23691f215ebb1dce463d
SSDEEP 49152:hCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvdiD0N+YEzI4og/RfzHLeHTRhFRN1:oG2QCwmHjnog/pzHAo/Ayc
TLSH
T13C367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\MegaMaxion\icudtl.dat
Size 10.0MB
SHA256 a9f6072e858ea29cb66501847856d403c862f23d03cac2656d1e0fa2865fdc7b
MD5 ba9e45bfca3621e4086e6a1870f8cc41
SHA1 8d1b2d42707812608907f8000041c16e7755532a
SHA512 07ac486039098753d77b53ce0638a172c583620d6feae0447da9b8931fe9e0f8b108ca7c8282b6596bdcfb252b3600bdfe7cb01c96b3564605084a932dc7298b
SSDEEP 196608:fwPBhORiYAXHiXUxY/iJ53IWhlVjEeIu2YEs:fswkpHiXUxY/iJ53IWhlVjEeIHs
TLSH
T199B63807A2FB8DC6F9F76F30E8F452679567BD496E32805911042F3B1D332A08661BB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\MegaMaxion\libEGL.dll
Size 481KB
SHA256 0be5218bc12b160bd199660b17ae56f1655af3a2a888f98be1548b118921c875
MD5 ea6e03151dbf03a312543c14aef091c1
SHA1 8a42570b7534c8be79234bdd02733d4af5ee8565
SHA512 e00d5695587d4373dd5607ec350b5d8ad9cddddc27b93f7b5e56b6b70234eae6a7e1a8b3f7e535ce8a639a4d412cf7b5b4f4fa5643a655afdba95f6bf0337895
SSDEEP 6144:yzfY+zGrn5XrjwM1ttv/j91osMeHXsHQ20dxmvQEzYzq5rNtr:gYdvwMztv/jXRXb20dxmvQKYW5r
TLSH
T1FBA48E15B3E454A9E06AD134CA534642DA77B4920F69FBDF03E492392F37BE85B39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\MegaMaxion\libGLESv2.dll
Size 7.6MB
SHA256 819b28bae6eb30a8b85cd12fee30ef5948cb096d14fa947917a45016fc40141a
MD5 8cfeeab96424c3228377291f2b1cfed5
SHA1 086af2ce56ad31b972085270d5676e7a60da1ada
SHA512 732b11c4fe6f0ca4717a5e886bbdf408867019471d60571b2b286ef73a81408d7af99fc04a5c143018ad8f971b5abe2fec064502f0df8aff878c439d0a22f396
SSDEEP 98304:QKk83dcG4wSevbc5Wk8CUTNTqIPo4GamXhkA:r3d2d+CUkuGnK
TLSH
T1A5868B03F39680D9D04DE2B8D7579626FA35B8850324B6CF269413252F6BFE0EB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\MegaMaxion\locales\en-US.pak
Size 492KB
SHA256 cc7d18d3a6606b645ede826de9417c961d6ebb815f7250bad3a930da89dcd3a3
MD5 9b020e4af087feccbc7e243c4094f748
SHA1 36c9e0ec82a744ff991ad6e8ec13ae44d4a084b8
SHA512 3a0185e918b0877c1998ab253ce88587556dcd6fa2a689901dcf562eadae3e198be47a810e63caf5810878e084fc550bb8d5f1fafb5dfa11f94613e96ce2fd6e
SSDEEP 6144:+Z2t9t+G2qFmg4MP9eQQxt3faY7J3O4N5DBxaQngm8/PZwB:+AL/J4MbQxt3x51xAwB
TLSH
T1ABB44C1FF744126906A352A27F0995B2FF32D06CA35112563CBD812C33B7B6A83776E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources.pak
Size 5.7MB
SHA256 4567a0b1f53629f9c232224f1af8b5c71899e353319d25e2136af7a6c7a7fcc4
MD5 1e975d432130d00764e97cfbb009f8dc
SHA1 6991cdc848fa59fcaceae637b2158b2a0cdf1614
SHA512 781212312f34961e026077cb0e4771dd88dab7e4ea384dc10ee6b5e0a7377538ad399ba40f3aff574ce9b552503e92e84171ce59c64fdd3d0efa7c25be363d56
SSDEEP 98304:/DgxIA9pPOXD1VtGhHIvQN9HOMh/rwrTO/jV0nlkMt2OMLAqWpwUkz1VuO2:UWIpWXD1J89HD/krS/zMgOMJda
TLSH
T1F25633FE72252DBBF44D837A025985B2478E706C1386A67985AD7036AC7352DAFD003F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.asar

