hxxps://cmauriflama[.]sp[.]gov[.]br/doc/ifjEtOHjOD/QOSLl4ktlu

Resubmissions

03/07/2026, 17:59

260703-wktybsav8m8

03/07/2026, 17:49

260703-web6bsdv618

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cmauriflama.sp.gov.br/doc/ifjEtOHjOD/QOSLl4ktlu
Sample260703-web6bsdv61

Score

8^/10

discovery installer persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
25	4576	msedge.exe

Executes dropped EXE 8 IoCs

pid	Process
4792	Procuracao.exe
2332	Procuracao.tmp
5188	Boost Note.exe
976	Boost Note.exe
3860	Boost Note.exe
6088	Boost Note.exe
3808	Boost Note.exe
4300	Boost Note.exe

Loads dropped DLL 12 IoCs

pid	Process
5188	Boost Note.exe
976	Boost Note.exe
976	Boost Note.exe
976	Boost Note.exe
976	Boost Note.exe
3860	Boost Note.exe
6088	Boost Note.exe
3808	Boost Note.exe
3808	Boost Note.exe
3808	Boost Note.exe
3808	Boost Note.exe
4300	Boost Note.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\ProUtilionQuickWare\\Boost Note.exe"	Boost Note.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\electron.app.Boost Note = "C:\\Users\\Admin\\AppData\\Local\\ProUtilionQuickWare\\Boost Note.exe"	Boost Note.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procuracao.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Procuracao.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4576	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4792-285-0x0000000000500000-0x00000000005E8000-memory.dmp	innosetup
behavioral1/memory/4792-2701-0x0000000000500000-0x00000000005E8000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275745956774687"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{54889659-EAB2-4853-90CC-696F4D433EE6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
3860	Boost Note.exe
3860	Boost Note.exe
4300	Boost Note.exe
4300	Boost Note.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 57 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2408	4828	msedge.exe	86
PID 4828 wrote to memory of 4576	4828	msedge.exe	87
PID 4828 wrote to memory of 5360	4828	msedge.exe	88
PID 4828 wrote to memory of 5360	4828	msedge.exe	88
PID 4828 wrote to memory of 5360	4828	msedge.exe	88
PID 4828 wrote to memory of 3148	4828	msedge.exe	89
PID 4828 wrote to memory of 3148	4828	msedge.exe	89
PID 4828 wrote to memory of 972	4828	msedge.exe	90
PID 4828 wrote to memory of 5524	4828	msedge.exe	91
PID 4828 wrote to memory of 972	4828	msedge.exe	90
PID 4828 wrote to memory of 972	4828	msedge.exe	90
PID 4828 wrote to memory of 5524	4828	msedge.exe	91
PID 4828 wrote to memory of 5524	4828	msedge.exe	91
PID 4828 wrote to memory of 1204	4828	msedge.exe	95
PID 4828 wrote to memory of 2356	4828	msedge.exe	96
PID 4828 wrote to memory of 1204	4828	msedge.exe	95
PID 4828 wrote to memory of 2356	4828	msedge.exe	96
PID 4828 wrote to memory of 3876	4828	msedge.exe	97
PID 4828 wrote to memory of 3876	4828	msedge.exe	97
PID 4828 wrote to memory of 3872	4828	msedge.exe	98
PID 4828 wrote to memory of 3872	4828	msedge.exe	98
PID 4828 wrote to memory of 3872	4828	msedge.exe	98
PID 4828 wrote to memory of 2780	4828	msedge.exe	100
PID 4828 wrote to memory of 5288	4828	msedge.exe	109
PID 4828 wrote to memory of 4112	4828	msedge.exe	115
PID 4828 wrote to memory of 4824	4828	msedge.exe	116
PID 4828 wrote to memory of 3572	4828	msedge.exe	117
PID 4828 wrote to memory of 1200	4828	msedge.exe	119
PID 4828 wrote to memory of 1200	4828	msedge.exe	119
PID 4792 wrote to memory of 2332	4792	Procuracao.exe	124
PID 4828 wrote to memory of 4396	4828	msedge.exe	125
PID 2332 wrote to memory of 5188	2332	Procuracao.tmp	126
PID 5188 wrote to memory of 976	5188	Boost Note.exe	127
PID 5188 wrote to memory of 3860	5188	Boost Note.exe	130
PID 6088 wrote to memory of 3808	6088	Boost Note.exe	133
PID 6088 wrote to memory of 4300	6088	Boost Note.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cmauriflama.sp.gov.br/doc/ifjEtOHjOD/QOSLl4ktlu
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffeb52ac188,0x7ffeb52ac194,0x7ffeb52ac1a0
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,7307402483850257631,13720335158286933904,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,14128072600919490816,13273110759594627228,262144 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,15559468449552731268,18068434086950977439,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,16712282001565679873,14537196688287638201,2097152 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,1197017249115088137,13888487048464359963,2097152 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,7207386654332998392,14303061709766870236,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,3444599395354285405,16374718093215758056,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,4125197858183736419,16473974551354243515,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5556,i,8058189511488528288,9910263581958583151,2097152 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,6778499933748847829,16604318509536640459,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,6778499933748847829,16604318509536640459,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,15891599025595937083,16175492499119710175,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,2711600626416659785,5368795075430523483,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,6825410876121035419,17570506994945688340,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,13164952747554883705,14836222755484121309,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,1340239977858627954,7731900685504346995,524288 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6312,i,3334467460650388579,7091710960401462489,262144 --field-trial-handle=2040,i,2121012689074265227,13668419242089311789,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3532

