Windows Analysis Report
Obaid_WFH_Check.pdf

Overview

General Information

Sample name:	Obaid_WFH_Check.pdf
Analysis ID:	1431808
MD5:	b5e121f6bb5574a588a430b51fda7f9a
SHA1:	afba123e82ac84ea9910ecbf3775168249c09867
SHA256:	ecd936385cea6816a3baf0c61b72cb5da62ae56cb9420c66ff0c11efa3bd2a15
Infos:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: classification engine

Classification label: clean0.winPDF@14/44@0/0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 20-05-34-613.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Obaid_WFH_Check.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1736,i,10949930308330096366,4183056358984129761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2084 --field-trial-handle=1736,i,10949930308330096366,4183056358984129761,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Obaid_WFH_Check.pdf	Initial sample: PDF keyword /JS count = 0
Source: Obaid_WFH_Check.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A93vnpsl_gg86rr_4gc.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A93vnpsl_gg86rr_4gc.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: Obaid_WFH_Check.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1431808
Product:	CloudBasic
Start time:	20:04:43
Start date:	25.04.2024
Sample:	Obaid_WFH_Check.pdf
Cookbook:	defaultwindowspdfcookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	b5e121f6bb5574a588a430b51fda7f9a
SHA1:	afba123e82ac84ea9910ecbf3775168249c09867
SHA256:	ecd936385cea6816a3baf0c61b72cb5da62ae56cb9420c66ff0c11efa3bd2a15
Filetype:	Adobe Portable Document Format (5005/1) 100.00%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	7402F5993BDECFFC2217604CA20783C3	FF90501CB50B9B912BE81440571405AFD875E706	0967291396DC97288898659A45E70D7FF7DDEAD328E63399F3C183BCE331860D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)	ASCII text	7402F5993BDECFFC2217604CA20783C3	FF90501CB50B9B912BE81440571405AFD875E706	0967291396DC97288898659A45E70D7FF7DDEAD328E63399F3C183BCE331860D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG	ASCII text	F766A5EE8C4EBE912E8CD2AC26ABE98A	0F15B1BD0BA192295C81B6189C56AE271E2D613D	73B9633468FA5B438637EB35A95F197344802D083028A6839DA16BDDC4E0B925
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)	ASCII text	F766A5EE8C4EBE912E8CD2AC26ABE98A	0F15B1BD0BA192295C81B6189C56AE271E2D613D	73B9633468FA5B438637EB35A95F197344802D083028A6839DA16BDDC4E0B925
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)	JSON data	8233C863EA4D7189B30D0CA656ADE9B3	E47A3C12124D9C94D6757D5F0CF8011DE4A2D3CA	F8E6D19EAB7D4FB7E69865D5A222F52A1CF21826A0ED9A81EC7B9642CCD8E959
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\dd2b2515-a754-4356-b3d7-fbccb6a9541b.tmp	JSON data	8233C863EA4D7189B30D0CA656ADE9B3	E47A3C12124D9C94D6757D5F0CF8011DE4A2D3CA	F8E6D19EAB7D4FB7E69865D5A222F52A1CF21826A0ED9A81EC7B9642CCD8E959
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log	data	733BFE73D40D33C7383793FC89478E9C	0A009DB6D408298FEA57C895D2296582DBDA439E	AEBD375431AC395239909C382CEA7E5085F384DD1D1C1C54AF970B9FE6C4DF17
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG	ASCII text	C697C462C6FAD07FAD05910B2E1B3D78	44775E6092AD89D031901E2903D5AFD7CDE77EBC	29C3E3A4424238019AC500DD8C42CA9E80CD690F7F790A11DE403ACDDA152460
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)	ASCII text	C697C462C6FAD07FAD05910B2E1B3D78	44775E6092AD89D031901E2903D5AFD7CDE77EBC	29C3E3A4424238019AC500DD8C42CA9E80CD690F7F790A11DE403ACDDA152460
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-240425180536Z-162.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32, cbSize 71190, bits offset 54	61024AB1427A6229CED0C8670F048BA4	199B76739AF8CF553675AA746C85C2054A6DF46E	DCFFD82F101981D707B4CC049E98F19B1C46A6010B4F6C3FB48A912448B69156
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3040000, file counter 15, database pages 21, cookie 0x5, schema 4, UTF-8, version-valid-for 15	69A9EF459E6028ECAF63FD62E9158AB4	F364B37A8856C7025966CB289818F66C870FC316	1603203E376A361DEBB81B7A1E051DFE6DE4F07AD3B891E6C4884EEC057F959E
