Analysis
- user interaction
yes - max time kernel
298s - max time network
222s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
EasySuiteSetup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
EasySuiteSetup.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
300 seconds
Behavioral task
behavioral3
Sample
EasySuiteSetup.msi
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral4
Sample
EasySuiteSetup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
300 seconds
General
- Target EasySuiteSetup.msi
- Size 71.6MB
- Sample260802-renf5sbb42
- SHA256 45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5
- MD5 50b0b7d854f14594d419cce69a66b517
- SHA1 9c7705850f70aa3af850dba47ea5a78de3077f57
- SHA512 fd611022d53e630487670bd0e1923c7d301ec63a8c3dbea2b7b97ba19dc23c982372f2bc4943804fdf00bde74c416d0a2a2409d3f10af661f38750092adb6806
- SSDEEP 1572864:pSZm7O3jPaLd4bN4LZAw5GGxITqLAVrPtDJw+CTRbdO8iUBYNzSbBC4P0:A6Cj6d4bNIZAwcGxiqLMtDK+gdO8hBSb
- TLSH T1AFF7339BB4046C63C6DD043E953F6B3AF6610EF3760005626463BE9EDD7124A4B9D3AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
pid Process 2908 Boost Note.exe 4704 Boost Note.exe 1092 Boost Note.exe 1468 Boost Note.exe 3456 Boost Note.exe 4524 Boost Note.exe 1348 Boost Note.exe 1732 Boost Note.exe - Loads dropped DLL 14 IoCs
pid Process 2908 Boost Note.exe 4704 Boost Note.exe 4704 Boost Note.exe 4704 Boost Note.exe 4704 Boost Note.exe 1092 Boost Note.exe 1468 Boost Note.exe 3456 Boost Note.exe 3456 Boost Note.exe 3456 Boost Note.exe 3456 Boost Note.exe 4524 Boost Note.exe 1348 Boost Note.exe 1732 Boost Note.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe" Boost Note.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe" Boost Note.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\H: msiexec.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\Installer\e588fe7.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{FFB98429-A8F9-4371-A79E-522A72B1D19A} msiexec.exe File opened for modification C:\Windows\Installer\MSI94E8.tmp msiexec.exe File created C:\Windows\Installer\e588fe9.msi msiexec.exe File opened for modification C:\Windows\Installer\e588fe7.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3596 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000aea20acdcfb7d9ac0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000aea20acd0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900aea20acd000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aaea20acd000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1daea20acd000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 3488 msiexec.exe 3488 msiexec.exe 1092 Boost Note.exe 1092 Boost Note.exe 4524 Boost Note.exe 4524 Boost Note.exe 1348 Boost Note.exe 1348 Boost Note.exe 1348 Boost Note.exe 1348 Boost Note.exe 1732 Boost Note.exe 1732 Boost Note.exe 1732 Boost Note.exe 1732 Boost Note.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3596 msiexec.exe Token: SeIncreaseQuotaPrivilege 3596 msiexec.exe Token: SeSecurityPrivilege 3488 msiexec.exe Token: SeCreateTokenPrivilege 3596 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3596 msiexec.exe Token: SeLockMemoryPrivilege 3596 msiexec.exe Token: SeIncreaseQuotaPrivilege 3596 msiexec.exe Token: SeMachineAccountPrivilege 3596 msiexec.exe Token: SeTcbPrivilege 3596 msiexec.exe Token: SeSecurityPrivilege 3596 msiexec.exe Token: SeTakeOwnershipPrivilege 3596 msiexec.exe Token: SeLoadDriverPrivilege 3596 msiexec.exe Token: SeSystemProfilePrivilege 3596 msiexec.exe Token: SeSystemtimePrivilege 3596 msiexec.exe Token: SeProfSingleProcessPrivilege 3596 msiexec.exe Token: SeIncBasePriorityPrivilege 3596 msiexec.exe Token: SeCreatePagefilePrivilege 3596 msiexec.exe Token: SeCreatePermanentPrivilege 3596 msiexec.exe Token: SeBackupPrivilege 3596 msiexec.exe Token: SeRestorePrivilege 3596 msiexec.exe Token: SeShutdownPrivilege 3596 msiexec.exe Token: SeDebugPrivilege 3596 msiexec.exe Token: SeAuditPrivilege 3596 msiexec.exe Token: SeSystemEnvironmentPrivilege 3596 msiexec.exe Token: SeChangeNotifyPrivilege 3596 msiexec.exe Token: SeRemoteShutdownPrivilege 3596 msiexec.exe Token: SeUndockPrivilege 3596 msiexec.exe Token: SeSyncAgentPrivilege 3596 msiexec.exe Token: SeEnableDelegationPrivilege 3596 msiexec.exe Token: SeManageVolumePrivilege 3596 msiexec.exe Token: SeImpersonatePrivilege 3596 msiexec.exe Token: SeCreateGlobalPrivilege 3596 msiexec.exe Token: SeBackupPrivilege 2452 vssvc.exe Token: SeRestorePrivilege 2452 vssvc.exe Token: SeAuditPrivilege 2452 vssvc.exe Token: SeBackupPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe Token: SeTakeOwnershipPrivilege 