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar
Size 1.3MB
SHA256 48a787c1ace90a987b73e5057a704ee59b0a6ee6e8b9c9d2f4c613824a9f072f
MD5 f94fcdc93c766469ee692f342496c126
SHA1 b961988f61895e61f79a2c54197102874449341a
SHA512 a6784ba1a92d71d3c2d7523a0a96248950265d92e503cf1bee8fedd663cc08e3312eec822ee49deb90711eea92b247cb845d1e3b6c4d322d9a8aec33f4d6b9b3
SSDEEP 24576:kuDeb0+uRe4/mgx+Gh7kDmBBa3LDrp5pPI6FSFtb:k8D
TLSH
T19665221B1FF82BE156F8AB350AD16F62256A277300A827DD686EDE0C8155C4BF91331F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\dist\prod\main.js
Size 8.7MB
SHA256 431f3fb59346e766684ba334cd1b1e1dc3f0716dd88f147f120c2be0af29dfbd
MD5 8c58ac4d5de12d5c5c9ea7ed1216b3a0
SHA1 856c48bf33297818d10be93c489e2e42ec52a0ef
SHA512 ef06d4a52974ec0f64d69eaa480d55c3881d8db30b145b5724f52119c5c099ff0c2bfc95402167c6dc359d36bc47748c2ca6f00f752c7ff108de57f7449bc83e
SSDEEP 49152:C/+alYr7tmzJ/f3GsRYwNmGHfC2NWxb7ejSfthX3COdnycYA9ab+rcTeQG8goK/Z:cPf3Hvu
TLSH
T1EC964BABDE083C6EEF9D4073A0CF25DB421E03872D62548D9149F6CB0965D1E77D8A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DuckDBValue.js

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\@duckdb\node-api\lib\values\DuckDBValue.js
Size 77B
SHA256 d43aa81f5bc89faa359e0f97c814ba25155591ff078fbb9bfd40f8c7c9683230
MD5 8963201168a2449f79025884824955f2
SHA1 b66edae489b6e4147ce7e1ec65a107e297219771
SHA512 7f65c6403a23d93fb148e8259b012d6552ab3bff178f4a7d6a9d9cec0f60429fc1899e39b4bca8cc08afc75d9a7c7bfdb13fc372ca63c85eb22b0355eb4d6000
TLSH
T163A01201692185E003A000C84111E0C1A0C104320025286557EC4D65440084C5060201
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\@floating-ui\utils\LICENSE
Size 1KB
SHA256 0e4c9a9b6c71019cbbea3bdc20b01223110a9035700f9c960c8fcbf78c2325ce
MD5 e3617bf30cda34893f5e1ebb6eb3f7f1
SHA1 f001329cf565b3300b3547cc6f1a03c38eedfc74
SHA512 148d2aac390826d2ab3736c84c3997cc6cfcbfd17aa19f0c9f9787898c2b16849ca9975cb1f2da977da3f21b6f955780431effac217e745b0f654ebe47d4afc3
TLSH
T15C11862D725407661C9713A0552968C5F22AB29F7B6F1784146DF349132B05CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

debug-build.js

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\@sentry\node\cjs\debug-build.js
Size 528B
SHA256 20772d2a2f2ea4061b9377c31dfc790fa2ed31c1c40ceba42d153e590b2e66a3
MD5 ccc84aca482ac2304ca9d18ce69d384f
SHA1 97fecbc8943485b211f50e58c5fadaeecc86c25a
SHA512 9268b80c077b5e399b7d2bd54ef7d17fdcb4e7ab615d2de44e6dc0f3fc483fc5496f71cdfabd6087fd7ce8d86b466c4126aa7aa3740fe345893a7b9e3360a87f
TLSH
T11BF08B76E8B457FD4D7434FBA312F1D2A715CB3A7226E0A034282B681CC946B4123D66
MD5 SHA1 SHA512 TLSH