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	SQLite Rollback Journal	35E78B0067F182A3E53985586D8615D1	E97ECC7E7401B61EE506723703E651D76CF0250E	9849D32022393D640D7FA72E381301A85600320F879A723EFD5C74ED1C6A4CC9
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5772	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)	PostScript document text	94185C5850C26B3C6FC24ABC385CDA58	42F042285037B0C35BC4226D387F88C770AB5CAA	1D9979A98F7C4B3073BC03EE9D974CCE9FE265A1E2F8E9EE26A4A5528419E808
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat	data	F5567C4FF4AB049B696D3BE0DD72A793	EBEADDE9FF0AF2C201A5F7CC747C9EA61CFA6916	D8DBFE71873929825A420F73821F3FF0254D51984FAAA82E1B89D31188F77C04
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID	JSON data	FD43E617714CCBB5604A45BC92DF4760	20F2CA317EA5FD78E259DC7F1964117D8FD2F330	6CFFA04A974946EDFE1E1F3BCCAEA302DA8E7D505646490A0F08D68D72170F2B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface	JSON data	167ED0C32A7D53F8D8842DF614FBDD15	6132DE69F85643AC96F95C8EE26B7CE5BE42D916	213749C87FF6D994E554169BCDDF1737B796A3CE3803FA4C9602308B87A43FD4
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface	JSON data	5EB759F8CE05D1F4C720742E7A995B6B	97FE3A2FEF743CEC325BE85DC161C6B2BFFD8275	A9976E6D00938FE8A36DEB5889A229388070AEFFB1E08ADAD453B12827246ADF
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD	JSON data	48BD0976669CAB663B36F330DE47DEFF	7917587289C9E1D3294D03825B886B781FA0E525	B47CD175DC766D3A05587C16A36BCFA696E0AA0915586E8953F4D1D31C142E61
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner	JSON data	D77B14997456EC767C2F7EEFB5A11E89	EAA3926527D914D4977851A50587FC44FC81E39A	782AB28D1966CD59CFA9914DA37E5F4C5355DD8ABBBB58A40823BE846EC7EC36
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner	JSON data	9C0D1D0F68598ED5DCEA586A884B306D	A74EC2546DB7C75D3D386DD09DB96F70C81B67AA	64284E2B7523799483AD0FFA32C972C84AFE35AE5BC5B5F8D07C6BEBFBE9AC1C
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention	JSON data	1DA79AEF047BB0FB6D472DBF60969A4C	6469A8F9C8A61463FACDC17F339C6F68B82521A3	B024D80D819F3981C14C2D361D399A7E98A78E4B1F001572047F65F0B082D939
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner	JSON data	2C2422B8465F46ECB21AC618E4954A4C	6B32569B4E79BAB566F235A1FDAB87035B287843	ADD36C991460055F1EA842783CC686216C8D7BD2C601F40A9D41280FB634268A
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner	JSON data	B6BF8E6FE321C1B74AD37A4B5E2ADF8C	5432F50DC7180D4E80355AFF8A7E21275022EFC7	7EE73DF12793EAB5F55778B0D92DB2CD8C586BAFDEB409965E8C6D2B0F1E668B
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner	JSON data	C47CEEAC9DEC3DB272FE7653B951A1FC	307414F6CB8554D787F080CE59B61206BDB6785D	56FDC4C27B8B93906842FE875C3A84D4D3849BB7EF8E66322C7C1AFE4D58168D
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner	JSON data	4174332827983009FD9CB2CA61264E22	D0DEAEEFB036F3260097B86175C053B1A8DCAA77	1E268A16E2F12894A6B16619429FE0296F188DD9D7D3DF0C3A106505F4859AFE
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner	JSON data	90C2F2A64E7C4CB58D065EC6A221524A	C69E8CA3C1FA0ACF139DF9DA51C91771FD030868	B28FE7FCFCF3FFCD2ED141AB52A964C08F38FB10105502BCD88BF5B0D53647DA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Retention	JSON data	3655961307417BBF09A8947D00B4B7A7	FC4A85BED1D46A42FDE21864E5B3912253C8E694	8F1D17D5C900CDE5F08A04256D194A7BC3CD62AB5F713143F571AACFC40135C3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Sign_LHP_Banner	JSON data	55FEEC9DD1541EFBFFF8066950DFE00A	4F51E97070886493A641459255191DA2BFB863D0	80308D6ADD546CB18443750A3B56F1A9AE01C7CBFE308291E859D384B1DA68A0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Upsell_Cards	JSON data	D2123807C2077CC2632DABFA6AB63EAC	B40C59BE14AE3D2896BFFF372DF3601674C71126	E56DB2626BAA2DAC9F5BFABD5E489EE873370D8BEB42DF66284300A48DE842A3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\Edit_InApp_Aug2020	JSON data	1A5D06718279723DFA316EE5B30D70C8	0271A4AC503D218049404751CECB384DA611B00E	CFF7C3AC7CFA7F746DF2607FC00DD236A03C36C259FEA26391A68483A21AEEF0
