Windows Analysis Report
letter_Request in criminal matter no 23233051091.pdf

Overview

General Information

Sample name:	letter_Request in criminal matter no 23233051091.pdf
Analysis ID:	1467808
MD5:	02cf359bd3267133e2d5ea76f264eb31
SHA1:	230c1593e7f76fc0e05be2c18e7f5579fc373d43
SHA256:	71ad13ec19dc09f68b2f13ef02ef5462a6ad461ef0417b6bec1267479d0fdf71
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

IP address seen in connection with other malware

Classification

Signatures

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.200.196.138 23.200.196.138

Source: E0F5C59F9FA661F6F4C50B87FEF3A15A0.1.dr	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c
Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: letter_Request in criminal matter no 23233051091.pdf	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: letter_Request in criminal matter no 23233051091.pdf	String found in binary or memory: http://www.color.org)

Source: classification engine

Classification label: clean0.winPDF@14/49@0/2

Source: letter_Request in criminal matter no 23233051091.pdf

Initial sample: http://www.color.org

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7568

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-04 13-52-31-969.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\letter_Request in criminal matter no 23233051091.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,16326239885150777202,8947239153147788887,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1736,i,16326239885150777202,8947239153147788887,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: letter_Request in criminal matter no 23233051091.pdf	Initial sample: PDF keyword /JS count = 0
Source: letter_Request in criminal matter no 23233051091.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: letter_Request in criminal matter no 23233051091.pdf

Initial sample: PDF keyword /JBIG2Decode count = 16

Source: letter_Request in criminal matter no 23233051091.pdf

Initial sample: PDF keyword stream count = 23

Source: letter_Request in criminal matter no 23233051091.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
23.223.209.217	unknown	United States		16625	AKAMAI-ASUS	false
23.200.196.138	unknown	United States		2860	NOS_COMUNICACOESPT	false

