Windows Analysis Report
JUDICIAL NOTICE OF TREATY.pdf

Overview

General Information

Sample name:	JUDICIAL NOTICE OF TREATY.pdf
Analysis ID:	1467208
MD5:	0a36fc5c818ad768426226763214aaa8
SHA1:	e0ac674b92868921e04ddc4c500bf556243f757c
SHA256:	9ff705c4f0c68febe7b956bae76b3c143a000c127d056d8b1980f7a55bcf4610

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Classification

Signatures

Potential document exploit detected (performs HTTP gets)

Source: global traffic	TCP traffic: 192.168.2.16:62627 -> 23.223.209.213:443
Source: global traffic	TCP traffic: 192.168.2.16:62627 -> 23.223.209.213:443
Source: global traffic	TCP traffic: 192.168.2.16:62627 -> 23.223.209.213:443

Potential document exploit detected (unknown TCP traffic)

Source: global traffic	TCP traffic: 192.168.2.16:62627 -> 23.223.209.213:443
Source: global traffic	TCP traffic: 23.223.209.213:443 -> 192.168.2.16:62627
Source: global traffic	TCP traffic: 192.168.2.16:62627 -> 23.223.209.213:443
Source: global traffic	TCP traffic: 192.168.2.16:62627 -> 23.223.209.213:443
Source: global traffic	TCP traffic: 23.223.209.213:443 -> 192.168.2.16:62627

Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.209.213
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.209.213
Source: unknown	TCP traffic detected without corresponding DNS query: 23.223.209.213

Source: unknown	Network traffic detected: HTTP traffic on port 62627 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62627

Source: classification engine

Classification label: clean1.winPDF@17/48@0/60

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\blob_storage\e4dc7437-de55-4e5f-9140-63e9081d717a

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

File created: C:\Users\user\AppData\Local\Temp\acrocef_low\fe5c8ec2-ff5c-43d8-b629-8368f3a540eb.tmp

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\JUDICIAL NOTICE OF TREATY.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=1568,i,16156778970679183670,2186025552337583250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2240 --field-trial-handle=1568,i,16156778970679183670,2186025552337583250,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\System32\msiexec.exe C:\Windows\System32\MsiExec.exe -Embedding E1F7F6A047E541ADFCF855522DC582DD
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: JUDICIAL NOTICE OF TREATY.pdf	Initial sample: PDF keyword /JS count = 0
Source: JUDICIAL NOTICE OF TREATY.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: JUDICIAL NOTICE OF TREATY.pdf

Initial sample: PDF keyword stream count = 26

Source: JUDICIAL NOTICE OF TREATY.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
3.219.243.226	unknown	United States	14618	AMAZON-AESUS	false
23.223.209.213	unknown	United States	16625	AKAMAI-ASUS	false
2.16.241.13	unknown	European Union	20940	AKAMAI-ASN1EU	false
217.20.57.21	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	Denmark	15516	DK-DANSKKABELTVDK	false
2.19.244.159	unknown	European Union	16625	AKAMAI-ASUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

Contacted Domains

Name	IP	Active
edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	217.20.57.21	true