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:216

C:\Users\Admin\Downloads\Procuracao.exe
"C:\Users\Admin\Downloads\Procuracao.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4792
- C:\Users\Admin\AppData\Local\Temp\is-ODG6RU0ANK.tmp\Procuracao.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ODG6RU0ANK.tmp\Procuracao.tmp" /SL5="$402BA,64665588,887296,C:\Users\Admin\Downloads\Procuracao.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe
    "C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe
      "C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe" --type=gpu-process --field-trial-handle=1724,1655179429517433346,2287094659029719741,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1732 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:976
  - - C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe
      "C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,1655179429517433346,2287094659029719741,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2104 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:3860

C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe
"C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:6088
- C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe
  "C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe" --type=gpu-process --field-trial-handle=1776,1439380549040710459,11312912945149430839,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3808
- C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe
  "C:\Users\Admin\AppData\Local\ProUtilionQuickWare\Boost Note.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1776,1439380549040710459,11312912945149430839,131072 --enable-features=WebComponentsV0Enabled --disable-features=CertVerifierService,CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 92dc4496d3210deb950dc8ea6152a6ef654a2544e4d207422c535f97081810aa
MD5 d0a4844d0fb7b2d86fc06cfd1f572b55
SHA1 f78586ec842ea8aec5741479477cf33544c40a8e
SHA512 83e8fabcf1028eee73222c39519018ce08d5ebbefa0ce078b30cf4b9561345ad112bff92b28c3377dd0275179ec16c245af300954b605f33b78f360a16f4a572
TLSH
T141E02B66C865FC2708FD4728600D9756E71423173B80894F3B3C820C8FB16264AC5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f29785f0e5606d9b2ef7e4eb15dfee4194cd951f2261d41a05bb067b6c9a0d35
MD5 e8269bd4870bb7b64becc9e272a305f4
SHA1 a65918d50b390c09858e8fa9296d25b015933484
SHA512 7ad155609ffa6f47b1e0ef3642b42444c196f1c9bc341a052b071ced36d86b52088c3911596cf96837dd4bff9dd16ad54f33980e1b604e28ef1c5edaf944b751
TLSH
T19D41A1F783F4856EDA0195F0EA186E2FCE6D0510432C3D9A85E4AF17A3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5f889389a0d109a13a2deee4d4a4760eb14ab31a924364982417c72e88dfe0a0
MD5 a0344d0e97f9b073da3c81b45fdc9be3
SHA1 d4129add91b51f779833868fcf2903f8c2ec735a
SHA512 119789d00778ad748fdeddcc8b5e330cdaa98fa4d5e55bf6223c64227b43d698d325389da83e9010aa54b4a21ecd79a29c8eb36ead36acae1d0a298dba3ef609
SSDEEP 192:sxZaRiyMqZjK1Ml8M9z/flsshwLaZdQzodpLHW6+WNGYv0u0trehIgjYJ:sxZah1z/flsshgazTLHbGlrIj8
TLSH
T11D62F8166A34597BCCDBD209F6457F93D2F90163A2945E48A9FC8B0C05E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4fb7bc56215679b6f6eca8a4777ea9cd2d4525f800aff6746b37567b91457c7f
MD5 4566938df99965d8d3439f57d7aa0133
SHA1 323f63a7b13736fb4b4f5df515b9c7825917a34d
SHA512 90136861cfb900efbd39f89d212dc59ac7f5f261d891c4d22d99f8d36d708af71d246508a938887434f57a7bab41378a626a078557f04229734945077050af50
SSDEEP 192:sxZaRiyMqZjK1Ml8UQz9z/flsuwAZdQzodpLHW6+WNGYv58wrehIg5sYJ:sxZahqBz/flsuNzTLHbGwrI+8
TLSH
T1EC62F916AA34597BCCD7D219F6457F93D6F90163A2905E48A9FC8B0C05E7BEC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6d1396415dd0eaa8b665abe98dbe9abde16302491a2e27294fc3edd8480cbad7
MD5 b7ececec8ffc6032ebe7f50730f54f68
SHA1 dd7826dfbb0c83c72eda9069564ad070d627470d
SHA512 072a95cfe63d218f389b4b2cd6039ee815fd5de2e5090764276eb03874a856e9354c1676486d88e64cf4bd772c108d591e00c629a723b4f6a27e109da4a247c8
SSDEEP 192:05ppxnY753RNBvRJJdt7p5J9XP516/masM1:0LppY93PBZJPtN53XB6
TLSH
T157B2565A703E0211397E2988B39696364F4235A37058E4AF7FB814A54F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 faccd6c9c80835ef1a4d60d085110e95b43c2c14b81f64ed14c78ab1bec20ba8
MD5 2a6506d525f38078188934400e537e7d
SHA1 5490c2b91644009af82ecf60e6049633a4288db8
SHA512 a1790273d3a0e453bbd48734bf205e0af88c55ae61c4045782fb27f55a4f6de8974b8b1e4919b40161cbbfeed13dff9eb39ab92f9fc19af3756def65c3da76f1
SSDEEP 384:np3iF9CcmyWCs3sNC8TUNTUlIm2QckCr9lNKpv4fxGgxiz0yJUH9vpwe4KV8p0us:pyFccps3fwgbkUjkkGgGJc9aI8p0YM
TLSH
T159B24B36EC58DABBEDE34F89B74A7A07DEE0126785D85AD4DAD85E0D00871DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 11468bddcd7d58a87a0b06c2612ae5cce24092f6bdc6c40205c921c778518c5a
MD5 4f1c040e797e3f68b9b6bd5c625c627b
SHA1 087438cdc38b75190532910ae6195b22999116c0
SHA512 968211e2ef2767e0224007574e3796c4e98c26207bb19e8890b8fef7917fa09813550bd770565e69371b0751ab9c2c31b16a5a0b0b93ac60abb699f6c09e1bc1