ID:	1467808
Product:	CloudBasic
Start time:	19:51:39
Start date:	04.07.2024
Sample:	letter_Request in criminal matter no 23233051091.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	02cf359bd3267133e2d5ea76f264eb31
SHA1:	230c1593e7f76fc0e05be2c18e7f5579fc373d43
SHA256:	71ad13ec19dc09f68b2f13ef02ef5462a6ad461ef0417b6bec1267479d0fdf71
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	7A89B1A4DFF88E3CF82CDB11E6A25F1E	8203E076F6B9DD58524CE6219130E679001D2937	B763D414BF2A8471974A4F2039F50D6C82921029680966D5A9F2EFED68973981
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	7A89B1A4DFF88E3CF82CDB11E6A25F1E	8203E076F6B9DD58524CE6219130E679001D2937	B763D414BF2A8471974A4F2039F50D6C82921029680966D5A9F2EFED68973981
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	144EFDD57AADDFBB68670951DF8290BD	17DED82B33784B6D0979C7CCBB8506DC6A53C2F1	72C0F9ED002996062AD797127DAD9C81811CBAEDFA343C6B5060BAC9BB9B11DA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	144EFDD57AADDFBB68670951DF8290BD	17DED82B33784B6D0979C7CCBB8506DC6A53C2F1	72C0F9ED002996062AD797127DAD9C81811CBAEDFA343C6B5060BAC9BB9B11DA
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	896E4A066285568C926C4B7B5BC53EDF	8E9521F96F4E78D26A90771D8E175D324ED20540	52DCEFC49BC56035BF93BB8359AF33CB3C4A5A1A11A00B38F60766BD3DB62216
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\cd7e82b2-5389-49b1-9412-ee040d0300aa.tmp	JSON data	896E4A066285568C926C4B7B5BC53EDF	8E9521F96F4E78D26A90771D8E175D324ED20540	52DCEFC49BC56035BF93BB8359AF33CB3C4A5A1A11A00B38F60766BD3DB62216
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	48D35717467D2446318C5AB92E6E2386	725540D7660A4B99CDF46D705CD0B09727614FD0	4DBC3D4F8157209DBA7EB3D2ACE88E815B7A61389324EB896AEE736F129C8DE5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	145511AA82FFB0FDB87F7AD397D5C432	FDF10D963CB95887763DAAF18E2878107E4340FC	430385774DD5ABF89864AB435C0F0670D9F0B48A56F7FAEDE064EAB23B0CEE80
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	145511AA82FFB0FDB87F7AD397D5C432	FDF10D963CB95887763DAAF18E2878107E4340FC	430385774DD5ABF89864AB435C0F0670D9F0B48A56F7FAEDE064EAB23B0CEE80
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240704175233Z-152.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	5F15EA9D46D26EC5DF4E67AFC7FBC09E	9036EFE3D2D81C218FE8BDAE3539B52C02CC8BB4	421F858D5CFBAB192418048E522137E3537C7A829E542B3E22CAC7BF2453A4F3
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	7F69676A726A2AA1C8FEC4AAE557BB60	D46AA1596B72CF5740989B526BDD7BAD928F6534	50AF6CCCC56E0B66C33BA430D99CBFC7B75AA94AE3EB7FFA0B45E94D3D8EC763
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	6E673C334C8827C5E6F7B7AE2062F36D	9C4002E82092368A610B667D8F64FA4DB6E37DB4	19B8D63F9141134A621C5AE9549D98B2CA826A990EFB9C86EED88B5CE4F0075D
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	8DD397900EF5DD03F7C146621F3CACA4	972626659B0432BEF2307E0ECC51605F0400E9EE	3DEC84AE3E4BB42778D1819C712D8C6D482B3BD6C4782362CCA75FBC2443F69B
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	563687D60BA85378C94668CEE31B5993	874B4DE69887E0F79A4372521C4076616EAABE28	18F637CAF1FE174A021FB05F14C6AB4EF865EA71B84352FD753ABF8921370946
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7568	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	3B0C1D0A6526B3B2A681CB5090EBE4CE	885A1571576C81F54C8213D27FBA83A66EA83116	32B87C3F0CD7012EFEAFC0937DF6018498C0B6054DBF56C8BF55BB6762DF635B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	1E37F53B84A98E9AF6AB016E1F3D4B51	9732CC66B4AB1BF0EA0C97F4A8A8BD2C7D3E1201	8F1DFF51C5A040401C4020C806C39928FF87F14D15E5FADBA14328921A0D53CA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	462205EE971A9912B0CDE3EC45A09D74	E01FA89862EF82CB8AF3D21B61166BD135155FC9	AE98C255D278DDD0AF9E045B5E371AA910DC0A0937A48F0D8FF369D4574C896A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	3C6D1EBE05B42E08AA555D22F0943E7E	F60C1DB852402CBAC58A6841F815FDB457B5069D	852DF22C814756D52AE7A3FEA58F6DF94BE17089DE6EE8F202AC783915264C47
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	B08500144699BE2B5D851F1FB9897D60	996F65D7027C61851C3CF2A01D3A2D7DE85FC216	0F665C9329EA0AFE4A5C52F57788D9D7A08BFB71346572B7D5F3324B1CAA17F0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	94D97BDDEC9D29EEF8E2A8A5D7DB4D1B	983B34D7BB90FDEE905804DD48CFDD3F12BD9A66	D436597D34A982BF4C27A92DD0028DD3CD67985AA4D70BBFC6FD9542E5E219FD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	4DBC2DB633BD6F06ADA82FDAC892B8AB	D31AD81C4DCA5C2EE6E1844E9703E84B2D8688B8	61F13EC3AA4C77CF192D20C5A3884983CA3D17805C07EC99B550FF72B2DC99A9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	DE341380C6B89333480BE7053AD5AFBD	01F0D96791BE131BB58D0516722A3777976C60B8	792086E5954CCF8E53E26FADFE36735E1B3916B0080B07A13A845A7A80206062
