Windows Analysis Report
lnv_20422206_Denverwater.pdf

Overview

General Information

Sample name:	lnv_20422206_Denverwater.pdf
Analysis ID:	1544569
MD5:	6090ef6d4bbea6240b8be5df50222bfa
SHA1:	ec0e35a52f6b85501e7a83522dedab726032686d
SHA256:	14390f1f8c48653ab9a212b42e84e61bd83d6f669b9ebd8422ce05610c7e6b16
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Potential document exploit detected (performs DNS queries)

Classification

Signatures

Potential document exploit detected (performs DNS queries)

Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org
Source: global traffic	DNS query: name: x1.i.lencr.org

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: x1.i.lencr.org

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: 5bd39301-5071-47aa-9f4a-f05228ecd6bd.tmp.3.dr, 59048770-7644-418b-b7d3-d2cd3a1bf6b7.tmp.3.dr	String found in binary or memory: https://chrome.cloudflare-dns.com

Source: classification engine

Classification label: clean0.winPDF@15/46@3/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 10-35-47-231.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\lnv_20422206_Denverwater.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1568,i,6500984805101185617,15702504535663562600,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2256 --field-trial-handle=1568,i,6500984805101185617,15702504535663562600,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: lnv_20422206_Denverwater.pdf	Initial sample: PDF keyword /JS count = 0
Source: lnv_20422206_Denverwater.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: lnv_20422206_Denverwater.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: lnv_20422206_Denverwater.pdf

Initial sample: PDF keyword obj count = 142

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

Contacted Domains

Name	IP	Active
bg.microsoft.map.fastly.net	199.232.210.172	true
x1.i.lencr.org	unknown	unknown