ID:	1467208
Product:	CloudBasic
Start time:	21:10:51
Start date:	03.07.2024
Sample:	JUDICIAL NOTICE OF TREATY.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	0a36fc5c818ad768426226763214aaa8
SHA1:	e0ac674b92868921e04ddc4c500bf556243f757c
SHA256:	9ff705c4f0c68febe7b956bae76b3c143a000c127d056d8b1980f7a55bcf4610
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	94E8D6A365B1652BF046AA17A1361DEF	864F0973FECF5D57955596CFA9FBD1336AF35CE4	51572B9A9D85E17B4A8E39C02FA31799503941E41ABA407169F7C065BF804E0A
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	80142FC882C4CE0D83CC8EEC4C526DAB	C439EA5019346FA0ABD5DB49002271F6EDCEBEEE	B8DA4E4D80253AED61719425CED25E3E13C21FF722ED46A0925A6728DBA82969
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\8c11247f-8522-4373-bc9a-fa0dcab0b25b.tmp	JSON data	6A249B3CDCFB1937F4B9BE6268564A10	2FA29F2B3C650E8266FE383DF9F7B71A02F50E57	F1551B1D06600A2C86948F026E60EC5E95BAE7AE2D5837559394A98B3E0B6370
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF531e42.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ed55821b-48ed-4f06-b061-4ae6666ebde0.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	631FED17F3214DAD86B4D638A675A3CC	8BD7378C07466FB798808DDF9669C0FFA5501E8F	8A438AA5C60A255A7921C4C21094BE8DE2E5F25F742CF493B6D5BD27DA537634
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	A1B1750AF5CBA9AF249AF3AD4242F39B	BC883C4CD43D6E6F081B2E5ED686C49E63CBCC41	181070E638F1F5E76E55EAAE4DA67989A29D6CBC78CC1EB28C7DF4B2AFACD0CB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240703191131Z-163.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	A17F19BD0E459F7E1065088F9AC7EF55	4F08C04BA5B60E787ACB8E54437B3DCF32EA480B	F60B5B2BE80E9AA5668B0D979CCF61F25A9E6667B66424C0E56DB7F60C0573D7
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 4, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 4	CDEEAE920A0C8E743B64CAC9528C4A13	2766D56FDCAA7BC558487228C2F6B36ED25CE336	E9E09DA9E3F2716808DFDE828E18D295AF95311537397AB9D8755E0D34221128
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	94492E9A81081AAC9D01D34C04A0830F	4F86D1645129FB320A844E4813E43012C21EC0F3	6FE86F702C6E4A3CD20071970B9E2F39EA6AB42277F8F6FF8F6AA1F153A1D7A5
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	D4AE187B4574036C2D76B6DF8A8C1A30	B06F409FA14BAB33CBAF4A37811B8740B624D9E5	A2CE3A0FA7D2A833D1801E01EC48E35B70D84F3467CC9F8FAB370386E13879C7
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	50C5141B9D511511C93472F2A2893F37	BD16FF22C06EB81F4CA3C2BC6CB5FAA3A4F503B1	7B3B63850FA4D45410AE9B78044539C927432603DBB846C7ED4B62D60019658F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0F5C59F9FA661F6F4C50B87FEF3A15A	data	E3CEE20910B6B5BDDA2093DE330831A5	4B70377536D43E8A584F45A844774A062F5C3805	FDBEE11A9941D61AA64DE343B077BC557C0C9D6E68C75D0DAFD1F43B3845DE92
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.6208	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	41624DB51D3F8E9A9C4469B23699B7CC	7BEA7E64C604B05E33A38F18F2D7CAF2AA5E7E45	FEA33CD6FBAF03690814693E291C6BB9E84DBE03A7ACA7D82F73BD8DBD6B81DB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	8402588F3B348A230B4A4B43F60286AA	9BD2F8E031C2B3C1312E821C5A3BF395B6DE0EFF	595FB35A2DE8352DBA8ECDD40F444989FC0E01FCA286B00752F66D990A0F9902
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	EE28959F5865055EFDE432FF87128E83	52D8C139C0B70660337312B624611DB6A9D6B14D	C86A4B17055AF51E09F1633E41F44CAC1B0FEBAEEF555BE9E5E05E0F4E9364DE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	0B419612560B2ECDD33ECC7B3A2FA591	C0A02CA07F461B6613D3483703A2CE82EBAB6AAA	C7BF2513A58DF930377411275E561FEEB4268C228C5E1B4AC178FCE38C938765
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	421536ECE15D36EBF54D136290EC2295	27DBD6537D6EDE7B9A5560CC5777A5FBBD6017C6	63F6ADC6ED5081433C87FBF9187A3346B6580B2665C28E7430F0A2A52B2F79B0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	C42FC682347C411B971115B7E73255F4	051C67189FE22ED6A54F17904B6E49BEF38E7CED	B92F71D3B13E233DD7255A3EDF478F927685C8D960F9045CB61F3169B3F357D6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	1BD3720CA3E6C5834E9FA265C196BD94	5B1E63347DCE10114A402D59EBA92F3FD6AD13F8	6F81232FBC78E5909F88EF4DDE378E14BC38196FF49581DFB66521ECCD49F290