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	2F681F4A6532A8DC0ACB4845B30D5233	36AE62DE46FC65052E35F4577232A06D3859A21F	0E643F48C21242021F4CBDD9B824CA0428F0880FA7A34B78FEC148DF8FBEF390
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	7B984D0C2207A281F854EE948C92C71B	FE519C72E6EA59FAACBF467DA0022ECDE2E0A803	FD36B0083396F0866A9C412C0C13149DD590CDF626259E7771516FA68B668FA0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	CB769BDF93699072065A0A4D963AE385	EFBA74D01BF75FAC2244F02CBC6C4DC3E1E3C813	368B85353C6AEC37874D9B3EB59F8664FB528BF59FF51EE3D938616FD3EEBBF2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	192DC42CF8F01EEA6A0596D30A623E17	8858D636308F9981992DC931FA9755991A7BADB0	960013EDA45328C4937FE04AB0F080067CBAF9F8437B7A38AE4CC59C8483234A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	E97055A5A686AF7BCB54484BB2E9126D	632A9B60EC4E43685C0C2FF64B549D50F9B75365	7710164303C253F62E186F00A71AE29C890D5963772A0199027107FBC157EE85
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	F87EC62A4FADC08E512078A8047FE71B	10ED347278E458B1ACD64B08D7CC1ACEDC314E81	118CE8F1D8DC20E91EB103D9C4F4D284C889BD17E8A438D4E60C668BCF19076C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	161613D655E2EC7382E1C73C77E2627F	F4C6799E10AB870A32CE3EEB45093F700A467718	4E4298F1DFE8ADF3E8B7F23E830773D3C64675D1C4C03410DE6C1502FA95093F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	667D9C5314144A7EE3C910EF21553DFF	F6C28489B7137C29210DFE5CF472361FA1413281	307142AB28E2A816F7F0059EC082447CC0B3B86C36D8DBC9EDD5BB53C69EC397
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	B3A7F0F34F232F450385755B5999D32A	E52BA19192CA2725AA5CB476BDCEC688B2F051B8	F1748FEDC2B51AC89EF4080EAD7421D489F9A9EB0F7E0DB3E38584DA1FA48FC4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	07136C07300696A7B863650952362902	EA27F4107D1F625334CB9DF5D049540AB829A6BF	FFED483F2C5A06A1B68164EDB14302E97F745C4AC6AF62E61704AE6E980292AA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	C0E9DDE8F74B12B8FF8ABCB68C74BEA7	3DA83F8A04AEEB1FF575380021E1CEE108E16F48	3BEED56ACE1E49545A352AE9D91BF15FC614D57402AC58E43EEA423674BFE00A
C:\Users\user\AppData\Local\Temp\MSI24305.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	774F8FCC99DC61522D633FC148384EF7	66FF86D815747A2FF066FBEB29121D581A2F1829	F0175B2FDA92794A2E8AD04AC60EC912F3A8B000DE3B4D765BBE9435B9084825
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A916fbfnf_oedeph_5u8.tmp	Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)	997CE5ED3633E8FF84C2F7D1F0E48E53	D22617BDF6D8DCE13E5FCBE9BDD57A812EE1E237	E06C221FB5B43F5A25220D326EB501573C2E0CC9FBB31007BF79054B6F613907
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-04 13-52-31-969.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	37DA86B5F7865F5369C4BFE9CA71C2C5	88E61344985386D21484DF9DA1518EDB6CCFD2AC	2DF9E644D4D3F9B4101D01255E080386496658DA1699B8B6562D0D3638AF6EFC
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	52C4AE33CEBDC952682DA14CED93D596	3512BFB7E9433F7530C1A867C238EC152072D8E3	496FB4463AD990727DD6B77F4D607D58B93D43DA3A0A3A88E869199CE4A38752
C:\Users\user\AppData\Local\Temp\acrocef_low\0d339d7f-5e1b-478f-b4f1-def733ba3829.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\762810f4-f16e-4c3c-ba13-45268d4fbfb6.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\db04e0f9-683a-4666-8a43-ecb4abcdc805.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\e8fd05f1-373e-4de3-be20-681d0fc31256.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	B7A9A5A223B9DCE0E7D10E2B32A0BA07	FFB925FA80873CF50D8CB6DA530BA8CD7F0D9922	4EF52E63D45F5230C47DBD3764AA90768F708B24885579375724473BB3FFB255
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	152F65AAA856C44E87C8ED561AE43C0F	B6440383DBC4D3446E91CBB58EEB8C8BD6671F50	48AC59FC9FA38016B6D5A4CB5D89A2C0CABCD8A0404AF29FBE995B4AA647A292

Windows Analysis Report
letter_Request in criminal matter no 23233051091.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report letter_Request in criminal matter no 23233051091.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Windows Analysis Report
letter_Request in criminal matter no 23233051091.pdf