Windows Analysis Report
Exhibit 7 - Catalogue Mattress-Jan 2024.pdf

Overview

General Information

Sample name:	Exhibit 7 - Catalogue Mattress-Jan 2024.pdf
Analysis ID:	1559724
MD5:	225d43650452e5075fc72fe303f9b41f
SHA1:	d988b73f991791033b730acc56712312fcb1971e
SHA256:	81a2b59d4267a52ebd7ac6994e1299b4bc65c8ce6181beaa213a211004dc543f
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic

DNS query: name: x1.i.lencr.org

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: classification engine

Classification label: clean0.winPDF@14/48@1/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-20 15-20-32-690.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: ReaderMessages-journal.0.dr

Binary or memory string: CREATE TABLE GlobalState (LastSuccessfulSync DATE, HTTPModifiedDate DATE, FileLastModifiedDate DATE, TestPopulation VARCHAR(30), TestSegment VARCHAR(30), ProductName VARCHAR(30), ProductMajorVersion INTEGER, ProductMinorVersion INTEGER, LicenseState VARCHAR(15), Language VARCHAR(15), OEM VARCHAR(15), Channel VARCHAR(15) );j

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Exhibit 7 - Catalogue Mattress-Jan 2024.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,9765931501288519504,15496460262962559114,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2108 --field-trial-handle=1596,i,9765931501288519504,15496460262962559114,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Exhibit 7 - Catalogue Mattress-Jan 2024.pdf	Initial sample: PDF keyword /JS count = 0
Source: Exhibit 7 - Catalogue Mattress-Jan 2024.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Exhibit 7 - Catalogue Mattress-Jan 2024.pdf

Initial sample: PDF keyword stream count = 55

Source: Exhibit 7 - Catalogue Mattress-Jan 2024.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: Exhibit 7 - Catalogue Mattress-Jan 2024.pdf

Initial sample: PDF keyword /ObjStm count = 12

Source: Exhibit 7 - Catalogue Mattress-Jan 2024.pdf

Initial sample: PDF keyword obj count = 73

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.214.172	true
x1.i.lencr.org	unknown	unknown