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTING	data	DC84B0D741E5BEAE8070013ADDCC8C28	802F4A6A20CBF157AAF6C4E07E4301578D5936A2	81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json	JSON data	4186C994E253A1AA5A2A342CBE5ACBF7	15EE9637856C9D90FF63596EDFC22B2CB0FD9B9E	1589D4E63CCC39529CDB3A68405CB4E6D6694F7D388718F2878E08B9C3C924B1
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents	SQLite 3.x database, last written using SQLite version 3040000, file counter 25, database pages 3, cookie 0x2, schema 4, UTF-8, version-valid-for 25	908A16033B7883AD2FD18BD7BF060E9C	E29C637ABF1070DD33D826D094D706D48CD87304	01134E76564E1DCF8A085B1B6CC46E3DB6757DA7468AB61C68D815E7490D1416
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents-journal	SQLite Rollback Journal	2F34E24665403071F3B66BB70D17EAA7	A7974F226908AF1FF7715BF1EE830E47241AD6D6	40136A690871EF5A1ED8E8DA3BD565E6BCFAEF90090E885CA658649F0E862BC8
C:\Users\user\AppData\Local\Temp\MSI85fd7.LOG	Unicode text, UTF-16, little-endian text, with CRLF line terminators	715B2273730CD5A5081AE9437E1A33AD	96744BF2C005A541287CBF4D0603F95157003755	D2D5C2B116D13A71795BAC54B6E712D0AF01DF08A7D2DA409F4407C7D3073C10
C:\Users\user\AppData\Local\Temp\acrobat_sbx\A93vnpsl_gg86rr_4gc.tmp	PDF document, version 1.6, 0 pages	CBFD68EECABF3425924AB5F03C89D227	204079D419488226338CE93360BF350C08F18A2E	B114954E83DA13B134BB2A5DFDFA20DBE38589681757EA07200475C1D60ECA8E
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2024-04-25 20-05-34-613.log	ASCII text, with very long lines (393)	8947C10F5AB6CFFFAE64BCA79B5A0BE3	70F87EEB71BA1BE43D2ABAB7563F94C73AB5F778	4F3449101521DA7DF6B58A2C856592E1359BA8BD1ACD0688ECF4292BA5388485
C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6.log	ASCII text, with very long lines (393), with CRLF line terminators	F0F22303A693664A53E0313646E7B56E	8EB7432B44D1F7A36EF62E46961402F5D921746A	3D807ACB42FB710BA5E9CC64E0FA24C7D8021615B465BBBCB6DBA720A177DD41
C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt	ASCII text, with CRLF line terminators	E1F3C6E8EA6515E968DF97FD66861922	296B0FB0B8EEBF266F3ADDFEC60633A4048F194E	2B10921E14AB9C419882B03BC2C341624043BC13E05B257C94DC8F032066D467
C:\Users\user\AppData\Local\Temp\acrocef_low\541f2c89-c1b6-44c3-bf1c-b9cc65c8c26e.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 299538	3A49135134665364308390AC398006F1	28EF4CE5690BF8A9E048AF7D30688120DAC6F126	D1858851B2DC86BA23C0710FE8526292F0F69E100CEBFA7F260890BD41F5F42B
C:\Users\user\AppData\Local\Temp\acrocef_low\9c026ce5-6078-4d65-a846-91df4ae4eae8.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 5111142	18E3D04537AF72FDBEB3760B2D10C80E	B313CD0B25E41E5CF0DFB83B33AB3E3C7678D5CC	BBEF113A2057EE7EAC911DC960D36D4A62C262DAE5B1379257908228243BD6F4
C:\Users\user\AppData\Local\Temp\acrocef_low\d9f468d3-3d6f-47c8-b31f-ff7498b35f4c.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 33081	A0CFC77914D9BFBDD8BC1B1154A7B364	54962BFDF3797C95DC2A4C8B29E873743811AD30	81E45F94FE27B1D7D61DBC0DAFC005A1816D238D594B443BF4F0EE3241FB9685
C:\Users\user\AppData\Local\Temp\acrocef_low\f61774f1-b9b4-496c-9c42-94a85b31afa0.tmp	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1311022	5C48B0AD2FEF800949466AE872E1F1E2	337D617AE142815EDDACB48484628C1F16692A2F	F40E3C96D4ED2F7A299027B37B2C0C03EAEEE22CF79C6B300E5F23ACB1EB31FE

Windows Analysis Report
Obaid_WFH_Check.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report Obaid_WFH_Check.pdf

Overview

General Information

Detection

Signatures

Classification

Signatures

System Summary

Hooking and other Techniques for Hiding and Protection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
Obaid_WFH_Check.pdf