Analysis
- max time kernel
298s - max time network
227s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 14:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
EasySuiteSetup.msi
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
300 seconds
Behavioral task
behavioral2
Sample
EasySuiteSetup.msi
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
12 signatures
300 seconds
Behavioral task
behavioral3
Sample
EasySuiteSetup.msi
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
300 seconds
Behavioral task
behavioral4
Sample
EasySuiteSetup.msi
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
13 signatures
300 seconds
General
- Target EasySuiteSetup.msi
- Size 71.6MB
- Sample260802-renf5sbb42
- SHA256 45e71fb42e9fc51f5d8f6f6b2d5daf24f3b7f3e8850e6de1235dc78c60d7a8f5
- MD5 50b0b7d854f14594d419cce69a66b517
- SHA1 9c7705850f70aa3af850dba47ea5a78de3077f57
- SHA512 fd611022d53e630487670bd0e1923c7d301ec63a8c3dbea2b7b97ba19dc23c982372f2bc4943804fdf00bde74c416d0a2a2409d3f10af661f38750092adb6806
- SSDEEP 1572864:pSZm7O3jPaLd4bN4LZAw5GGxITqLAVrPtDJw+CTRbdO8iUBYNzSbBC4P0:A6Cj6d4bNIZAwcGxiqLMtDK+gdO8hBSb
- TLSH T1AFF7339BB4046C63C6DD043E953F6B3AF6610EF3760005626463BE9EDD7124A4B9D3AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 8 IoCs
pid Process 3448 Boost Note.exe 3128 Boost Note.exe 948 Boost Note.exe 6108 Boost Note.exe 2828 Boost Note.exe 3292 Boost Note.exe 2240 Boost Note.exe 3736 Boost Note.exe - Loads dropped DLL 14 IoCs
pid Process 3448 Boost Note.exe 3128 Boost Note.exe 3128 Boost Note.exe 3128 Boost Note.exe 3128 Boost Note.exe 948 Boost Note.exe 6108 Boost Note.exe 2828 Boost Note.exe 2828 Boost Note.exe 2828 Boost Note.exe 2828 Boost Note.exe 3292 Boost Note.exe 2240 Boost Note.exe 3736 Boost Note.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe" Boost Note.exe Set value (str) \REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\MegaSuitelyTechMaxx\\Boost Note.exe" Boost Note.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe - Drops file in Windows directory 12 IoCs
description ioc Process File created C:\Windows\SystemTemp\~DF01C3E92A38744D57.TMP msiexec.exe File opened for modification C:\Windows\Installer\e599e4a.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF881A56C8F2D5F20F.TMP msiexec.exe File created C:\Windows\Installer\e599e4a.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\SourceHash{FFB98429-A8F9-4371-A79E-522A72B1D19A} msiexec.exe File created C:\Windows\SystemTemp\~DF29D9E250005AD74E.TMP msiexec.exe File opened for modification C:\Windows\Installer\MSIAFBE.tmp msiexec.exe File created C:\Windows\Installer\e599e4c.msi msiexec.exe File created C:\Windows\SystemTemp\~DF4BFF62822FC27DE7.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 4612 msiexec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000067831fc6f5c7bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380167831fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410167831fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e367831fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e667831fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4936 msiexec.exe 4936 msiexec.exe 948 Boost Note.exe 948 Boost Note.exe 3292 Boost Note.exe 3292 Boost Note.exe 2240 Boost Note.exe 2240 Boost Note.exe 2240 Boost Note.exe 2240 Boost Note.exe 3736 Boost Note.exe 3736 Boost Note.exe 3736 Boost Note.exe 3736 Boost Note.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4612 msiexec.exe Token: SeIncreaseQuotaPrivilege 4612 msiexec.exe Token: SeSecurityPrivilege 4936 msiexec.exe Token: SeCreateTokenPrivilege 4612 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 4612 msiexec.exe Token: SeLockMemoryPrivilege 4612 msiexec.exe Token: SeIncreaseQuotaPrivilege 4612 msiexec.exe Token: SeMachineAccountPrivilege 4612 msiexec.exe Token: SeTcbPrivilege 4612 msiexec.exe Token: SeSecurityPrivilege 4612 msiexec.exe Token: SeTakeOwnershipPrivilege 4612 msiexec.exe Token: SeLoadDriverPrivilege 4612 msiexec.exe Token: SeSystemProfilePrivilege 4612 msiexec.exe Token: SeSystemtimePrivilege 4612 msiexec.exe Token: SeProfSingleProcessPrivilege 4612 msiexec.exe Token: SeIncBasePriorityPrivilege 4612 msiexec.exe Token: SeCreatePagefilePrivilege 4612 msiexec.exe Token: SeCreatePermanentPrivilege 4612 msiexec.exe Token: SeBackupPrivilege 4612 msiexec.exe Token: SeRestorePrivilege 4612 msiexec.exe Token: SeShutdownPrivilege 4612 msiexec.exe Token: SeDebugPrivilege 4612 msiexec.exe Token: SeAuditPrivilege 4612 msiexec.exe Token: SeSystemEnvironmentPrivilege 4612 msiexec.exe Token: SeChangeNotifyPrivilege 4612 msiexec.exe Token: SeRemoteShutdownPrivilege 4612 msiexec.exe Token: SeUndockPrivilege 4612 msiexec.exe Token: SeSyncAgentPrivilege 4612 msiexec.exe Token: SeEnableDelegationPrivilege 4612 msiexec.exe Token: SeManageVolumePrivilege 4612 msiexec.exe Token: SeImpersonatePrivilege 4612 msiexec.exe Token: SeCreateGlobalPrivilege 4612 msiexec.exe Token: SeBackupPrivilege 6068 vssvc.exe Token: SeRestorePrivilege 6068 vssvc.exe Token: SeAuditPrivilege 6068 vssvc.exe Token: SeBackupPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeBackupPrivilege 1424 srtasks.exe Token: SeRestorePrivilege 1424 srtasks.exe Token: SeSecurityPrivilege 1424 srtasks.exe Token: SeTakeOwnershipPrivilege 1424 srtasks.