Submit Download

debug-build.js

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\@sentry\node\esm\debug-build.js
Size 453B
SHA256 bb860e39a46e6e788bb7f07b1e2947c0780f9d906f6c6b0ee0e876cee990cf7d
MD5 d2c04dac5bd76f9f6f97c2f9ab911d33
SHA1 e50a1b7ba3d6f3f79df77ed63eef71389abe1cec
SHA512 78dc62be46f56e4971f3dc77c4fec1bbf4fcc4594ef66c2eb2d2148a9712d56ddd3b25bfbb18c2aeadfb22eb8a5f750c566c619dbcc503d059dc7df8fb0e24db
TLSH
T1DCF0D436D4A453BD4C3434F76352F1D2A315CB397324D0903428272C1CD543B4237C56
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\@sentry\types\LICENSE
Size 1KB
SHA256 5923d68bab743f88511b2f1efe7087ac8d748f36e6d5aea8ab5265e8e6a6c7c7
MD5 a07d7ee90304bae402d6079a5fba9fbd
SHA1 899f05a865886e93c4db6898e989087061cb30cc
SHA512 a5f5cd90709a6bcb4f70df79b72089f0ed13dd041d34819384cc2c323ca862debf1589a6fd24d8a3852aef76117f6951f2f22c6dae73987e40911d55b6b90bf6
TLSH
T13321966E736457A61C5213B0647568C4B25BB11FBE6F2680145EF384232B07CE1FB800
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\dot-prop\license
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\find-up\license
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\localforage\LICENSE
Size 11KB
SHA256 8c3c0576866d6c22f56cbe65b8ef20e63c8aa75ec58f8cd139a242edb42bf8f1
MD5 51c1b48f066f0f3e8959f8e95a1e19a0
SHA1 8b3537a7473e734e29daaa0f422dfe59c95dbaee
SHA512 79dbe7e74169447613b3c0844a7ed1872807532eefceaf10eb286ff4d00d74bf6cd185cefb3daaa5b667c2a4553bacd9a9458ee3fcc9c283b590655149a6a3b7
SSDEEP 192:fU6G5KXSD9VYUKhu1JVF9hFGvV/QiGkS594drFjuHYx5dvTrLh3kTSE+7HbHR:M9vlKM1zJlFvmNz5VrlkTSJ7Ht
TLSH
T19B32623FBA48037706C20162BB9764CBF21E903F3B552568354CC1681F6BA6543FB6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luxon.js.map

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\luxon\build\node\luxon.js.map
Size 483KB
SHA256 15e65e3f28e9a64d940c8ff14fda20772df28061f9299b44106f12b2fa8d8282
MD5 bc01ef48e3bbf8b0b6a919b1a260da85
SHA1 48cdec9389a46f52d02e77acb2a6c3ab35fd2f27
SHA512 a0788e34e7414c8871a6a4158639433ee9142d2ccc6255824a4db9995b5870b9f3285feecf8efb3011d3269b5c12a5be0aa77107ef521b5b7c778b664cfe4c59
SSDEEP 12288:wZNJbvcpnHUHTbaiUb/206KBPt3l3x0rcOUbd9up+37tZPF+7Bv2dKPG9evc07V9:fbHh8
TLSH
T134B43F7211A7D937772B07E7198E0156BE24745EAD998A04388E9390F383F39F4F39A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\minimatch\dist\commonjs\package.json
Size 25B
SHA256 8005a3491db7d92f36ac66369861589f9c47123d3a7c71e643fc2c06168cd45a
MD5 df9ffc6aa3f78a5491736d441c4258a8
SHA1 9d0d83ae5d399d96b36d228e614a575fc209d488
SHA512 6c58939da58f9b716293a8328f7a3649b6e242bf235fae00055a0cc79fb2788e4a99dfaa422e0cfadbe84e0d5e33b836f68627e6a409654877edc443b94d04c4
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\MegaMaxion\resources\app.asar.unpacked\node_modules\minimatch\dist\esm\package.json
Size 23B
SHA256 3ca9d4afd21425087cf31893b8f9f63c81b0b8408db5e343ca76e5f8aa26ab9a
MD5 d0707362e90f00edd12435e9d3b9d71c
SHA1 50faeb965b15dfc6854cb1235b06dbb5e79148d2
SHA512 9d323420cc63c6bee79dcc5db5f0f18f6b8e073daaf8ffa5459e11f2de59a9f5e8c178d77fa92afc9ddd352623dec362c62fff859c71a2fab93f1e2172c4987f
MD5 SHA1 SHA512