SSDEEP 768:YiFXj+9MTpwg0kBdkGgGJccDbyj29Mit8:YV9MTM4TcN2+it8
TLSH
T100D23936E854CABBADE38BC9B74A3947EFE0425786C86AC4D5D95E0C01C71AC430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7fa761e61cc6a2b3c660a43b4ccd6989fb5f8eb2701fa43c744799a114a78e5f
MD5 69d3b7e80082810fa347dd367dfac4b4
SHA1 e9f30d1aff7572cd58efcc11d474f42e1f8b8f4a
SHA512 fa3d428bc06b4f5fb2b4e9fd5c095ef7c6fce650e506857cab6622e29ba841d7f9a4f8c36a1e8fff911c0b84af9ecf8e14855190d6e8257248dc2e9c3d1cafa9
SSDEEP 384:nkiF1tNn/s3n9SssNn8TUNTUlI49QckCrsNTpv4fxGgxiz0yJUHcvrBbyjOObjIW:/F1j+9LKwgAkBdkGgGJccDhyj29Mit8
TLSH
T1E5D24936D854DABBADE34BC9B74A3947EFE0426786CC6AC4D5C95E0C01C71AC430BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 02f5afe5725e91b7a22e6d4d0de097049201da88b09b6d0030f9098f8444898a
MD5 7fd01c6ac0f206f415722d8d4c839c61
SHA1 f677b4608fce1278d7819d1f0a91f9a2ad9ec774
SHA512 3acd60d4441f1690b1b22407a1506f00495ce5f89be73b7f2156f639b6747d932266404bd6afc6748442a734b9c3f4fb002af23e746f0ee40dc507e108379915
SSDEEP 768:peFccps3awgbkURmkGgGJccDoyjI8p0YM:8s3MyTcqI8p0p
TLSH
T13DC24B36E858DABBECD34B89B74A3947DEE0426786CC9AD4DADC5D0C019B1EC430BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8782e0bfc84a5859ff1517157d4b5ea55cf936edef86d67292b2b15d0cb7a724
MD5 aca18166165256daeb504c2ab4e66c22
SHA1 6a650cc16bfacce84f79f8cb2577eda67dd1ae01
SHA512 0b8ffc7b62626e9dd139b26f1f22bcb2594b01f1a045b9d99b6a283887228a6dcd6ee0652a485aaafc50be9c311d83e3e39ead2c3194fe4db6a32afa1ae609a4
SSDEEP 384:npYiF9CcmyWCI3sNn8TUNTUlI4YQckCr+NTpv4fxGgxiz0yJUHcvrBbyjOObjI96:pjFccpI3Kwg3kjdkGgGJccDhyj29Mit6
TLSH
T125D23936E858CABBEDE34B89B75A3943DEE0416786CC5AD4D6DD5E0C01CB1EC430B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6efbe64eb76afdd31d864b281b0238206c7c01ceda253eebe72e850ad3ac46c0
MD5 eaa9303763ad62930b284516e93a6da7
SHA1 cdb79b414f7b98c5cb64dd1a4def72e10c3b0996
SHA512 588dff9db9992fdcbce7e9c636cb0d6a6dff10b688d749c41d5235f4893d13feaa87790b09a461ddf3a9cc01afc502f0c66d93cc9edde927ba003d0f4a125feb
SSDEEP 384:npYiF1tNn/s3n9SssNn8TUNTUlI49QckCrsNTpv4fxGgxiz0yJUHcvrBbyjOObjV:pjF1j+9LKwgAkBdkGgGJccDhyj29Mit8
TLSH
T19AD24A36D854DABBADE34BC9B74A3947DFE0426786CC6AC4D5D95E0C01C71AC430BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1375132e591f3062cbd7704b013c3053c2bb89293b79680a2d8c44df86c2e935
MD5 fcab8187a50075d2e24880dfe85dc93f
SHA1 39eb7db35a47818ea495ee64101d12ec154e82d0
SHA512 870a3db0bae11a11638797490e878b8b2dbf6d941acb0356e71d7f1cf773c0a52b147095088745afc29342a36c45a339701dfbffdd127d1aa57cb6ca1c83c1bf
SSDEEP 384:nYniF1tNn/s3n9SQIsNn8TUNTUlI49QckCrsNTpv4fxGgxiz0yJUHcvrBJyjOObx:YiF1j+9sKwgAkBdkGgGJccDbyj29Mit8
TLSH
T1F6D24A36E854DABBADE34BC9B74A3947EFE4425786CC6AC4D5C95E0C01C71AC430BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 70c1e544981ab566762a55b0a161a8bf5010675a5a6974fbae68a49627924577
MD5 913f2e82800afeeeb29e9acb39292e53
SHA1 55d878a796b6872f2a74edc5da2a2eec2e54d1fb
SHA512 19011ce3626cf9ec832ec34addb3ed104baadf6ec3ea0e9e3f5cad9783745f186430dd9a17508a4b4ccddd381363489521dffee006c60a3cbf780aaeb85e5b5e
TLSH
T121410958A6F92148B3777F169FF7A86E447ABD772E0A94AE00110E4F0676A40C4A1B33
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\chrome_100_percent.pak
Size 123KB
SHA256 f1a935db8236203cbc1dcbb9672d98e0bd2fa514429a3f2f82a26e0eb23a4ff9
MD5 a59ea69d64bf4f748401dc5a46a65854
SHA1 111c4cc792991faf947a33386a5862e3205b0cff
SHA512 12a1d953df00b6464ecc132a6e5b9ec3b301c7b3cefe12cbcad27a496d2d218f89e2087dd01d293d37f29391937fcbad937f7d5cf2a6f303539883e2afe3dacd
SSDEEP 3072:YerKzw9bpxlr+bEfF2DGb0+VvfGGY304F2DExm/KLQ2I:YeKzw9Vh90Gb0OveGe04mExhLY
TLSH
T187C3D0D373F0ED7DCF6756B7A52A41B1ECB302391A92034A469AD8356A27348DDC8393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\chrome_200_percent.pak
Size 183KB
SHA256 7f9ded50d81c50f9c6ed89591fa621fabbd45cef150c8aabcceb3b7a9de5603b
MD5 1985b8fc603db4d83df72cfaeeac7c50
SHA1 5b02363de1c193827062bfa628261b1ec16bd8cf
SHA512 27e90dd18cbce0e27c70b395895ef60a8d2f2f3c3f2ca38f48b7ecf6b0d5e6fefbe88df7e7c98224222b34ff0fbd60268fdec17440f1055535a79002044c955b
SSDEEP 3072:yDfDQYaEM+9bslr+bEfEfRIGMR+F8fQnYw9pGbXGYoDd+qHqRxmeK/rIM0:6DQYaF+9bMhCWGMRe8InVXYopym74
TLSH
T12E04D1D7A3F49D3CDAB30A77553A01F1ECB6127516A3424A42DBAC347A5678C4CC9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\d3dcompiler_47.dll
Size 4.3MB
SHA256 44422e6936dc72b7ac5ed16bb8bcae164b7554513e52efb66a3e942cec328a47
MD5 7641e39b7da4077084d2afe7c31032e0
SHA1 2256644f69435ff2fee76deb04d918083960d1eb
SHA512 8010e1cb17fa18bbf72d8344e1d63ded7cef7be6e7c13434fa6d8e22ce1d58a4d426959bdcb031502d4b145e29cb111af929fcbc66001111fbc6d7a19e8800a5
SSDEEP 49152:aYlc/220PPiMLKam+VMrLi21f4i3jn5ZO3XUDmOZQwVd2uQpN3WsGVUWd55i/jrs:a6KD2Mrdaix4NQnLt
TLSH
T16F267D5677A840A9C27BC178CA574313EBB1781403349BEF55A0C665EF33BD26E3A728
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffmpeg.dll

