57dac1b0fa9e682d746a942301e285c8cf030e42a00ec79aac16400eb65bce64

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OficioPCPE.pdf.exe
Size 62.9MB
Sample260629-stem8agw7t
SHA256 57dac1b0fa9e682d746a942301e285c8cf030e42a00ec79aac16400eb65bce64
MD5 d074703783405f7bd72384fb15e39c03
SHA1 75a0afd8a5199de7bb87b7e3407206042321e0f4
SHA512 c001e18c7323057047d6df73ea1fb8dde83cbfa34190338613b0def054bc794206e2e143e2fbda58ec2e62eb7b0b59d85963d6d6f92e7592dfd3551ee0c085ea
SSDEEP 1572864:zAb5tU/EvsBLTW4qIIbDNCRJ062JC3JuuODB7SUOTa1R5J:zAb5tUesoaI/NS2KJ0DUUaa1RL
TLSH
T112E73337F149523BE0AA2B355EB3A024983B96504D928D1BC7EC759CCB356303E7B297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\SmartToolproProTool\\Boost Note.exe"	Boost Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-759331733-200834466-1207319849-1000\Software\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\SmartToolproProTool\\Boost Note.exe"	Boost Note.exe

Executes dropped EXE 9 IoCs

pid	Process
5744	OficioPCPE.pdf.tmp
4304	Boost Note.exe
2684	Boost Note.exe
2832	Boost Note.exe
3380	Boost Note.exe
4892	Boost Note.exe
5920	Boost Note.exe
6224	Boost Note.exe
1056	Boost Note.exe

Loads dropped DLL 14 IoCs

pid	Process
4304	Boost Note.exe
2684	Boost Note.exe
2684	Boost Note.exe
2684	Boost Note.exe
2684	Boost Note.exe
2832	Boost Note.exe
3380	Boost Note.exe
4892	Boost Note.exe
4892	Boost Note.exe
4892	Boost Note.exe
4892	Boost Note.exe
5920	Boost Note.exe
6224	Boost Note.exe
1056	Boost Note.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OficioPCPE.pdf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OficioPCPE.pdf.tmp

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/6004-0-0x0000000000E50000-0x0000000000F38000-memory.dmp	innosetup
behavioral2/memory/6004-1809-0x0000000000E50000-0x0000000000F38000-memory.dmp	innosetup

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2832	Boost Note.exe
2832	Boost Note.exe
5920	Boost Note.exe
5920	Boost Note.exe
6224	Boost Note.exe
6224	Boost Note.exe
6224	Boost Note.exe
6224	Boost Note.exe
1056	Boost Note.exe
1056	Boost Note.exe
1056	Boost Note.exe
1056	Boost Note.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 6004 wrote to memory of 5744	6004	OficioPCPE.pdf.exe	89
PID 5744 wrote to memory of 4304	5744	OficioPCPE.pdf.tmp	90
PID 4304 wrote to memory of 2684	4304	Boost Note.exe	91
PID 4304 wrote to memory of 2832	4304	Boost Note.exe	92
PID 3380 wrote to memory of 4892	3380	Boost Note.exe	96
PID 3380 wrote to memory of 5920	3380	Boost Note.exe	97
PID 4304 wrote to memory of 6224	4304	Boost Note.exe	99
PID 3380 wrote to memory of 1056	3380	Boost Note.exe	100

C:\Users\Admin\AppData\Local\Temp\OficioPCPE.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\OficioPCPE.pdf.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6004
- C:\Users\Admin\AppData\Local\Temp\is-LYOJ81291X.tmp\OficioPCPE.pdf.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-LYOJ81291X.tmp\OficioPCPE.pdf.tmp" /SL5="$5021E,64665588,887296,C:\Users\Admin\AppData\Local\Temp\OficioPCPE.pdf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe
    "C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4304
  - - C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe
      "C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe" --type=gpu-process --field-trial-handle=1548,15372897351811325307,15346686220377794590,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1564 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2684
  - - C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe
      "C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1548,15372897351811325307,15346686220377794590,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1940 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:2832
  - - C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe
      "C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe" --type=gpu-process --field-trial-handle=1548,15372897351811325307,15346686220377794590,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1480 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:6224

