Windows Analysis Report
Alejandro Garrido.pdf

Overview

General Information

Sample name:	Alejandro Garrido.pdf
Analysis ID:	1579363
MD5:	6fcc481c398275f4ce4e09111dcb3267
SHA1:	618c3c41ef2bf3a425a2a93b82472c2594c4303c
SHA256:	141796b0b44e3d608ef171d9e2978f2eda412c8bf75801a5284737bf24a3d212
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/50@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-21 17-57-36-999.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Alejandro Garrido.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1744,i,6040898802560817988,17395833604069419443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2116 --field-trial-handle=1744,i,6040898802560817988,17395833604069419443,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Alejandro Garrido.pdf	Initial sample: PDF keyword /JS count = 0
Source: Alejandro Garrido.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A910mthvh_rk3d9p_5qg.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A910mthvh_rk3d9p_5qg.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Alejandro Garrido.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Alejandro Garrido.pdf

Initial sample: PDF keyword obj count = 95

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
x1.i.lencr.org	unknown	unknown

ID:	1579363
Product:	CloudBasic
Start time:	23:56:41
Start date:	21.12.2024
Sample:	Alejandro Garrido.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	6fcc481c398275f4ce4e09111dcb3267
SHA1:	618c3c41ef2bf3a425a2a93b82472c2594c4303c
SHA256:	141796b0b44e3d608ef171d9e2978f2eda412c8bf75801a5284737bf24a3d212
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	92587FA4BEC8EAC808C395F0A2E5FBD4	8664F5A49F590F63296873E4886347D25FBFF3D9	0EF072CF8A37A50C9087F72CA33D04763A3EE956BBB02D1368B3DE7959503BA4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	92587FA4BEC8EAC808C395F0A2E5FBD4	8664F5A49F590F63296873E4886347D25FBFF3D9	0EF072CF8A37A50C9087F72CA33D04763A3EE956BBB02D1368B3DE7959503BA4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	06AFFF8307E06FD33F4AF7B40E94AD85	2AD101FE83CBBE2C7ADB721D0EB4324C4D1BD6EB	86B4E7DB161B8A230A5E24A2A63EA0B66C6E9A5D9E7A639DE049F3F33D3A0897
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	06AFFF8307E06FD33F4AF7B40E94AD85	2AD101FE83CBBE2C7ADB721D0EB4324C4D1BD6EB	86B4E7DB161B8A230A5E24A2A63EA0B66C6E9A5D9E7A639DE049F3F33D3A0897
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\9b960b16-a398-4a34-8491-336ddf17e0bd.tmp	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF6b408b.TMP (copy)	JSON data	B7761633048D74E3C02F61AD04E00147	72A2D446DF757BAEA2C7A58C050925976E4C9372	1A468796D744FCA806D1F828C07E0064AB6A1FA0E31DA3A403F12B9B89868B67
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\efa74e5d-64dd-4cf7-b1fa-931ee4b88930.tmp	JSON data	0AF3C31E142EE67979B8829EB0C45D28	4EEF48F1C682723B3B2680C3BE3689A161A54B87	CDCF2F662C6F2DA2BA63D5F268283E087B4870DAB030CD991C73733CFB414E2E
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	8C1D713DAFEF1E94A8A99D643FB701BF	3799549F0BB72E26D8428A8BAD920B05989A3C44	504C637C14927972F648F331875357952A9B526BF6B6D2B767A80D6780C23A6F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	BE680FADE70D9546FE8F3F617AB1BD5D	6D0017A12DC88833BD3BB3E4FB7A6A17AE0B1F25	9627724CC3121D0D6555F5D696C98A3CD41E2007E6DE8DBA49CD7C85BFB759BC