ID:	1559724
Product:	CloudBasic
Start time:	21:19:31
Start date:	20.11.2024
Sample:	Exhibit 7 - Catalogue Mattress-Jan 2024.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	225d43650452e5075fc72fe303f9b41f
SHA1:	d988b73f991791033b730acc56712312fcb1971e
SHA256:	81a2b59d4267a52ebd7ac6994e1299b4bc65c8ce6181beaa213a211004dc543f
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	71DB3B2568B5E5EAA36FF03AF392107D	3362E8C77C7A46D1CE26558FB1C42F5753DB8964	409F5110886F75DD91F2CFCA06CE2A49B2555BE9F1175C4C6B9E45B20F76C7A8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	71DB3B2568B5E5EAA36FF03AF392107D	3362E8C77C7A46D1CE26558FB1C42F5753DB8964	409F5110886F75DD91F2CFCA06CE2A49B2555BE9F1175C4C6B9E45B20F76C7A8
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	40AC957484B5E58914336D7E39A0470B	488520C6E515EFADF6149863A04DD16CA37D2C47	9A50658A16F57FADE7C32F4627FA5E59F87CAB2D782FA84E7D8D3FDA1DA26E5B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	40AC957484B5E58914336D7E39A0470B	488520C6E515EFADF6149863A04DD16CA37D2C47	9A50658A16F57FADE7C32F4627FA5E59F87CAB2D782FA84E7D8D3FDA1DA26E5B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\97126a8f-e122-4bcd-b511-565cbf97299c.tmp	JSON data	DD37F82325396DDFFAD88B82D2CBCD66	3466956564A5B291ACA580AD3A64DB1D17FF3EA1	E7CBC01B0A229857D322679808C064A1E1324977D8E4CB7D1E7EF683CA77F986
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	F326539D084B03D88254A74D6018F692	395B367E0E3554C3E78A8211F2D4B9F0F427CA87	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF5aaf16.TMP (copy)	JSON data	F326539D084B03D88254A74D6018F692	395B367E0E3554C3E78A8211F2D4B9F0F427CA87	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\a46d5241-4302-4354-a490-13542ee1381a.tmp	JSON data	F326539D084B03D88254A74D6018F692	395B367E0E3554C3E78A8211F2D4B9F0F427CA87	9379694CADD7846403E1B6975502326FBC619E0E3A873BBB7BC2C03EE3623007
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	75A66A1830948E018B70400DF9D18446	57ACB9BCA4C6D5C8D5BD96A031D4E34F33549DA6	18CCDD2AB45715E641B0ECBF939EBC70B51F0DC53EFA4605A808EBA6CC1F87C0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	C9D504357E145CF1B6ACDF359C6ECD5C	5AE443187DE4CB3F101DD8EC455C5B5B31809350	D39364502A709F2DBEC76D6F3D19FE35CEE012E0082B429DE2768EC1FE46D6DE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	C9D504357E145CF1B6ACDF359C6ECD5C	5AE443187DE4CB3F101DD8EC455C5B5B31809350	D39364502A709F2DBEC76D6F3D19FE35CEE012E0082B429DE2768EC1FE46D6DE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241120202035Z-201.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	6E1BE9FD4799C6A9823A8EEDCF02458D	215932F09CD82844D442FC978AF54DF91E3A7181	4EA077925FF3A2E92408142576DAFE2C37547BCB8FE600C5DEAB5CE2E3B3CFEB
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 11, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 11	8EA2E8FDC98C3838BB2659CE07276E8C	E1D1D20B21CBD9F2124DC302FA6F9A4A98EA32BD	7210779B76EA945D7D02FF8646F661A9294F7AECA8DB6ADDAACBC39692DF617A
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	681ED30877CA468537F6CF5979E3DBA6	B8FB09E77884263A20C8A96D1B7A160392611D93	350E363374A906792CB5F2FF14FA6561A450F25F42D2FC86C9EF2B029A2EDD27
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	8C43418CEB9A2981D136609597605FF5	4D83406D6BD15CA649C8BC92D8ABF73F2F2A701F	5C65CC98C8961F8F5199347467A143351337C88E5046F9F5FD72CA25EE4B09A3
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	43B11A1E2B3B675A95C399239A803707	E4AFAC7029415C76FCF145FA41BD4D29904FC56F	4B5DF0A0241DCDB556F173335203FE060F5B6AF837BED53EEFBA67DA62513137
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	B818E722BD4826732B5B51A764A2DEED	22ED095EE973AED3BA5C3A805FCE0174423E2352	47BB6F65159447A89B1B0D8114D569458862C84A7A247A1032618E09AA86868F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	1F0096B5CCC8A2EA8B8C2295B6F3D197	963F309AA3E7AF9BD5D90F7DD3003A73C25A7787	D84D55B6C3624D1AE13CEBB39EDD19628C462F0B13D4164426B7928AEA8AE9CB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	6D90C86118F0EDDA0E9B66C5177FC9EB	31A7C7A13AFFF368F3FFBC97CB184670CAAFBD80	89B8174D10151F81145A2F652EBC49D7B863BECCFB8B723ABC21CC69BD43ADB5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	4B79731AF3E0F030008D8D8E072E47AE	A13AB4B61A92942A0A88B19A9D740356DA2AF8CC	BEEC80E605153F469B4010E43CCFE059938D4805CC44FBDF553176DBFD08ECA0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	2DB9A7A0ABCDF932CD8F3707DA4ED450	5755F0050E0770605822FA85F113A685908123C4	16BB93A132A8B52DEB5A87240CBDA9357208B14AB04020BE492AC0B9DDC7EAE1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	711D065A23A8FFC0318EA542C90DC9F0	FCA8A8AC26BA882EC3073E37DBFA928617645FD6	DFEB7674A8FAB69BBA4E947D22BFDD0922221E8F0354B1CE7BF75FFFC663547F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	638B94438BD23F67945DF66615B468ED	D2FE8C9403E385D79124287A980858406ACEAF31	BD9C89394A09387B78BF297D68F6528F2BD39C27B2F7B820DD1A68CF96304D00