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\ffmpeg.dll
Size 2.7MB
SHA256 8653b57b37618f11e358c93aad9dc9ef0193f0288f7e59147194e42b0842b50e
MD5 b34d74a152e1788532b0acfa8cfbdf1e
SHA1 e99e5a26d8b695b57cb1a1bb0d2c032d822d0461
SHA512 06f8def21101d8c899c321b3a445e6838f824d6d6305d569b49fb7ad14a197a57c601a8965c50057e7af1d5414b74dd2c79e2f27a58eedab31b3b36202947dd9
SSDEEP 49152:nSFoiJBtTcoQ9mjUBA6vXH4VjB0kxryYTK8gJ2EDE+oM0iloSa08UHdiVqAy6cTC:ijUBA656ryEpEdiVq4
TLSH
T1DFD59D0BF2A645DDC029C53083AFA233F934394A4725A6EF16A156252F3FFD0667EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\icudtl.dat
Size 9.9MB
SHA256 02db39ba465fc8b7a4cd280732760f29911edde87b331bf7cea7677e94d483e0
MD5 70499b58dc18e7ee1d7452a1d7a8bc6e
SHA1 41c5382f08c6a88670ce73a20c0dcdb3822f19e9
SHA512 a80939e9809bb7d20f00ad685c94d5c182fa729616c975e605abf09afb58376be73a49fefa35b75ed1a284eccf208af7656c8df44c5959df7eaf51367d232dc6
SSDEEP 196608:uUGwSv9AAQnt6liXUxR0rHa93WhlU6t7CLhl:uoKlQnAliXUxR0rHa93WhlU6t+Ln
TLSH
T131A63947A2FB4DC2F9FBAF30D8F452679467BD496E32805A11042F3B5C373A096617A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\locales\en-US.pak
Size 85KB
SHA256 ac1cdb4fb4d9fb27a908ed0e24cc9cc2bd885bc3ffba7e08b0b907fd4d1a8c4b
MD5 6bbeeb72daebc3b0cbd9c39e820c87a9
SHA1 bd9ebec2d3fc03a2b27f128cf2660b33a3344f43
SHA512 66944fb1abcc2a7e08e5fd8a2cee53eb9da57653d7880aea226f25879e26379f7d745ebf62a3518378fa503f3a31b3ea3716f49fe4c7db4f4af0228b81b53a10
SSDEEP 1536:MzBh0wu6Y90fYSKD0R4RlQ2trhWMJ5dBxgMSO0JedMVrBHhQYVfD3ggl+C/fpkwG:6hp1YSwhBxgrvQY3ggl+CGwG
TLSH
T1BB835E1BE3C41266099243227F06E3B6AB26D079936311663C6CC16C3777FA982777E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\resources.pak
Size 4.9MB
SHA256 367467609a389b67600628760c26732fc1a25f563f73263bc2c4bf6eec9033df
MD5 5507bc28022b806ea7a3c3bc65a1c256
SHA1 9f8d3a56fef7374c46cd3557f73855d585692b54
SHA512 ae698d4feacc3e908981ee44df3a9d76e42a39bf083eaf099442ace2b863f882b43232e26e2c18051ca7aec81dccef5742acc7b82fb0cda2e14086b14d5a9a26
SSDEEP 98304:1jMQZikLH2tMPwSGBNumogFJlFlh1wTJntwyqWBsCiLeD8crwrb:tMqimHmGfgfhyTh8YsCi6Qckrb
TLSH
T1FB362302F2E4283BC6DB31766C6BA161B73444471068BD2E7A9D52DCAF5492802FEFF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.js