ID:	1544569
Product:	CloudBasic
Start time:	15:35:15
Start date:	29.10.2024
Sample:	lnv_20422206_Denverwater.pdf
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	6090ef6d4bbea6240b8be5df50222bfa
SHA1:	ec0e35a52f6b85501e7a83522dedab726032686d
SHA256:	14390f1f8c48653ab9a212b42e84e61bd83d6f669b9ebd8422ce05610c7e6b16
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	3226BE237FF22736B1DA22FCD332E593	97815556AE933D2D638436D30DE1C221EE2C29F5	F28ACB4D08CDB04EFB42BA0B72E319514A07E5438BDBACD5A349D166A88B87C1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	3226BE237FF22736B1DA22FCD332E593	97815556AE933D2D638436D30DE1C221EE2C29F5	F28ACB4D08CDB04EFB42BA0B72E319514A07E5438BDBACD5A349D166A88B87C1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	4E22CF7FCD9A5DF1760E3DC989F76D43	2E47F37A02CBF6FCA26C965DA1E5268B14F042B1	6F8D942C29BFB25C606E34E542ABF134AA07ACC426E0E43E59F570FB72AFCEC1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	4E22CF7FCD9A5DF1760E3DC989F76D43	2E47F37A02CBF6FCA26C965DA1E5268B14F042B1	6F8D942C29BFB25C606E34E542ABF134AA07ACC426E0E43E59F570FB72AFCEC1
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\59048770-7644-418b-b7d3-d2cd3a1bf6b7.tmp	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5bd39301-5071-47aa-9f4a-f05228ecd6bd.tmp	JSON data	5F09C2993C3DCABF15FBFF5D4501C2B6	1995070D03DB2458CC6F57F8B533051F483C8F84	49A4D5D15F195F5422ECAB4C6370A212F94C1DA0CD9A82C6EC0D78B847A5CF72
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State~RF3c6e17.TMP (copy)	JSON data	4C313FE514B5F4E7E89329630909F8DC	916EED77EC8C9DC90C64FF1E5CC9D04D4674EE56	1EE7C151EF264F91FCDCCB6644F62DC33E27A4E829DAAB748DA1DE4426400873
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	84A9B6B20A322EFF00614D7ACF451B0C	858140FD02A1CD1B2D66B8D22E66CE5F9FDFD896	3564ABD213D8E936C44288C08F109F85DEB36AD371769908FA3F1648BE56BAB6
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	2BE3F3DAF628412E7B078EB512476C8D	C6D56D2A0FEBD8C69F0DB6525AC55E413D31CA89	E1E62B5DE9413DA94628C3FD560784E99A5579F9567FBC11326B42D9FB24C134
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	2BE3F3DAF628412E7B078EB512476C8D	C6D56D2A0FEBD8C69F0DB6525AC55E413D31CA89	E1E62B5DE9413DA94628C3FD560784E99A5579F9567FBC11326B42D9FB24C134
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-241029143549Z-164.bmp	PC bitmap, Windows 3.x format, 107 x -152 x 32, cbSize 65110, bits offset 54	4D0AA4BC3C9EA082383D90E99173A4FE	17E7C9878AFCB6EA4ADD0C74D04C59E57FB38672	FB7B629B2210247CA42D3D308749128E8245E3572D6B81EC61C116FBC62C7ECE
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 2, database pages 14, cookie 0x5, schema 4, UTF-8, version-valid-for 2	A4D5FECEFE05F21D6F81ACF4D9A788CF	1A9AC236C80F2A2809F7DE374072E2FCCA5A775C	83BE4623D80FFB402FBDEC4125671DF532845A3828A1B378D99BD243A4FD8FF2
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	253F79773C682CBEEBE0EA6474B48CB8	7956C5538660F6C211DDB24892CC092F68E49C44	4F45ACB3BDA77A0474977419F06225EDB9D4A5A8C1785085E1D3930E5B4E2660
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D	Certificate, Version=3	0CD2F9E0DA1773E9ED864DA5E370E74E	CABD2A79A1076A31F21D253635CB039D4329A5E8	96BCEC06264976F37460779ACF28C5A7CFE8A3C0AAE11A8FFCEE05C0BDDF08C6
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	Microsoft Cabinet archive data, Windows 2000/XP setup, 71954 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression	49AEBF8CBD62D92AC215B2923FB1B9F5	1723BE06719828DDA65AD804298D0431F6AFF976	B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D	data	2C1BBD4469B4300DF4FC048CE80566F5	273AF1811F559198F616A66A3A1C0891CC266E93	DFB3834F23498D92D81AA9A8E51DE8903D1294FC2B8643FB47D1D2173EB64996
C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	data	31056DF82DA253967B9CEA59353EA2B3	C27DE3AD603E1328BD5E028303CCFBBBC6B301E2	94CC69F8D34B14448C04B4D79580BF860ED98AE5EA22E18E2B833673DEC60C5C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	9E80A9175D4F2C811047EA571DD790D6	BE68641F4058293375655FBD3FB95A9D87712926	2B7133F2ABC43D411E44193C242CF5F72361C67EE4158256EF26218AB1FAF1F8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	3D45D5082835F04822A2DDFA518ABEAC	8CDAB3CAD9D1216261672403BE1CEA5362CBCCEB	6068BD38B6A5672ACDBEB55940B1D769395E7EA5AD1384865738D281A28EF5AB
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	0C02350EC47C0FE649CDE7A7C30C97B5	4B1AD94716BBDAF58B71A7DD99D029188ED9B3DC	86342C3AC6523F9B76D176A38058E056B94C4C00560ECCC1B2C13878C0E404B5