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	BE680FADE70D9546FE8F3F617AB1BD5D	6D0017A12DC88833BD3BB3E4FB7A6A17AE0B1F25	9627724CC3121D0D6555F5D696C98A3CD41E2007E6DE8DBA49CD7C85BFB759BC
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241221225738Z-157.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	601B64D1CF1C327BAE52CF00874130A2	A3C4FB7B4CEB76E5B2FDFA8E0341E6C37898F2EA	1DC8D670D56AC87B07D0590C9905FD6FBC694DED50B9BAA40D277D34A8C00D1B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	8198594E223DD7BD7C67615FD301DF3A	B394EC8766597993BCC340351B42E27EC7CFBE64	38495AAFA77C6A91AE195CD8CEDDA19014CE25240F8A439FEA62ADD338377EFD
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	BE38317FFBE86B83CAED69915B9FA247	1EC154BB7CC44172A3CE87B16B985A0746AAE274	766DB174F4880AC51B831B39381D6B1374178463B2F3ED7C0F5B5D74F2B1F13E
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	4717E00FC1A31C4A24088044D343537C	77D64AC46BEEDAE2C0AE1FDB2CE49EE882CA990E	C066486E447B0B6E167B453B35A51C4E9E2D86A3F120262CD73BEB42DC599139
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	76861C344FA1C8B2000D5B4465322221	8024FA88C9CAA36981BF085D7990C36DFA62E10A	E29906269B44551C8EEB9CA0A7AB0CF2F9FAF398477304763ABC980D75DF7B96
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt23.lst.7432	PostScript document text	B60EE534029885BD6DECA42D1263BDC0	4E801BA6CA503BDAE7E54B7DB65BE641F7C23375	B5F094EFF25215E6C35C46253BA4BB375BC29D055A3E90E08F66A6FDA1C35856
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	09B99484033DD722886FD2A3D2D8DA9E	ED4C5742C00E6AD410364FE18E1A611ADED8F17D	D556A55CFBD4582D703A8614F92BD3BC827CA126E6C1698D0F7BBEE582F3AE52
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	AD2EFC4D2567A4CED45437A91058CF4B	998F0871F13A566B8621ED149D7DB0DCD928AF0D	BF66176972D4A75EAFC7487605833D810C53A955350663F5AFB4B51330F3DE29
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	B667CD10944CA93A71A26B9DC6BBFAAD	B169AF69C6DD419E39BDDDBA43879B9201FE0A13	B95C4A23001113550EE50E6A6779E14E4C8F55E9B6F7BFD086CC1A0CA6BB6BD6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	53BCD9E89F07DE4125F922B97AFAE8F8	709C91DD699FF0E8C16EA2E59A04D49DB4C07B88	AAC1D5C377DE7336C3ADE427945EC18F92CF54744335561D597A5935FCD02EEA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	AD36DA49BA43EC0AA0B5066720CE1B42	BBEBAF574424895432761C4804FE882F9E7A69D5	033A5824CCD83A6CDC32BE8CEE11BE43895C2127C27B16F144DDFAE429BAD079
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	EB565E5EEBCB16B246D27DE36AD9AC80	4748263438224D7D031C687D00F7360A4EA4305C	EC3DEFE00D2BA1D76CC76DC9E4154E58AA9E5DD7B134A2CEED7B501DD12EDEDA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	1B3DE28A3F50C114891456C7347A39ED	2FADAF4B4AEEB671026B3A76DE06EE8E51B383E4	4B8AFEC1878B42EA5F07375B54F4C540F58FC487D0CA6CD331BA056206C445FC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	B963EF86AD5C7DE53DFE8E6214F41070	B1D8261D6A2DDDE7AA1A4D18072BDEA038A8DD49	07B5E248A786EF7D4E1A35DF55212DC0DD8A16B58822CE3BDE18F565A6C43E5D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	37D42001BAA8FC0AFA912EC1B5095C3F	074EA5D262F86B4A2999D8137B0DD7BEBA3B8E00	EEF8719F219F4883BBCBB8F6D458419B3643583E86EA9D07A4DE5EEAD386EAC3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	3C36F5371DA5BCE9A7158C81C0C08B60	3F168AF3DF2F66361F4E882B465ADE23E6D186CE	E0CD981B84AA0328030A727B1A9C6176CB0910D35BA8D8058A6A5313A6EA56D7