C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe
"C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe"
1⤵
- Adds Run key to start application
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe
  "C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe" --type=gpu-process --field-trial-handle=1652,9283824384078526578,743902456143825240,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1660 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4892
- C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe
  "C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,9283824384078526578,743902456143825240,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1992 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:5920
- C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe
  "C:\Users\Admin\AppData\Local\SmartToolproProTool\Boost Note.exe" --type=gpu-process --field-trial-handle=1652,9283824384078526578,743902456143825240,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1576 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\SmartToolproProTool\d3dcompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\SmartToolproProTool\ffmpeg.dll
Size 2.7MB
SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
MD5 b34d74a152e1788532b0acfa8cfbdf1e
SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
TLSH
T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\SmartToolproProTool\swiftshader\libEGL.dll
Size 458KB
SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
MD5 21a07ee229edc5d8de61de97f1a65210
SHA1 a60f93adbad349e25cca0eca5a81c78fbf24f133
SHA512 6375d8bda8cc187f79f6ea0cfd8358ac0d85508327f44d0bbcca641a934fa2b690933eb1ab588821a2f63f6615b1926aa433bc759b787015170aff11e633d0e4
SSDEEP 6144:e6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:ePZ4IM4u7BmXZXGuTcAD
TLSH
T13CA47C16B7A504A9D036C4348A574A43DA71B8DA0F74EBEF0294A27D2F7B7E05F39324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Users\Admin\AppData\Local\SmartToolproProTool\swiftshader\libGLESv2.dll
Size 3.1MB
SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
MD5 07a0f70d8e06fcb7e9063f39c0ab8c68
SHA1 896f3401b019c31ab1de2a376a66829daceccadb
SHA512 f58e4b23eca4aa4eef435288fc4d3740ea700debe82e083167a68df709c383f8bb7393ee74558acae8804ed105536ac86c5657912a98d284a1fc57dcf25586ff
SSDEEP 49152:cgnhCIFndJN3alVO7hUADGoJJ5AtyPzaaujA84dvCilHS4E0JhHHRBHpJbftopLw:TYIFnXoLfauC1DeFR
TLSH
T1EFE55A43E08880D9E05DD5BC874BA62EE132BC856B7272DF12946B222E77BF0573DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE_799f1d

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\LICENSE_799f1d
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE_7d9dbf

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\LICENSE_7d9dbf
Size 1KB
SHA256 0194571d45a06ea2a22ceb51f981e3be92525966d28847dbc0d9982603bf90de
MD5 78fd36a7284eb85369521bcb6e863186
SHA1 8ab3afa5af90b0fa4421252da279bf563b3c47b9
SHA512 265c0b9cb7e34ea63851a6bf0da02cd3da5beb2839b79bdec72607b26a5aeb0f34a812f37941d77c692f9f9799a706de704f41c9e0f360b8d40dbb9d0b416481
TLSH
T15511755EB251077228AB13A05578ACD5F23BB25F7A6F2A84246DF345233A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE_8a3d6d

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\LICENSE_8a3d6d
Size 1KB
SHA256 861908ec818ff6142fdd6c4b66d6264c206d3d5a46003b1342e1853a9a85abac
MD5 9a2baa6947d5018096b83508bd94026e
SHA1 cbe9761d4d16ad1a0a2007b305bc2951bf94be98
SHA512 6fea6e2f30885cdd6cae236637ef194fe9eb06276437e370c02eac651e170031980ab201ff5e8a95b7b5c21f24788fa93807d6c4f2cf79d5f71792e6e8a61fef
TLSH
T10C11421E72510B76189A13A05579A8D9B22BB25ABAAF2A84146EF245232A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE_f3aaee

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\LICENSE_f3aaee
Size 1KB
SHA256 3fe8d55a98dbf260eace67c00cf9bc53edb46234e840098a0b93df3096b97fb6
MD5 9befe7026bf915886cd566a98117c80e
SHA1 a95ab3a4b0e4bd978897f09b3b430a449da20a08
SHA512 b52ba143042812d6dd1031a12946afddb6e8f8ebbc7169c59c138d16aafc5e261aae92fe6b1ea94a3d80e39d2415c4b219710ef46939a2df135db24a0cf712fb
TLSH
T14E11B91E735507761CAA13605579ACD9F12BB25F7A6F1A44146DF340133A06CD1FB840
MD5 SHA1 SHA512 TLSH