3488 msiexec.exe Token: SeRestorePrivilege 3488 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3596 msiexec.exe 3596 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 3488 wrote to memory of 3604 3488 msiexec.exe 90 PID 3488 wrote to memory of 2908 3488 msiexec.exe 94 PID 2908 wrote to memory of 4704 2908 Boost Note.exe 95 PID 2908 wrote to memory of 1092 2908 Boost Note.exe 96 PID 1468 wrote to memory of 3456 1468 Boost Note.exe 100 PID 1468 wrote to memory of 4524 1468 Boost Note.exe 101 PID 2908 wrote to memory of 1348 2908 Boost Note.exe 109 PID 1468 wrote to memory of 1732 1468 Boost Note.exe 110 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EasySuiteSetup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3596
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:3604
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2908 -
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1744,2479442196389759174,10060071887766531489,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1748 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4704
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1744,2479442196389759174,10060071887766531489,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2072 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1092
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1744,2479442196389759174,10060071887766531489,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2132 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1348
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1748,6075913265688437747,2305803081711216182,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1792 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3456
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1748,6075913265688437747,2305803081711216182,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1928 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4524
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1748,6075913265688437747,2305803081711216182,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1052 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1732
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e588fe8.rbs
- Size 144KB
- SHA256 df46b70eb48a9baffe1d30a793483bb0cd7da4a6111783215b15c98b82af4c3d
- MD5 86a99bc8e0259468fcaf090c50bdf7ae
- SHA1 00e14fedd0ffd3c6da6d479cd8b0f5c91b796538
- SHA512 d70fa952941bce980e2fdb7e0d63600321b2280484d2ce38fdb72ff553c6235c42fa01a665c380238a24c5d3a73e500a51dbd329f968234838e35ba36c983c2f
- SSDEEP 1536:Kh7vGI7BNvGVKytG7cWyxFh8SEid7KT46l6:k5UG7wf/
- TLSH T138E3F0B752F5B7778D28457B72E3F43C85A40DAACA1D2B091138443F25D26EB7EC6A08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_100_percent.pak
- Size 123KB
- SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
- MD5 a59ea69d64bf4f748401dc5a46a65854
- SHA1 111c4cc792991faf947a33386a5862e3205b0cff
- SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
- SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
- TLSH T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_200_percent.pak
- Size 183KB
- SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
- MD5 1985b8fc603db4d83df72cfaeeac7c50
- SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
- SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
- SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
- TLSH T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\d3dcompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\ffmpeg.dll
- Size 2.7MB
- SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
- MD5 b34d74a152e1788532b0acfa8cfbdf1e
- SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
- SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
- SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
- TLSH T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\icudtl.dat
- Size 9.9MB
- SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
- MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
- SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
- SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
- SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
- TLSH T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\locales\en-US.pak
- Size 85KB
- SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
- MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
- SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
- SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
- SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
- TLSH T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources.pak
- Size 4.9MB
- SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
- MD5 5507bc28022b806ea7a3c3bc65a1c256
- SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
- SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
- SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
- TLSH T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\index.js
- Size 240KB
- SHA256 176f28d4929e80b0039851d31297cc3db98cfc2813216ecda880d7dc63668618
- MD5 54e9cc07b1bf0158f749a741a23921fa
- SHA1 d811807a19ae6d733b9cd902e700f7d836862b77
- SHA512 26204d6fe601cf916d30cf3f984a8ab272a422f3b5bc99c65fee7bc56a8302e0e45a98dcfa9165ef19286c3ea8cd89a377b250726dea3ab2e56b430b13f325d9
- SSDEEP 3072:/hprLsKuviSpbMECceMtJmCC4j9X1aQllVO1V:/hprLs7viShChMtVC4j9FU7
- TLSH T1303495843BCAA0D2421935F1063F3615B56E4D627A0CCA88D7FAB49EFDB930594B7E34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\file-type\license
- Size 1KB
- SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
- MD5 d5f2a6dd0192dcc7c833e50bb9017337
- SHA1 80674912e3033be358331910ba27d5812369c2fc
- SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
- TLSH T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\normalize-url\license
- Size 1KB
- SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- MD5 915042b5df33c31a6db2b37eadaa00e3
- SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
- TLSH T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\package.json
- Size 326B
- SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
- MD5 48f234e36eba960bf0f66519a219e17e
- SHA1 988d574c95e613f177e81417c590540f77ed9845
- SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
- TLSH T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libEGL.dll
- Size 458KB
- SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
- MD5 21a07ee229edc5d8de61de97f1a65210
- SHA1 a60f93adbad349e25cca0eca5a81c78fbf24f133
- SHA512 6375d8bda8cc187f79f6ea0cfd8358ac0d85508327f44d0bbcca641a934fa2b690933eb1ab588821a2f63f6615b1926aa433bc759b787015170aff11e633d0e4
- SSDEEP 6144:e6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:ePZ4IM4u7BmXZXGuTcAD
- TLSH T13CA47C16B7A504A9D036C4348A574A43DA71B8DA0F74EBEF0294A27D2F7B7E05F39324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libglesv2.dll
- Size 3.1MB
- SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
- MD5 07a0f70d8e06fcb7e9063f39c0ab8c68
- SHA1 896f3401b019c31ab1de2a376a66829daceccadb
- SHA512 f58e4b23eca4aa4eef435288fc4d3740ea700debe82e083167a68df709c383f8bb7393ee74558acae8804ed105536ac86c5657912a98d284a1fc57dcf25586ff
- SSDEEP 49152:cgnhCIFndJN3alVO7hUADGoJJ5AtyPzaaujA84dvCilHS4E0JhHHRBHpJbftopLw:TYIFnXoLfauC1DeFR
- TLSH T1EFE55A43E08880D9E05DD5BC874BA62EE132BC856B7272DF12946B222E77BF0573DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\v8_context_snapshot.bin
- Size 160KB
- SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
- MD5 b64c1fc7d75234994012c86dc5af10a6
- SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
- SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
- SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
- TLSH T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\daemon.log
- Size 8B
- SHA256 ab65b21fd00a15b6ea183217277caecdf306ed6fc5199027de057aa870f2ece0
- MD5 2338cc250d30e5df925ab44274c9c86e
- SHA1 2cc8c6f472ff94ed54f05064eab75b838a32313b
- SHA512 cdc17f9286169b58d0f13be18513d5fe7c8a85b3bc482ece519688e825d4dc8b15eda80d88169e5b512d1951d2c825fc4d3a1bf7f49851566cc5b519bae4f6ba
- MD5 SHA1 SHA512
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 3c39f8437d733a1c8772f2b0c43df04698577da4c2b1864373185f49fb6c20f1
- MD5 1572bd89fc4090cef66d217817f43d48
- SHA1 da4122b8f5f5b67afe66f3ec461ad242b88d37cf
- SHA512 36f17b10f86d75d7f6b0357ce93d52a4cddb5e377482d43a137e3a8e55feb4ac405a94d35cd5263f0022563ecab629827df6bb72a1937fcbf22e7361821818ba
- SSDEEP 24576:uu8m+1z7doO/vvTLLWceJma49F0zEVsCwqmteTtlUU6tOrFhov1Fk63Rp:u
- TLSH T16D47C22836F92200F7F79E3D68F46A274D3A7D5B9C159E8D05811B4E0921FB0E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{cd0aa2ae-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{67a5b9ab-da13-4b48-8945-3735d6e37141}_OnDiskSnapshotProp
- Size 6KB
- SHA256 de18edfb85d849a139f43d8ca8d95e4b86c16d06ab8082c5c0a9e7302e42e0d7
- MD5 6dfbee96f61d3308661b7d5dd908dece
- SHA1 614fe1bcbc3fb84a35ee91bf8cf23b0a5d502d37
- SHA512 fbd4d3d8a6f293fd6837b31ceaa184ecd69163f5edfcbe8849f0fa4501da2affb0e2b1277000330a8b7febee481759dd4a3aa26c4b22ec2488efba866f9e7165
- SSDEEP 96:FK2DOcrsnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:9Dib++ZVmN
- TLSH T146D18A085AF54711E2B3AB3229F58557A877B911EF33CB8E0198238E6670A10F935F5B
- MD5 SHA1 SHA512 SSDEEP TLSH