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	55B8422E95743A60C8154D4EA722B8FA	48827A30FDBD4ED3BCD650A0507CCE9218486AB9	86E65C5FD203099222C33DD50B72BD947AF303B8CDC070791727E58DA228078B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	4069553FB5337C663BC13F3A903049D2	73F39EF986AB4FB688E8AD07562AA70AE793B044	9EF1F151AEF7CE116D6C7DF8C176DA036840D30A125BB95371D8C59CB806312B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	F89B3B2D03D2F91E97059C8FAACDF26F	24F4253A1CD21D572C3BC787CAFC1DB9AEC4F265	D809CD3B6C7710D7DE12D17D831975D538A4468EFFD2F156646AAF2C2D038622
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	7AE3F885E3E0667333103CF6EEBB9F9D	672CE02086CBCE1D17A8E4DD2F567680F39CCCCD	074BAD1A69B5819B7E4A1178C239151D85BA60C86555EA313F767420F43EBCBC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	114C4F734E301206E3F7F8BA43AD0D11	ADCE11A0156169B6D37E970B3B9CBC81B85E5258	459030D2637189DF457AD1DF98335B31C3805FC44233A415EE6454B2819E5F88
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	0EC2097C2F1F00C85C5F183FE4D250ED	75578BB9858FF589A819B57F7F72D3167422BA9D	94696810D6D3794F52904FF885412DD9E2008CD25550139954686B6283F38B62
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	55DE36515DEB4D32811BB0219C44187B	DF79871AF96F0A40E17EA10D606628D5C6270E39	7C9559820733B41947AE8A120DBBFEE12AFFFCEF2BEAD411082813FC536E7511
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	EEB62ADE2D3C0833A0622BCD313D9BC6	A05C4E1071CD64AE359777F42D52AD6ED85AE94B	C81FA1B32E26AD2E04AEBC06105360E4A3520C0F367A12219CD0403B21F02DC9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	345DDE6F642714A581989CFC4727A885	37920F70959399CFF4F656774B65D1486E0FC96F	DAF8E5AD214B12E1881212FA5B4EF36414FEAD165910BF07926669B8E637B5D5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	52B6F8429024DD95E29EDF961A2F94F3	B473C5BA29BDB3CA1DA6F3D9F42CBA5FC43883C4	0F07551F41D57101F271E3D7AAD5C5AAF0ACF6A2205F8F6D74D0732453EE4402
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	1EB254786E80EF6A9FD895AF19C6C7EB	4AD132C192D1009A1D908DED4527A9463EAF70B8	8D0544CCDF3ECE782040A9A2E9E2DCEFBFE7C0A48C85B425C68FA01CE34C66CB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	EB63F8925E726060AD06CC62BD6A443C	62B4F9F04DBA67EB833D4D16C774077E91CDC74E	1D7D3C4A0CB142FEF9E3DD06D4CF1069E982CBA95128BD11713B7D70DDC29E6D
C:\Users\user\AppData\Local\Temp\MSI215ea.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	2784B43B8A140702A406BC79CB56239B	38AAF5539B89A2B60FCC733E0368992CB3DA327B	AD00F8EB8A2013593790B59910DD93E1F71780DEC9D8013020A56D9A1925984A
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-07-03 15-11-28-849.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	EEB6716A4F383F08D68F29C7FCBE1577	8331941E3AF166B002114CA009E8F3D834F333A4	92EF28BAC4BB66E41723D85B71D36B1429396FE8F14C2932D90DF6F95731F41D
C:\Users\user\AppData\Local\Temp\acrocef_low\21104f42-3450-45b7-a79a-4abe66e962f3.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\5d902f7a-1e12-4ff3-aeee-ff0a3ec38e5e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\c8a864ad-6ac4-4a06-a0c6-978b35de420e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	59EE5E2FB56A099CAA8EDFD7AF821ED6	F5DC4F876768D57B69EC894ADE0A66E813BFED92	E100AAAA4FB2B3D78E3B6475C3B48BE189C5A39F73CFC2D22423F2CE928D3E75
C:\Users\user\AppData\Local\Temp\acrocef_low\fe5c8ec2-ff5c-43d8-b629-8368f3a540eb.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	0A347312E361322436D1AF1D5145D2AB	1D6C06A274705F8A295F62AD90CF8CA27555C226	094501B3CA4E93F626ABFCAE800645C533B61409DC3D1D233F4D053CE6A124D7
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl	data	B7A9A5A223B9DCE0E7D10E2B32A0BA07	FFB925FA80873CF50D8CB6DA530BA8CD7F0D9922	4EF52E63D45F5230C47DBD3764AA90768F708B24885579375724473BB3FFB255
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl	data	152F65AAA856C44E87C8ED561AE43C0F	B6440383DBC4D3446E91CBB58EEB8C8BD6671F50	48AC59FC9FA38016B6D5A4CB5D89A2C0CABCD8A0404AF29FBE995B4AA647A292
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata	ISO-8859 text, with very long lines (3486), with CRLF, CR line terminators	32FCA302C8B872738373D7CCB1E75FD4	DA85FAF24ED0ECFD5D69CCFD6286D8B77D7EB4F1	CD0DD26304B88C20801FE80B33C49C009E2E5D4411B5D7F83252E1D90CD461C6

Windows Analysis Report
JUDICIAL NOTICE OF TREATY.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report JUDICIAL NOTICE OF TREATY.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Windows Analysis Report
JUDICIAL NOTICE OF TREATY.pdf