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\resources\app\index.js
Size 233KB
SHA256 71f69978667dc421e7edf8885e9f3bde9dd527d9f7974228c9a6eac84c2ab71c
MD5 187bab3548439b4b11a1fdbcea7b22d5
SHA1 a5cf8162403fd63254c046f116fac364f0216fb6
SHA512 b5fdde90286e4087a52b3e5e1fa846b0b53520a804afc674942b512eab7bccf76d7b5bfa0cb6aa5902fb91baf6794268abc340591dc3be6f1f21db98b84916ef
SSDEEP 3072:ZnxPxK7CEeBpt0aaAI5hRwvvCpJwm6z8u0cFAVgKo4imY6KX1J56MY8:NxxKGhiaaAI9P6z8u0d+UY6Kl9Y8
TLSH
T16134E88437D1B16B810D24763A5B2029F8ADDCC2364D4898E3E568D2FF7E31596BBB34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\resources\app\package.json
Size 326B
SHA256 ed559a3a3027667ce6302f1debaed9aef5bef1c6d4236ec4da01199b398f78b2
MD5 48f234e36eba960bf0f66519a219e17e
SHA1 988d574c95e613f177e81417c590540f77ed9845
SHA512 08ac57c789dd209ceebdc73d5ee709ee141811f0955b982454c3459eeac9353eec08aac68646d18c55a181a1f5f64f56fcbebe203597dabef54f2deb40e5e276
TLSH
T128E08C18DC499E23129B888A3068014728612C079959F80DB79E930C1E5C96FB2FCAAD
MD5 SHA1 SHA512 TLSH

