73d511657cf6ebb4e52d98906843abcf27c47a538095a69064277e69d5c75e33

Analysis

user interaction
yes
max time kernel
45s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260513-es
resource tags

arch:x64arch:x86image:win10v2004-20260513-eslocale:es-esos:windows10-2004-x64systemwindows
submitted
04/08/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Pedido de anulação não solicitado.eml
Size 126KB
Sample260804-lr2xeacl41
SHA256 73d511657cf6ebb4e52d98906843abcf27c47a538095a69064277e69d5c75e33
MD5 4e4249e3b557ab78b9416f837c323e3a
SHA1 b4c941590bf915d0221ca513c92ffd6fd73cdd68
SHA512 1cfbfdacefef067ccdbbaf05ca3c42cc052473aa18a5932486edc6651f2a7efb4cb723bf099e1ed0576a5c4d1bb322b401e3ebe39355c5f994a09a65f1427a09
SSDEEP 3072:/bqltONfhF6xyeEoihErswuhWjm7sSPzwcDxHenauHOLZK1:/2ltKhF6xybDh37TwcDCauiO
TLSH
T182C3F1541D8114AEA67302D57552FA08F2732C0E6CB751D2B03F8EBA2F864C2BB5E5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

adware discovery spyware

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	prevhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	OUTLOOK.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	OUTLOOK.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	OUTLOOK.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OUTLOOK.EXE = "10001"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\	AcroRd32.exe

Modifies registry class 29 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	OUTLOOK.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\	AcroRd32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	OUTLOOK.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	OUTLOOK.EXE
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	OUTLOOK.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	OUTLOOK.EXE

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\WiZink Pedido Adesão – Anulação.pdf:Zone.Identifier	OUTLOOK.EXE
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y2CV88LE\WiZink Pedido Adesão Anulação.pdf:Zone.Identifier	OUTLOOK.EXE
File created	C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y2CV88LE\WiZink Pedido Adesão Anulação (002).pdf\:Zone.Identifier:$DATA	OUTLOOK.EXE
File created	C:\Users\Admin\Documents\WiZink Pedido Adesão – Anulação.pdf\:Zone.Identifier:$DATA	OUTLOOK.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
312	OUTLOOK.EXE
312	OUTLOOK.EXE

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
312	OUTLOOK.EXE
312	OUTLOOK.EXE
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
2532	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
312	OUTLOOK.EXE
312	OUTLOOK.EXE

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
312	OUTLOOK.EXE

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
312	OUTLOOK.EXE
2532	AcroRd32.exe
312	OUTLOOK.EXE
312	OUTLOOK.EXE
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe
4236	AcroRd32.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 5072	4040	prevhost.exe	94
PID 5072 wrote to memory of 2532	5072	AcroRd32.exe	95
PID 5072 wrote to memory of 2532	5072	AcroRd32.exe	95
PID 5072 wrote to memory of 2532	5072	AcroRd32.exe	95
PID 4236 wrote to memory of 3840	4236	AcroRd32.exe	100
PID 3840 wrote to memory of 3000	3840	RdrCEF.exe	101
PID 3840 wrote to memory of 2136	3840	RdrCEF.exe	102
PID 3840 wrote to memory of 2136	3840	RdrCEF.exe	102
PID 3840 wrote to memory of 4512	3840	RdrCEF.exe	103
PID 3840 wrote to memory of 3180	3840	RdrCEF.exe	104
PID 3840 wrote to memory of 2132	3840	RdrCEF.exe	105

C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE
"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\Admin\AppData\Local\Temp\Pedido de anulação não solicitado.eml"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:312