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	2F3962684A9796722108E93B9FE4CFE9	80F122C6E917773341A8414CBC97172B8F8563CF	F186C77D5535BEBBE82E0C9BB221CA953A48A42FC772BAE90E602A0C8A558600
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	A42B1D4D3402E6E48170CB3A20799075	78ED6E0B6780396FA7204F89FE12C1C51752D2A9	BB44A0059296B85C473881F4192EA8790BFC74767C24BA78B01BCFC73119BC8B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	93627F9AF871FB6273B90C395B316B57	A1ED0B772F2497C5F8B47665BF59D7F2FE2F3E97	92BD28D6A1E1D8DCD65EB8F14B825665540C9C3EF36DAF2FE2267B3172892469
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	F9E56FC8DDB2E2EEB38AEBCD1CDACEE6	057415593D11F5DB84961F23E828E765FA3DB208	2B770BB401A26C61A0A192038D5B13630CA37A99D3D018D52B31FEFCE77E6294
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	914BF1AA6D159D55A752D76E9EC23541	26FB8A56F333B28BEA874918E8EE726BA8C88356	4109E3F1741BA3D0377F4A20CA625551083C26888C54B690F1782885B74D8260
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	29CC2A4B8948883BFEC2B58377DFE7CB	8FA48AC7E1262FCFA8D5C49C393738A35302E84A	854F2F667D370144C325C24953B79BF200A60B0E878BC92DA8BEA00CC9288DB9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	94F48A1CE2EDC1CE47A5205FE687A940	9CBE34285B91C4531E430AA1CA24E2DE4A4988EB	E44C2CCD0F8DD7080F1CB1AB501AED4825ABD1BCDF6CF50B4D1BB1C42FF4BAE2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	4AF4AA1AFA2C290FFC878E2FF18D07BC	FA09404D2A6596726846B03829F9561C175415D8	0E3C4E75FA5489D0ED664D40C1D6F5317021C2862BDED53A689A19E9238C0E6D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	2E6F52EE1CE3C65346637C79A6B67F58	C425E6684E1AC299C7D7258044F2B39CF145230E	15A0021734A3D76F538D3DC87ED400F5F72F3BAAB673058B47ED8BD9BC8D85AE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	A3804F163EC0D53D6AA6B79C668D16C2	445BE63419C2963BA48A20E8FE11553762173B48	676CCA0EC2E87DC001BB6DF382ACBF089F599DD15F75C9EEDEF0F49DA44BFBF1
C:\Users\user\AppData\Local\Temp\MSIb02f5.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	31B43D2D3D6C8CF581FC0DEA6FB208DE	9894C941C8F4F5C2996D852D3147A7CD087D4249	064EFF28613DA7D1AA132668847652FE165A80B091F75661BF15B7DDA7E29922
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A910mthvh_rk3d9p_5qg.tmp	PDF document, version 1.6, 0 pages	693C38103064AF8D887EC04423A1A4B7	2E3D4759295E52DA482C396AD2FF8595A78880AD	FD8AE052BEF5CE65276F724A537504E2857E48CBF4925A106F456EB18FF37596
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-12-21 17-57-36-999.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	E9533743BBBF51A889EADB0F29447075	EB9726608A9F805075B2AB24375588CCEF1B7CC7	E88CB464AEE474895BC2F0B40EB54A0F67CCBB9DF4A9227C25C6D96F36C2D0C3
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	4C462B34F4B4D8C759D49D680C60CC82	AC530B81BDD3A71CED13DAC8A738390A958B77F0	D7CAF8EAEBD00F03DB1E02FA7D52C672FF4F9B093990309640984597E718F76E
C:\Users\user\AppData\Local\Temp\acrocef_low\930854ac-9282-42ad-8f4d-ddb42d449ac5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\a9aa0c15-f286-4131-9138-8edd47a9a56c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\b749b831-7756-471c-9209-ad72a1a60db5.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\c646e222-e86a-40fc-8e9a-fe8c427a831f.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4

Windows Analysis Report
Alejandro Garrido.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Alejandro Garrido.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Alejandro Garrido.pdf