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	5EAFD737A2211E3A6EF21C3007028878	E91D2DD758F2FAA7B79EB95E0E5977055220ACCD	3DC45C7F40EC88A8911FFB942DA26C1FE0C4C1822E2D0E7017F2CED56BA7FE7A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	1B82931556DC86699BD0ABFB7284BCC1	BC2E50DD886B8A515D008E3576436EC0C9E1464D	ED6A6F77ED483F99B072861A39C1A301BA8BBCF0A0629826D354C2BD48C84B5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	FE79BCB9020E952CF031E83509C0E5D3	C8DC473692BB1A3C331C163DC08D97A59E028094	9C1A28E6D1A65DA142641842F1399B2783A68FC894200F0FECD54DB1206488A9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	DFE61D1BF6A75CDFC7B4FE07D1DD8D42	04874DE5259B5E5B4E86466C02BC4B704C9E230D	70B2F78C3239F150E4380B4023BF176B911F83544EB0797778547421EF4BEFCA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	ED18BEC005FF17C64C12FEA3FEF26A20	8E003265A64362778D4A0257660C8A774EA92908	7C07DF49527BCB075FAD027C9F7F88DE58F16D586EBDF3C99E243E0FFBF2B2B4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	28B4047A2D025E26EE62DA2FBF8A2EE8	AD7F7806224E6B00382980FDBD067375D90E581E	94218CB341A7AA5321D9A960B11D110B3ED8E3887B2B10984308EB77D7B8CDDD
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	359D7877FC2D6EAC1F5BA261C6720D82	8535DA8AEA8EE142E66F5D0B53683F04817E0D09	06660589FAF2224DC40CE3C766CB55E440DBE4D50D3A727FD95BE3D5353DB376
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	739CD6173CE6066C5C0C6AB0A677B65C	72FC98119E7FA66B09C264E8E374743AD87ABD5F	611CB90248177F60135C039815A3282F7358F5426BA94714F3A3B18CFD02D9E8
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	5569D2A7BC144BDEF80971DED094E038	0D94FD2B796C23D9E88DA5B899F5E4528FCD8B77	A39D478385938B9694A5034DF0B9848EFE8F774E9976379B9BD6B40827347E72
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	38B1048F98AB882410F8E1CC4AB18CE0	A9A331EE96E5D4FEB48F0E6258789158BFDD485C	90EF0362E3F15FF0296DB0760CB6E4C818BD9EECEEC5F1D7D2D9E0015EAAFD1C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	62AC29862611D5255899A07DF822D819	7D4FB002588261ADDF283ACB35DC1B542E78CB3B	0AC24FD9DAF5062F466B64041D09DCCDA2BF35C1E8E996D16A523873F0B2CB5F
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	C2AC2881D9E30B46071C51356015A26B	0179AE1EA39D368B4D92213B185EA3BDF389BF74	F7E3C5337F17E4BB2FAD0B930D8C73C6C9615C40EEC66CE8A4276BC632BA57BC
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	70D338DD1EBBA07C5CE16879141B1EA0	A1E364C87CBC4B9FB6D990FA15540371AAD98069	0116058E16FCF4362C420C8EF8EEB2C87E796AD992576EB11C72D9251213AF86
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	CB0FE792457A1135300A240AF0EED544	F9D8331C9D88D66B1AD810740DFD9442A02DE625	4EB84DA779EDA4D240FF2FD7539C4E2E001FBD4D53174F0121454F704A0DEBBF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 19, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 19	3EFA68C464515226E93F70F75E7C1CC8	0AF90D8B40286F5913FAD62708A4BDB2B2BBA1EF	DAF7C6A89BE90E580E13F0AADE0B054FECA61BEC8681A574FCC1F0DD9D15B9D6
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	6EB62B5E41393AEC9F7FEF14AF3E8494	058B7A85FC536079D109D52CABFA53DA3653D693	C5ED9D2008D5BADDF0CFDAB74CF78C89475C69AB2F3382592FDCFA9195B5647A
C:\Users\user\AppData\Local\Temp\MSIb609f.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	AA9663B4ECBE77A4984842BBB062F963	73D31E0FDF57830A13AD7C3D049DF37F570E2A51	EB92FE648E6801EE868972C67387FC799617E8E2095DD74BA8DBBB6F1D16FE3E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-10-29 10-35-47-231.log	ASCII text, with very long lines (393)	91F06491552FC977E9E8AF47786EE7C1	8FEB27904897FFCC2BE1A985D479D7F75F11CEFC	06582F9F48220653B0CB355A53A9B145DA049C536D00095C57FCB3E941BA90BB
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	875289F9499072C9C4D89B4C6ACAF81D	A2BADDF91763D9684AFF259E91283391A05E36EB	DFC878CEF7E190E0D7C58035887C98CD138934855487B559F0DE0BEA7C4E9FD7
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	EB7955AAC3E9E3C24B056424A0472AF3	2F8C4455F7BEEEEF7993A8D9DA40807708641AD5	779A1E90443592EBA153EF2171B6E6C3C099B68007A6085DAAAFFDA1BB6CCD16
C:\Users\user\AppData\Local\Temp\acrocef_low\2ec5dfb4-efdd-427d-8b42-42844fd93952.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	1D64D25345DD73F100517644279994E6	DE807F82098D469302955DCBE1A963CD6E887737	0A05C4CE0C4D8527D79A3C9CEE2A8B73475F53E18544622E4656C598BC814DFC
C:\Users\user\AppData\Local\Temp\acrocef_low\645fb6ed-f35a-4912-83a6-4c6d8e7fee99.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE
C:\Users\user\AppData\Local\Temp\acrocef_low\b0f45595-1713-4d12-83ad-8e104fccad1b.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	A8E5C37206C98D1B655FF994A420FFB6	827237782AB5971EC205C3BCECCC7950BE9F84C3	F1F755059AF7C2CBC36920337941AEFB18FBDB3CD14D3239CBBBCF0CB8F208EA
C:\Users\user\AppData\Local\Temp\acrocef_low\ee14c006-1e68-4c6d-9128-f33b16b3e350.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B

Windows Analysis Report
lnv_20422206_Denverwater.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report lnv_20422206_Denverwater.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

Software Vulnerabilities

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Screenshots

Behavior Graph

Network Map

Contacted Domains

Windows Analysis Report
lnv_20422206_Denverwater.pdf