Submit Download

libEGL.dll

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\swiftshader\libEGL.dll
Size 458KB
SHA256 bfd1d3fb9e50a3d9a58d9c62663fbf46bedcac24744020b801c9bb4cdc55f977
MD5 21a07ee229edc5d8de61de97f1a65210
SHA1 a60f93adbad349e25cca0eca5a81c78fbf24f133
SHA512 6375d8bda8cc187f79f6ea0cfd8358ac0d85508327f44d0bbcca641a934fa2b690933eb1ab588821a2f63f6615b1926aa433bc759b787015170aff11e633d0e4
SSDEEP 6144:e6txlbRay7iVeTIM4gkZ8A9YfCmpmXZvrpeK8MbhGG+gwLuggcAgAeG4:ePZ4IM4u7BmXZXGuTcAD
TLSH
T13CA47C16B7A504A9D036C4348A574A43DA71B8DA0F74EBEF0294A27D2F7B7E05F39324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\swiftshader\libglesv2.dll
Size 3.1MB
SHA256 54b6e787450bfcebed843ad1dafb31ca0904a908131d1005b567513ee8e2db46
MD5 07a0f70d8e06fcb7e9063f39c0ab8c68
SHA1 896f3401b019c31ab1de2a376a66829daceccadb
SHA512 f58e4b23eca4aa4eef435288fc4d3740ea700debe82e083167a68df709c383f8bb7393ee74558acae8804ed105536ac86c5657912a98d284a1fc57dcf25586ff
SSDEEP 49152:cgnhCIFndJN3alVO7hUADGoJJ5AtyPzaaujA84dvCilHS4E0JhHHRBHpJbftopLw:TYIFnXoLfauC1DeFR
TLSH
T1EFE55A43E08880D9E05DD5BC874BA62EE132BC856B7272DF12946B222E77BF0573DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\ProUtilionQuickWare\v8_context_snapshot.bin
Size 160KB
SHA256 31c3aa5645b5487bf484fd910379003786523f3063e946ef9b50d257d0ee5790
MD5 b64c1fc7d75234994012c86dc5af10a6
SHA1 d0d562b5735d28381d59d0d86078ff6b493a678e
SHA512 6218fcb74ef715030a2dd718c87b32f41e976dd4ce459c54a45341ee0f5ca5c927ad507d3afcffe7298b989e969885ed7fb72030ea59387609e8bd5c4b8eb60a
SSDEEP 3072:pBgpuz1xV9mRTUAnPH5lZw15qCy0CmiRNiA0hTBAzZs7q/JBXTPv:p4O1xoTPyqIRhTBAzZs7kJ1TPv
TLSH
T1F2F3121427D0829096ED4094A25B06E7C5D26C6D1E2CFF0A3BB5FD4C0AA3DCE55FE1B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Procuracao.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-ODG6RU0ANK.tmp\Procuracao.tmp
Size 4.2MB
SHA256 88a5f174c094981664f6d3e0d93fffe2678b4bbc860a9afa005fed297d285a98
MD5 c05a2e592798355253faa1f01319421b
SHA1 463f830f1b88ea7c28802817e0a9a692c074ab49
SHA512 0ca20191d977293bfa3441e406e5e07c764853e048ed2af5e3028d1ee1b16cd0975227b1dfab64ad836c9d728ea4d2f7962a64c2f66b3a62cd8e1c70a307755b
SSDEEP 49152:AC+KV5oP3m5US+sVlCGnmJc8cnoWwDgxtIDjVT0r333PhJ:ACDLoUnnmJc8coWwDVT0r333Pj
TLSH
T17B266D13F284653AE46B1A3B483BA658583F7F713A168C477BEC2D4C4E396406D2A7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE_28c47a