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeBackupPrivilege 1424 srtasks.exe Token: SeRestorePrivilege 1424 srtasks.exe Token: SeSecurityPrivilege 1424 srtasks.exe Token: SeTakeOwnershipPrivilege 1424 srtasks.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe Token: SeTakeOwnershipPrivilege 4936 msiexec.exe Token: SeRestorePrivilege 4936 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 4612 msiexec.exe 4612 msiexec.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4612 msiexec.exe 4936 msiexec.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4936 wrote to memory of 1424 4936 msiexec.exe 94 PID 4936 wrote to memory of 3448 4936 msiexec.exe 97 PID 3448 wrote to memory of 3128 3448 Boost Note.exe 98 PID 3448 wrote to memory of 948 3448 Boost Note.exe 99 PID 6108 wrote to memory of 2828 6108 Boost Note.exe 103 PID 6108 wrote to memory of 3292 6108 Boost Note.exe 104 PID 3448 wrote to memory of 2240 3448 Boost Note.exe 106 PID 6108 wrote to memory of 3736 6108 Boost Note.exe 107 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\EasySuiteSetup.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4612
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1564,1882443410627722181,8062269569706399571,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1572 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3128
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1564,1882443410627722181,8062269569706399571,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1932 /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:948
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1564,1882443410627722181,8062269569706399571,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2240
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6068
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6108 -
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1604,12269880167813029448,355910077536289225,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1612 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2828
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1604,12269880167813029448,355910077536289225,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1960 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
-
C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe"C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\Boost Note.exe" --type=gpu-process --field-trial-handle=1604,12269880167813029448,355910077536289225,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1520 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Installer Packages
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e599e4b.rbs
- Size 144KB
- SHA256 f5f686feb0497d938f70e4ab727c5760064703b129efae5078136d50defddf56
- MD5 039708d863a3ff2ae63d619430f472e1
- SHA1 6b8e69b7c63c7dea0dec125b48e9e24a2469f237
- SHA512 973205a6c12b2078565c89f7e70a6fcb045a0c51628b6494e5678baee8782aa6758a11f4b6f853cf21470bdc13923316067439cb0bdc68db518296dd573d6a5b
- SSDEEP 1536:Ui7vGI7BNvGVKytG7cWsxFh8SEid7qT46lI:T5UG7e7p
- TLSH T1CFE3F0B752F5B7778E24457B72E3F43C85A40DAACA1D2B091138443F25D26EB7EC6A08
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\D3DCompiler_47.dll
- Size 4.3MB
- SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
- MD5 7641e39b7da4077084d2afe7c31032e0
- SHA1 2256644f69435ff2fee76deb04d918083960d1eb
- SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
- SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
- TLSH T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_100_percent.pak
- Size 123KB
- SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
- MD5 a59ea69d64bf4f748401dc5a46a65854
- SHA1 111c4cc792991faf947a33386a5862e3205b0cff
- SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
- SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
- TLSH T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\chrome_200_percent.pak
- Size 183KB
- SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
- MD5 1985b8fc603db4d83df72cfaeeac7c50
- SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
- SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
- SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
- TLSH T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\ffmpeg.dll
- Size 2.7MB
- SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
- MD5 b34d74a152e1788532b0acfa8cfbdf1e
- SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
- SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
- SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
- TLSH T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\icudtl.dat
- Size 9.9MB
- SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
- MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
- SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
- SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
- SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
- TLSH T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\locales\en-US.pak