Submit Download

angular-sprintf.min.map

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\angular-sprintf.min.map
Size 429B
SHA256 3d6885b5d3ebce0c1119d558c8784806cc79f076a5af8279051b7e94c412b697
MD5 88110c6656f210b1a33dfbacaca20bc8
SHA1 7e346bf1faac9cf2a443b934627d644c4a2a1e1e
SHA512 580fff2450e6afcf8be2d46fb46babfa89c157488cac31b322de78869ec3027067d345360cbf5a63b77a008f5213a608677263a507102e580f067a173a67d417
TLSH
T102E0E5F4CCC96D1869394DD9E4990E4C2BCEC09A7EDDF3114A94C56C4421F0DF0A0430
MD5 SHA1 SHA512 TLSH

Submit Download

license_e1a10c

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\license_e1a10c
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license_e57c8f

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\license_e57c8f
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

pako_inflate.js

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\pako_inflate.js
Size 106KB
SHA256 ec7e5936c652800e132c63cc1fcd00c23103a6a10a294ed3736bab70e38fc592
MD5 18ba5b8f0f9d69b8443df838577b59c7
SHA1 f21e39c5004036d69c56ad7b0f81607d9687714f
SHA512 98eb3873b102823c64154922bc5bb60107a8e78de7ec8e0d7a9b0d332be23fc6c8eb456640e5513f193a7d92f33ddd0092bb0688e3ee29ea19a3516b5fc2bdac
SSDEEP 1536:VWiXPnKsErlxSelzMs7GfJUVuNhaScFDYRe:fs6ON7E/a7x
TLSH
T104B3F84526F3221B181660B5DB8F70A567E6911F430BD9643CAE83847F9063E82FDFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updateInfo.js.map

Path C:\Users\Admin\AppData\Local\Temp\is-KH5HZZAPYS.tmp\updateInfo.js.map
Size 68B
SHA256 7318ccc42e283138707b3e67f39f03753f5ba998ab0d4e5bbe28fc79bc4f28e4
MD5 8d7f8e1cbd902a2427246d4831e90812
SHA1 608ab180e80eec4ce60ecad7fbdbabc055820342
SHA512 b6b21a0956d75d56105fcd38af04fe95bea39401f968a93873282d46f0919fe36c8fa91a330b08d91ed71927b35ae6830bea07dcad5a0fe4f5b75dd9e5a6b028
TLSH
T1F5A0028B58706F711F1007A908551FC272E1905AD80D405CD8D58C88573C01E4DD5C13
MD5 SHA1 SHA512 TLSH

Submit Download

OficioPCPE.pdf.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LYOJ81291X.tmp\OficioPCPE.pdf.tmp
Size 4.2MB
SHA256 414c505925499139935aa5123fdef21b89827980482ea8c60cf196616119c83d
MD5 c8b45096c79aa75c3e4bccc91d14e93d
SHA1 0e02fe7eedd1a42c7d6afdcf46d7d9b544dd4e54
SHA512 13474d15d330af7a45ba83a668dfb5c84f93ec3847fd3179cf56559173798335e49ed588099a7de38574e3c5e35be11d222ec0ac3c0dde51f8631ffaa96861d6
SSDEEP 49152:AC+KV5oP3m5US+sVlCGnmJc8cnoWwDgxtIDjVT0r333PhP:ACDLoUnnmJc8coWwDVT0r333PN
TLSH
T104266D13F284653AE46B1A3B483BA658583F7F713A168C477BEC2D4C4E396406D2A7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 dd344c2e4e00d292e2531efa81b609f49006eedf6b8df5e4d82a2adf9b7bfd5e
MD5 0c2d34d66e40613acb3a6ea3e469a2dd
SHA1 42d205ecb91e98366419a51dfb80a39aa5e55175
SHA512 2f4f50e8c0d3cfd60c4b76ff66906577a4e49fce2f130e13fb7419e0022012eeb20425ce5e6672d7616ed074f7d1e7545d20dadaf58d8ed953c7c13100cd0e35
MD5 SHA1 SHA512

Submit Download

memory/2684-1789-0x00007FFBE8A80000-0x00007FFBE8A81000-memory.dmp

Download

memory/2684-1812-0x0000022C640E0000-0x0000022C64187000-memory.dmp

Download

memory/4892-1813-0x00000256B1900000-0x00000256B19A7000-memory.dmp

Download

memory/5744-6-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Download

memory/5744-1811-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

Download

memory/5744-1810-0x0000000000EB0000-0x00000000012FD000-memory.dmp

Download

memory/6004-0-0x0000000000E50000-0x0000000000F38000-memory.dmp

Download

memory/6004-1809-0x0000000000E50000-0x0000000000F38000-memory.dmp

Download