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\LICENSE_28c47a
Size 1KB
SHA256 3fe8d55a98dbf260eace67c00cf9bc53edb46234e840098a0b93df3096b97fb6
MD5 9befe7026bf915886cd566a98117c80e
SHA1 a95ab3a4b0e4bd978897f09b3b430a449da20a08
SHA512 b52ba143042812d6dd1031a12946afddb6e8f8ebbc7169c59c138d16aafc5e261aae92fe6b1ea94a3d80e39d2415c4b219710ef46939a2df135db24a0cf712fb
TLSH
T14E11B91E735507761CAA13605579ACD9F12BB25F7A6F1A44146DF340133A06CD1FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE_aa0e72

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\LICENSE_aa0e72
Size 765B
SHA256 4ec3d4c66cd87f5c8d8ad911b10f99bf27cb00cdfcff82621956e379186b016b
MD5 82703a69f6d7411dde679954c2fd9dca
SHA1 bb408e929caeb1731945b2ba54bc337edb87cc66
SHA512 3fa748e59fb3af0c5293530844faa9606d9271836489d2c8013417779d10cc180187f5e670477f9ec77d341e0ef64eab7dcfb876c6390f027bc6f869a12d0f46
TLSH
T1E401FD9FB2E26BD458D09B603DA16DC962CAB03B7803AA152468E298DB7740FA47A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE_d0072d

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\LICENSE_d0072d
Size 1KB
SHA256 861908ec818ff6142fdd6c4b66d6264c206d3d5a46003b1342e1853a9a85abac
MD5 9a2baa6947d5018096b83508bd94026e
SHA1 cbe9761d4d16ad1a0a2007b305bc2951bf94be98
SHA512 6fea6e2f30885cdd6cae236637ef194fe9eb06276437e370c02eac651e170031980ab201ff5e8a95b7b5c21f24788fa93807d6c4f2cf79d5f71792e6e8a61fef
TLSH
T10C11421E72510B76189A13A05579A8D9B22BB25ABAAF2A84146EF245232A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE_e4efa4

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\LICENSE_e4efa4
Size 1KB
SHA256 0194571d45a06ea2a22ceb51f981e3be92525966d28847dbc0d9982603bf90de
MD5 78fd36a7284eb85369521bcb6e863186
SHA1 8ab3afa5af90b0fa4421252da279bf563b3c47b9
SHA512 265c0b9cb7e34ea63851a6bf0da02cd3da5beb2839b79bdec72607b26a5aeb0f34a812f37941d77c692f9f9799a706de704f41c9e0f360b8d40dbb9d0b416481
TLSH
T15511755EB251077228AB13A05578ACD5F23BB25F7A6F2A84246DF345233A06CD5FB840
MD5 SHA1 SHA512 TLSH

Submit Download

angular-sprintf.min.map

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\angular-sprintf.min.map
Size 429B
SHA256 3d6885b5d3ebce0c1119d558c8784806cc79f076a5af8279051b7e94c412b697
MD5 88110c6656f210b1a33dfbacaca20bc8
SHA1 7e346bf1faac9cf2a443b934627d644c4a2a1e1e
SHA512 580fff2450e6afcf8be2d46fb46babfa89c157488cac31b322de78869ec3027067d345360cbf5a63b77a008f5213a608677263a507102e580f067a173a67d417
TLSH
T102E0E5F4CCC96D1869394DD9E4990E4C2BCEC09A7EDDF3114A94C56C4421F0DF0A0430
MD5 SHA1 SHA512 TLSH