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\MegaMaxion\v8_context_snapshot.bin
Size 685KB
SHA256 462919f1b49c9e913042f9e9a738e9510884d5920a426a8a5f1b188e28c4da91
MD5 d4b195232a23682da49bb49b43dac7a9
SHA1 24671a21f74cc904f0d5cc48816f6aa95c3e3f72
SHA512 ca5f7b4e72313b365362d0ea4cb07eabc3cb08ce2a54afe4c53803f12a87909c827cd1a4c1724841468bf5647e4bdc61936a7bd5fdf2feaada1c694cfc3e4526
SSDEEP 6144:ri2g51RJBR+t+8mfdz4l3znkF52BhbV/n8Xn4xFoR:rr8ZYDkF5yn24/A
TLSH
T182E4A1D6F30DDB27C3CC59B6DDF9EA453CB5B08EAF4B821B3119077E60356680969288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader.dll

Path C:\Users\Admin\AppData\Local\MegaMaxion\vk_swiftshader.dll
Size 5.3MB
SHA256 19208515a2fbd14d4797e8cb69b2ed08e6ec0e04755dbb6837027e74467ef13d
MD5 987fe91cbd9a40b4879397f1cc483341
SHA1 44a921e162ac54f8b193d56d64339a4864626d0e
SHA512 c7e93c13cb9bd447d5c77b9ff007c35ba83e195350c50a8af37b4206f5b8e8b79ab2df293006bc0dbd64398b40f8d0faa61f6f827e9d9bc1bd66fc63e8f4c08a
SSDEEP 49152:eF5hWGPiCQzIcchAdQkYlmOwqC+tCjyqNFC0cLCqof1Ydlkr44rxCQrKedIKNrep:eDPiOmXe6A37X
TLSH
T117463903F28580A9F05DD579875FA622F272B8811B72B6DF52A01F192E77FE06B39701
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vk_swiftshader_icd.json

Path C:\Users\Admin\AppData\Local\MegaMaxion\vk_swiftshader_icd.json
Size 106B
SHA256 32d83ff113fef532a9f97e0d2831f8656628ab1c99e9060f0332b1532839afd9
MD5 8642dd3a87e2de6e991fae08458e302b
SHA1 9c06735c31cec00600fd763a92f8112d085bd12a
SHA512 f5d37d1b45b006161e4cefeebba1e33af879a3a51d16ee3ff8c3968c0c36bbafae379bf9124c13310b77774c9cbb4fa53114e83f5b48b5314132736e5bb4496f
TLSH
T1A6B01211430088B36062AF3C41811F468765411C36020D491040540E83BBDB6A102394
MD5 SHA1 SHA512 TLSH