C:\Windows\SysWOW64\prevhost.exe
C:\Windows\SysWOW64\prevhost.exe {DC6EFB56-9CFA-464D-8880-44885D7DC193} -Embedding
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" /b /id 4040_1150511897 /if pdfshell_prev161b80fc-803b-4c62-ae79-392eb2c56f11
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer /prefetch:1 /b /id 4040_1150511897 /if pdfshell_prev161b80fc-803b-4c62-ae79-392eb2c56f11
    3⤵
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Documents\WiZink Pedido Adesão – Anulação.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=22F4EC75706BD89DA55231D325C60B78 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3000
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=37FB2F02A7AA2C737D12CC221F0F1711 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=37FB2F02A7AA2C737D12CC221F0F1711 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2136
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AF88481DC742C2B26FA4D8E31E3ADD1A --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4512
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6FC48D23F0A95418B22AF73244681064 --mojo-platform-channel-handle=1960 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3180
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2BFF2FBC4673F0A0AC2C1ED9234D7E9D --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 c366d00e585d861150cc42b9043b672c41b013785b2cf4daec034331cfb7d919
MD5 0f800745b4f8724be1ed67412a65900c
SHA1 17c302ff453dc155759a79ff7d1c0030e8277719
SHA512 9f84ac79f616dcc8849fbc0a62b9cbef83bfde707fe7afc5c6a88393791f65d750a828055d5bc309650333572e4af1460a9b0a237f83f963b43b2c6101c08c75
SSDEEP 384:yeCdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:p+eUZsLQCZsL3hUS4
TLSH
T1F053CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiZink Pedido Adesão Anulação.pdf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\Y2CV88LE\WiZink Pedido Adesão Anulação.pdf
Size 53KB
SHA256 917268860e5f12822901007c1370746f78ce76c0e3f6de684538d1479c47e57e
MD5 39e3894e416622066eab8b51c463bcb5
SHA1 4382167ceb9675225bc7552f10f9c56d77398475
SHA512 91bcf569636f464b166f0c02d513f2ec32f6685c57e91b5381e64eca0bda71cc4aa95d88d50d8b1b6d8063788b389729d61709970aa1fb3b2d756a17ccbd81b5
SSDEEP 1536:PoGuVA3AVSq5XJ+MCsTDsfQNsnHyLM1ObNRlVtF:huVVN5XJkscfEhnrF
TLSH
T13C3301C9D237CD1CEC81E07C5AC3BB1158D9763A91D5B99D60E98FEB10A1A68C211FE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blank[1].png

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\8JFAT3IH\blank[1].png
Size 68B
SHA256 f0af11365d861eb4fd6a247f24eb038f58ca874db1ff3386f3a811a7d99589c7
MD5 8688d783696d6efc851cd4de3e2570d0
SHA1 15ac67d1f3ef937eba452c98f2296fcac1366672
SHA512 bba9039f2cbbe5739f4687ac5c1a88d31a5ff1f4899945b198d8af8b0200ade16986fad8ade96f2c81f17c7b91351433b55e8df12685039cf8174de286c0f88c
TLSH
T177A002D273909D7DD68E8133C6140250F971525B06110D6C0446F5256D636A99588693
MD5 SHA1 SHA512 TLSH

Submit Download

ES_session_store

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store
Size 10KB
SHA256 960f92c801d4649a70c3ddb59b47750ac3f4ab86c33d9fbec50dfd8a3b7e3cd1
MD5 8d7beffc7ee74458e61adab00a0479de
SHA1 7a6e8ba00d8b1257eee21f368ae14425c6e395c1
SHA512 91dd5abc60e4e12902470f9974ec9e6d9807f178f4483d4e939a08546253f0604a98b398da488696dda98121c7230b08858c927f751d9c470d8a1723d59f5450
SSDEEP 12:jUZ+GHCAAxUj6KLtKa78RDeYxVtasNM2oKfrkX8Rl:M+VAx6KL97847K6lM
TLSH
T102224191B893B298EEC94C75252C582870FA65C0227ABD2EC2008D50AADAAC630D0933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ES_session_storei

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei
Size 23KB
SHA256 dad6e61acee1da526a710f1736212e433217c6bcb6b9391ee9f1c004981aedb0
MD5 96476049e2826bd00461c3136aec6db2
SHA1 a268088a87d9ef93d31178bda07b90fea0e0bcec
SHA512 ba7a6c202e40e1385b2af2ba9db1a3318066b9665c7e1102b451a5cd7a4f105e1fdba45a7661daaca68dd9da7481c598cd37071a6037d774f8aa15baf8931cbc
SSDEEP 24:eDTKmngZ650xUcKVfq54uM67KpMtDvtC5O0akUKn2sFww6NDjHQzBjs7:efngoqxbDFx79VvIY0aXK1Fw1nMBY
TLSH
T181B2E64351C47C5CC30E29F50551347B97A13B1DBC896483AD544842C78DE8BE98F311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiZink Pedido Adesão – Anulação.pdf:Zone.Identifier

Path C:\Users\Admin\Documents\WiZink Pedido Adesão – Anulação.pdf:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

memory/312-12-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-65-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-6-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-13-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-1-0x00007FF8B848D000-0x00007FF8B848E000-memory.dmp

Download

memory/312-11-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-14-0x00007FF875BC0000-0x00007FF875BD0000-memory.dmp

Download

memory/312-15-0x00007FF875BC0000-0x00007FF875BD0000-memory.dmp

Download

memory/312-10-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-9-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-66-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-67-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-7-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-8-0x00007FF8B83F0000-0x00007FF8B85E5000-memory.dmp

Download

memory/312-3-0x00007FF878470000-0x00007FF878480000-memory.dmp

Download

memory/312-5-0x00007FF878470000-0x00007FF878480000-memory.dmp

Download

memory/312-4-0x00007FF878470000-0x00007FF878480000-memory.dmp

Download

memory/312-2-0x00007FF878470000-0x00007FF878480000-memory.dmp

Download

memory/312-0-0x00007FF878470000-0x00007FF878480000-memory.dmp

Download