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	224A64DA96967F1D334191C685BDDF63	B9A63C7AC8528005CA0EA4E59258821EB4FA3607	547500E9C847575FA8EF1D0A11D364C723A615F87BDA07FD956E61D8FAFD9376
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	D902ED2F0B9B85EA4DCBE81B71BFFD9E	7C5C730C868A7DB02F1E9F306E55E626E8C82FE8	CB638408DB569FD726C9201E1B4538779540461DD31D341E59F5CEEE4B30FB01
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	177F86671A2448A1EEC0B22F69E4AE4A	DFC02777EC87B3A5679FD8B85FC1D6711664DF21	B8AA5D8BCE15550D7D68A09388220997F0DD1193EDB9BC3116162863E6642495
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	3739FA7A0CFC0EAA75E80EA713796CDD	6332B43BCAA1AED134E6813745568E5BD0CC5B2E	110B5238F9BE7C333188D5EFEFF2812F601E7ABB1E18E6F3F77E9F56AB553288
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	6380C46CE02317243BD57C7DEEA00DB2	6719483D34DD3A1060102CE27BA96B74975E050A	66298866123CE750241331E908699515FCB6F57A9C6895603A73A60AEC9FF742
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	E8D497F58BD7C874E785D0599339EDDF	471664FC1ED30E30ECEF84F91F9308D66A55F220	440364026EF74E8B6138C3CA3F791DE91E38A9A4E7FEED4C591EF02709E3A476
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	EB7C6CEC04A8C2A9F8D2076844AAB0A7	D24F2592BD15E52DF1646C967FB2195FF8E4A198	79450749391CD46ACEE035A4CF9AE20A765415E16D47336B52B898466CB00237
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	CFAF9B5BC112D3CD535AC3A0D971BB78	B6434A627EDE0DEB8F0DE1C1D27091158A1F16A4	9D3EC6E4E455FA945069BFDC8E202DC138EABF63A5D4ABF69981C5F188D885EE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	771CAA7972D685A65684DA40BD8104A1	DB0E74AAD13A5FB76229EB3268544D98FEF00086	E5B41F6FFF7E2CA34B54D071D009F7457784D69669194F872DD31EB1A2F34192
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	988E36374D8F70773FDC5446B0B0EB20	8BB5C52312DBA08E2E8C866186A493F5A4C472DE	9A1A1F88ABFA7C79099000FAA57E0016D49123B53120E0A2ACC8AFBCE274E2EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	29003D79EA67827588485D443CBB5639	3CB03970D201F3F4CC3771A30E3EADCD4B45823C	B380FD4160A4F7DC9792FD445FA0C109ED4F5846D1EC28D644A85FF1333D59F2
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 24, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 24	1DDF761E0C34A17498821F281BB58A3F	1739461A25C622EC10295D6320275D1EFB63CA8C	687F9988AC451A4D469FBD16CA804F2140BAE76D7B7C470358E243DF24216E19
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	FB11B8B69E72BACFB134B66E6D028A13	819D30652BD1E87287CE9798CE27E3CAC730E284	DBD29D8BEB008769F8961D0D336761B72F150C2C5E7AA4D8D7B6783AD98BD633
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin	data	2F7CB3E762CB3B5A9A9D55F55E5DC06F	D86C840CC9FCBA4E5B97069E37C3FC2377D8FAB5	75B2B4A02DBB6733E1CC9DD9FE3FC68FAB5A2B74A309BF61C86B68006E8669EF
C:\Users\user\AppData\Local\Temp\MSI9fe73.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	A34A7CEBAA34F29208F347EBF67C98E0	B5E717BA177F58DA60638255506467E8B0FBB73F	421ACB6D6816CBAD835B54E846693DDE1C337A83EFF376E1AD28DA2DBEA17936
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-11-20 15-20-32-690.log	ASCII text, with very long lines (393)	128A51060103D95314048C2F32A15C66	EEB64761BE485729CD12BF4FBF7F2A68BA1AD7DB	601388D70DFB723E560FEA6AE08E5FEE8C1A980DF7DF9B6C10E1EC39705D4713
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	174153EBC27FB9D82F733C2B41A69DA9	624028036238449D3D320921132923FE77A8B3EA	78CC455AF6AE4A867467EA5C12F516F083795945466A206D23A901D9387C00CB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	C1C9507B0A7108C101A2D48C5BCCCEE0	D81FDC460C205F4A5886AEB13AF387A103F1318F	9DB4767C17B53515B0B60B68D05A23AB0A12B61769BD957CFE08D24AB3D31976
C:\Users\user\AppData\Local\Temp\acrocef_low\30608a34-2418-484f-ad69-f0898b0cb6a2.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	8B9FA2EC5118087D19CFDB20DA7C4C26	E32D6A1829B18717EF1455B73E88D36E0410EF93	4782624EA3A4B3C6EB782689208148B636365AA8E5DAF00814FA9AB722259CBD
C:\Users\user\AppData\Local\Temp\acrocef_low\364a9b0a-94dc-4580-b827-8baeb687d28d.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\3f0efbc3-ee64-490d-b8c0-70ee196cbe30.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\5db0d78a-d246-45a4-b25c-73f205d43d22.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	EC8D4FAB55F24C0E344D263724846C4A	5444D90F86D68A23AF7FB5434DEAE740D57D0312	E489C11D38BFF8F1F51351BAEBEE9F723A5C036DA0B0CB9C82306251017054EE

Windows Analysis Report
Exhibit 7 - Catalogue Mattress-Jan 2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report Exhibit 7 - Catalogue Mattress-Jan 2024.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
Exhibit 7 - Catalogue Mattress-Jan 2024.pdf