Submit Download

license_1c32c9

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\license_1c32c9
Size 1KB
SHA256 48da2f39e100d4085767e94966b43f4fa95ff6a0698fba57ed460914e35f94a0
MD5 915042b5df33c31a6db2b37eadaa00e3
SHA1 5aaf48196ddd4d007a3067aa7f30303ca8e4b29c
SHA512 9c8b2def76ae5ffe4d636166bf9635d7abd69cdac4bf819a2145f7969646d39ae95c96364bc117f9fa544b98518c294233455d4f665af430c75d70798dd4ab13
TLSH
T1EC11931D7254136318BA13A069696CC4B32BB11F79AF6B8418AEF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

license_611403

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\license_611403
Size 1KB
SHA256 5c932d88256b4ab958f64a856fa48e8bd1f55bc1d96b8149c65689e0c61789d3
MD5 d5f2a6dd0192dcc7c833e50bb9017337
SHA1 80674912e3033be358331910ba27d5812369c2fc
SHA512 d1f336ff272bc6b96dc9a04a7d0ef8f02936dd594f514060340478ee575fe01d55fc7a174df5814a4faf72c8462b012998eca7bb898e3f9a3e87205fb9135af2
TLSH
T18221931E7254136318BA13A0696A6CC4B32BB11F7DAF6B8418ADF244233B46CD4FB840
MD5 SHA1 SHA512 TLSH

Submit Download

pako_inflate.js

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\pako_inflate.js
Size 106KB
SHA256 ec7e5936c652800e132c63cc1fcd00c23103a6a10a294ed3736bab70e38fc592
MD5 18ba5b8f0f9d69b8443df838577b59c7
SHA1 f21e39c5004036d69c56ad7b0f81607d9687714f
SHA512 98eb3873b102823c64154922bc5bb60107a8e78de7ec8e0d7a9b0d332be23fc6c8eb456640e5513f193a7d92f33ddd0092bb0688e3ee29ea19a3516b5fc2bdac
SSDEEP 1536:VWiXPnKsErlxSelzMs7GfJUVuNhaScFDYRe:fs6ON7E/a7x
TLSH
T104B3F84526F3221B181660B5DB8F70A567E6911F430BD9643CAE83847F9063E82FDFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

updateInfo.js.map

Path C:\Users\Admin\AppData\Local\Temp\is-W0RX2JVQAN.tmp\updateInfo.js.map
Size 68B
SHA256 7318ccc42e283138707b3e67f39f03753f5ba998ab0d4e5bbe28fc79bc4f28e4
MD5 8d7f8e1cbd902a2427246d4831e90812
SHA1 608ab180e80eec4ce60ecad7fbdbabc055820342
SHA512 b6b21a0956d75d56105fcd38af04fe95bea39401f968a93873282d46f0919fe36c8fa91a330b08d91ed71927b35ae6830bea07dcad5a0fe4f5b75dd9e5a6b028
TLSH
T1F5A0028B58706F711F1007A908551FC272E1905AD80D405CD8D58C88573C01E4DD5C13
MD5 SHA1 SHA512 TLSH

Submit Download

daemon.log

Path C:\Users\Admin\AppData\Roaming\daemon.log
Size 8B
SHA256 684e5254b6a65da00c4be4791cca38c1eae6b379203790bd7bc4b8128a4af9c9
MD5 de76663c297b784c64f258581cbf6ac2
SHA1 7230c112150aadc9dd0f75726fafb4ce733da24f
SHA512 b32b4dee1d8a85aeebb077269b1bf2646dffe04cf3fc5248bcf9aa97168c975b121dba65ac13a2c8013bef9d6a513197be4515f000014a2e62dc76d1befef9a7
MD5 SHA1 SHA512

Submit Download

memory/976-2678-0x00007FFED0290000-0x00007FFED0291000-memory.dmp

Download

memory/2332-2702-0x00000000008E0000-0x0000000000D2D000-memory.dmp

Download

memory/4792-285-0x0000000000500000-0x00000000005E8000-memory.dmp

Download

memory/4792-2701-0x0000000000500000-0x00000000005E8000-memory.dmp

Download