Submit Download

vulkan-1.dll

Path C:\Users\Admin\AppData\Local\MegaMaxion\vulkan-1.dll
Size 882KB
SHA256 9e57b55f6e1534aa6e074711b09a936ec2d2c48d5d1e2b312ac7e1c1295af7c0
MD5 3868c5c237a671c6970813abc4bcf65d
SHA1 7d43faeb10a25b8c36f9eb13ae82f4ed880af4f3
SHA512 50cda5819e260d6032f77d6ed1a570ed532fa065b167a4f87803abafc4ac9d0f05744cef7170b7f270293085f6a598975cdefad8c6fbf8a1b9605cfa19316b15
SSDEEP 24576:tC4y/8rdHb6QJto6DgcEB6Z5W5DYsHY6g3P0zAk7YR:M4jd76QJto6ccEB6Z5W5DYsHY6g3P0zy
TLSH
T13D155C23D6548A69D47A8034C9C24A03C9F174925326B9CF02A85718BF6FFF87B7DB25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

id.txt

Path C:\Users\Admin\AppData\Roaming\id.txt
Size 8B
SHA256 a1a6efa4766dcbf4e5c4d6195dde6dfb9230d085bd5d09926538a5ae83c73ebf
MD5 2f91d2f17fd954e7c124923153ce27ec
SHA1 64b3453201062a8dfcde543eb84639b6ea0a8b83
SHA512 b9d78c172750cb22c99e864bcb51ecff30dbcf1e501d5cee153348d72a89439163b2d698af7752282c74fddc4067080dbcc1d9e1a1aee90382e6884360e49699
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\superintendent\Local State
Size 434B
SHA256 62e67221e50a645c92ec1cc5425ddcf288f03a48b86fc2a76d5de6db43b88bda
MD5 e54d83445ebe0a72c43666536486dcfb
SHA1 cf5220aabc787f33f9f8ac588cde452ceb52eaec
SHA512 dc5f711a50ecc55a0bf31edf8dd71eeecaf207820a76df5f711715fd225623c2dd68193f736cfda5d64c3813633348195e62bdd35912811f7d69d1e7d3dfc7f1
TLSH
T117E023729830DE512B12878A702D23E10C21050F8980163D9B89122383954A5C604C21
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\superintendent\Local State
Size 434B
SHA256 a8fe40bb68ba47cd9a2cffafb4d7826961ddac0f20c087075406d102c36e7663
MD5 7ef118bace4083a343fac44b89f6b385
SHA1 0c036b52a2a00d73ffbf629b524c81a4df9c085d
SHA512 664a1947ae26766d6c41bd6cc5c9f8dfda51c7219bd753a2e02fbac80283eb4d92f6bf85419834f92cfbab5babc292e05da54fd4a41078b8f8faa207af97a75a
TLSH
T1F0E0ABB6A4A0B942B76A2C5489AB3E122D2AA6A781125E5076BCC7094355862472FA3C
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 3fb246d0fcbbdb798e60e0f0c410e52608ffe68bb6feacef1635f06ce675de96
MD5 fff9dc0a1117954bfecb90975397edd6
SHA1 606fa10a912cd055f2aa671921b44d8d6b997db4
SHA512 c48c6950363cefebd0b0ff404c593520eb841da54d254261e413771cfaf09ea1b279b50f217d3844fd60ad0bb504b02c422cd1dde07b1b43bb7ae9424e1ef57c
SSDEEP 24576:m2gmSp1ldoO/vvTLx26+xEHqfqJRg4OQW25dXpkajB6IkG+/4hrtb3w9h:6
TLSH
T19947C32436F92110E7F79E3C68F0AA234D3A7D5B9C1A9E8D05451F4E0961FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{09a97052-a7f7-4d28-9746-1aef85260b0d}_OnDiskSnapshotProp

Path \??\Volume{b9c79ca0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{09a97052-a7f7-4d28-9746-1aef85260b0d}_OnDiskSnapshotProp
Size 6KB
SHA256 1d1bbc17bfb6d4aeb8da389f02559de9460731bd009923f4674b58f501f03675
MD5 7a66f3cb19cc16d0fd20579e18b0e757
SHA1 cb0060e7289557100b612e1f3c3ea1e3ab58ad10
SHA512 290676d4b6306b5a28b3b664e7a36819db67133d8f6ccfeb86b5df734c5ea2063f3b3f4ab3f242d0f9738ccb496c75b6e67cb43e6796c055339d535192863787
SSDEEP 96:F/LS74ltvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:ZLllnb++ZVm
TLSH
T15ED178185AF54711E2B3AB7228F18557A877B911EF33CB8E0198638E2670910F876F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download