- Size 85KB
- SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
- MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
- SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
- SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
- SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
- TLSH T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources.pak
- Size 4.9MB
- SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
- MD5 5507bc28022b806ea7a3c3bc65a1c256
- SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
- SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
- SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
- TLSH T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\index.js
- Size 240KB
- SHA256 176f28d4929e80b0039851d31297cc3db98cfc2813216ecda880d7dc63668618
- MD5 54e9cc07b1bf0158f749a741a23921fa
- SHA1 d811807a19ae6d733b9cd902e700f7d836862b77
- SHA512 26204d6fe601cf916d30cf3f984a8ab272a422f3b5bc99c65fee7bc56a8302e0e45a98dcfa9165ef19286c3ea8cd89a377b250726dea3ab2e56b430b13f325d9
- SSDEEP 3072:/hprLsKuviSpbMECceMtJmCC4j9X1aQllVO1V:/hprLs7viShChMtVC4j9FU7
- TLSH T1303495843BCAA0D2421935F1063F3615B56E4D627A0CCA88D7FAB49EFDB930594B7E34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\file-type\license
- Size 1KB
- SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
- MD5 d5f2a6dd0192dcc7c833e50bb9017337
- SHA1 80674912e3033be358331910ba27d5812369c2fc
- SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
- TLSH T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\node_modules\normalize-url\license
- Size 1KB
- SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
- MD5 915042b5df33c31a6db2b37eadaa00e3
- SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
- SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
- TLSH T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\resources\app\package.json
- Size 326B
- SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
- MD5 48f234e36eba960bf0f66519a219e17e
- SHA1 988d574c95e613f177e81417c590540f77ed9845
- SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
- TLSH T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libegl.dll
- Size 458KB
- SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
- MD5 21a07ee229edc5d8de61de97f1a65210
- SHA1 a60f93adbad349e25cca0eca5a81c78fbf24f133
- SHA512 6375d8bda8cc187f79f6ea0cfd8358ac0d85508327f44d0bbcca641a934fa2b690933eb1ab588821a2f63f6615b1926aa433bc759b787015170aff11e633d0e4
- SSDEEP 6144:e6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:ePZ4IM4u7BmXZXGuTcAD
- TLSH T13CA47C16B7A504A9D036C4348A574A43DA71B8DA0F74EBEF0294A27D2F7B7E05F39324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\swiftshader\libglesv2.dll
- Size 3.1MB
- SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
- MD5 07a0f70d8e06fcb7e9063f39c0ab8c68
- SHA1 896f3401b019c31ab1de2a376a66829daceccadb
- SHA512 f58e4b23eca4aa4eef435288fc4d3740ea700debe82e083167a68df709c383f8bb7393ee74558acae8804ed105536ac86c5657912a98d284a1fc57dcf25586ff
- SSDEEP 49152:cgnhCIFndJN3alVO7hUADGoJJ5AtyPzaaujA84dvCilHS4E0JhHHRBHpJbftopLw:TYIFnXoLfauC1DeFR
- TLSH T1EFE55A43E08880D9E05DD5BC874BA62EE132BC856B7272DF12946B222E77BF0573DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\MegaSuitelyTechMaxx\v8_context_snapshot.bin
- Size 160KB
- SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
- MD5 b64c1fc7d75234994012c86dc5af10a6
- SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
- SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
- SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
- TLSH T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\daemon.log
- Size 8B
- SHA256 5f87885d944a0eca3e79dc0a0e77e0a60bc28305e7098b80ad2873f6d08ae803
- MD5 e9ffc3d5740fb0de979e5bdbb7a47188
- SHA1 c85e4ba6b1192de20583043cf3a81c0bfeb89456
- SHA512 551988506bb8cf58d80b24094235824b5e89f86c8f11b428ab63a8fed3fc4ec580303594c936d08a4242217596d8e5d0cc21a1579a7f741c3d5f6718083c0cab
- MD5 SHA1 SHA512
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 15c4360b8be0365e8c9e858427c141c32774ed919ebe1bdf1d70e3397be03aa9
- MD5 4a458d707c1525c39e3804965c2c5a30
- SHA1 00f3468ef71ce202ef6f9eb0398df0b686007837
- SHA512 9dc6fd98f7298d2d02e41e58fbe9308d6496733687255ee1a93ace153cf7ee2cc82debcca7cb548636dd0fdc126115f1d58a959aa4799fb8bb09826f7009ceb7
- SSDEEP 24576:WFo3DMPsdoO/vvTL/SwyiCFAvre45LFB0vkwN/8qUn8aZ1jS8Ih2ibYDGu0:nHA
- TLSH T1CA57B42436F92100EBF7AE3CA8F06A274D397D57AC16DE8D45511B4D0822F71E872F6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f381e6e4-9323-417f-a9e5-44f19313cd73}_OnDiskSnapshotProp
- Size 6KB
- SHA256 95b2fdf70b3d6725d1cb3689daa28d475bada8925625603058785a93803665cd
- MD5 26bbbe0c150660849da02d3acf519619
- SHA1 f8045d4cdc00e9bb2fdc20e53e5d87bd1044b0d7
- SHA512 2422a2dc1821257f3570114d97cec85cacf5796d203f62bc1763f71a48db676c17fba169e34bc7221585ac7c9843885a62a264838a3da844e9640c867079099e
- SSDEEP 96:FIn9llPvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:0rb++uVmN
- TLSH T14AD189185AF54711E2B3AB7129F18557A477B811FF33CB8E0194238E6631910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH