Edit tour

Windows Analysis Report
AR Care.pdf

Overview

General Information

Sample name:	AR Care.pdf
Analysis ID:	1652981
MD5:	3f4fce75f73e2833fcfd4daf7e776247
SHA1:	27360ba18d8c41a6b827fefeb5bf3ffe2dc64bc7
SHA256:	5fff95ecd9a376d87ce626273a765836871875e03ce5c60c4002103b11e9da0d
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected landing page (webpage, office document or email)

Suspicious PDF detected (based on various text indicators)

Creates files inside the system directory

Deletes files inside the Windows folder

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7872 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\AR Care.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 8072 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7400 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1612 --field-trial-handle=1604,i,5356942124287896857,12943061900740152347,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 8888 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8924 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2008,i,3824752678761937169,17390088200995456266,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 7528 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://g7868d.onrender.com/b765a52bd2c50a8e/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJiNzY1YTUyYmQyYzUwYThlIiwiaWF0IjoxNzM5MjkyMDg2fQ.QgLKBfHewGnX9JgoiBZq79fw-TDoD0F41eawEVZJyrY" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection

Click to jump to signature section

Show All Signature Results

Phishing

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'REVIEW DOCUMENT' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'review document'

Suspicious PDF detected (based on various text indicators)

Source: Adobe Acrobat PDF

OCR Text: g Dropbox DocSend Click the button below to access this content REVIEW DOCUMENT DocSend is the best way to securely send and track your content. Learn more. Dropbox DocSend Made in San Francisco, CA O 2025 DocSend.

Source: unknown	HTTPS traffic detected: 142.251.32.100:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.252:443 -> 192.168.2.4:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.24.57.252:443 -> 192.168.2.4:49743 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /b765a52bd2c50a8e/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJiNzY1YTUyYmQyYzUwYThlIiwiaWF0IjoxNzM5MjkyMDg2fQ.QgLKBfHewGnX9JgoiBZq79fw-TDoD0F41eawEVZJyrY HTTP/1.1Host: g7868d.onrender.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCIrgzgEIruTOAQiL5c4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: g7868d.onrender.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://g7868d.onrender.com/b765a52bd2c50a8e/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJiNzY1YTUyYmQyYzUwYThlIiwiaWF0IjoxNzM5MjkyMDg2fQ.QgLKBfHewGnX9JgoiBZq79fw-TDoD0F41eawEVZJyrYAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: g7868d.onrender.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Mon, 31 Mar 2025 15:32:49 GMTContent-Type: text/html; charset=utf-8Content-Length: 243Connection: closex-render-routing: suspendcf-cache-status: DYNAMICServer: cloudflareCF-RAY: 9290e6ccbaefc3f3-EWRalt-svc: h3=":443"; ma=86400
Source: global traffic	HTTP traffic detected: HTTP/1.1 503 Service UnavailableDate: Mon, 31 Mar 2025 15:32:50 GMTContent-Type: text/html; charset=utf-8Content-Length: 243Connection: closex-render-routing: suspendcf-cache-status: DYNAMICServer: cloudflareCF-RAY: 9290e6d9b9ea7281-EWRalt-svc: h3=":443"; ma=86400

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\AR Care.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1612 --field-trial-handle=1604,i,5356942124287896857,12943061900740152347,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2008,i,3824752678761937169,17390088200995456266,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://g7868d.onrender.com/b765a52bd2c50a8e/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJiNzY1YTUyYmQyYzUwYThlIiwiaWF0IjoxNzM5MjkyMDg2fQ.QgLKBfHewGnX9JgoiBZq79fw-TDoD0F41eawEVZJyrY"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1612 --field-trial-handle=1604,i,5356942124287896857,12943061900740152347,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2008,i,3824752678761937169,17390088200995456266,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: AR Care.pdf	Initial sample: PDF keyword /JS count = 0
Source: AR Care.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.90.172	true	false	high
e8652.dscx.akamaiedge.net	23.48.144.248	true	false	high
gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net	216.24.57.252	true	false	high
www.google.com	142.251.32.100	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
g7868d.onrender.com	unknown	unknown	false	unknown

Name	Malicious	Antivirus Detection	Reputation
https://g7868d.onrender.com/b765a52bd2c50a8e/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJiNzY1YTUyYmQyYzUwYThlIiwiaWF0IjoxNzM5MjkyMDg2fQ.QgLKBfHewGnX9JgoiBZq79fw-TDoD0F41eawEVZJyrY	false		unknown
http://x1.i.lencr.org/	false		high
http://c.pki.goog/r/gsr1.crl	false		high
http://c.pki.goog/r/r4.crl	false		high
https://g7868d.onrender.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
23.48.144.248	e8652.dscx.akamaiedge.net	United States	20940	AKAMAI-ASN1EU	false
142.251.32.100	www.google.com	United States	15169	GOOGLEUS	false
216.24.57.252	gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net	United States	397273	RENDERUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1652981
Start date and time:	2025-03-31 17:31:13 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	AR Care.pdf
Detection:	MAL
Classification:	mal48.phis.winPDF@37/51@6/5
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.48.144.248	Invoice Number INV132146-1.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	Invoice Number INV132146-1.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	3bSDIpSIdF.msi	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
216.24.57.252	smtp12_0_BANK DETAILS.xls	Get hash	malicious	AgentTesla	Browse	uri.ac/UXLwPY
	Transferencia.xla	Get hash	malicious	AgentTesla	Browse	uri.ac/bHA3z_
	n#U00e1kupn#U00fa objedn#U00e1vku.xla.xlsx	Get hash	malicious	AgentTesla	Browse	uri.ac/cjwX3v
	Comprobante.xla.xlsx	Get hash	malicious	AgentTesla	Browse	uri.ac/bHA3z_
	comand#U0103 de achizi#U021bie.xla.xlsx	Get hash	malicious	AgentTesla	Browse	uri.ac/sUkkLX
	Payment Advice Copy.xls	Get hash	malicious	Unknown	Browse	uri.ac/gUUc_w
	Payment Advice Copy.xls	Get hash	malicious	Unknown	Browse	uri.ac/gUUc_w
	DHLXInvoice.xls	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	uri.ac/wfvMQA
	DHL_89576534576879899009079968.pdf.xla.xlsx	Get hash	malicious	AgentTesla	Browse	uri.ac/IUTYP4

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net	https://ebidxs0lqgtrc1e6kmwrwew9kcjkl3nqg0ud6g8m5kilxdom6s.g8way.io/O-wpvbR0VIDe1sWempQ4ZZLhpjGlCINUUh9hHVDZnXc?email=portugal.reception@daiichi-sankyo.pt	Get hash	malicious	Unknown	Browse	216.24.57.4
	http://download-wetransfer-wp8tkd96cmrqfbloynb7vhxy2rjqg3t5aztpxlmapp.vercel.app/	Get hash	malicious	Unknown	Browse	216.24.57.4
	FW_ Ready for Your Review & Sign-Off Before Submission #U2014 Final Q1 Financials.msg	Get hash	malicious	Unknown	Browse	216.24.57.4
	http://www.google.com/url?q=http%3A%2F%2Fbusiness-page-appealdepart-de.vercel.app&sa=D&sntz=1&usg=AOvVaw3y7XLatnyOzQiEGegrNq5u	Get hash	malicious	Unknown	Browse	216.24.57.4
	https://wetranfshare-download.vercel.app/?_vercel_share=mMrjHbEyWpUy8BtvznHKEbLe5VGwPObG93LXJheS5nbGl0Y2gubWUvc2NyLmpzIj48L3NjcmlwdD4KPC9oZWFkPgo8Ym9k?email=	Get hash	malicious	HTMLPhisher	Browse	216.24.57.4
	https://ahorrosparati.vercel.app/points/PSE/falabella/index.html	Get hash	malicious	Unknown	Browse	216.24.57.4
	http://yesincs.com	Get hash	malicious	Unknown	Browse	216.24.57.4
	Fulcrumair- Insurance - Agreementfdp.pdf	Get hash	malicious	HTMLPhisher	Browse	216.24.57.4
	http://ipfs.io/ipns/k51qzi5uqu5dju03dk6lty37zzhw75rly586fojrercxcsjg745vjuulzzc1wi	Get hash	malicious	HTMLPhisher	Browse	216.24.57.4
	https://cloudgate.digitalshrill.com/c/pokhhtfe	Get hash	malicious	HackBrowser	Browse	216.24.57.4
bg.microsoft.map.fastly.net	R5STYRsz6b.exe	Get hash	malicious	Vanhelsing	Browse	199.232.90.172
	Revised - Bcs 2025 Handbook21920.doc	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	199.232.90.172
	Natsu.exe	Get hash	malicious	Quasar	Browse	151.101.46.172
	Setup.exe	Get hash	malicious	LummaC Stealer	Browse	199.232.90.172
	DoxoGram V14 (PC).exe	Get hash	malicious	LummaC Stealer	Browse	199.232.38.172
	StartupScript_0f6d844f.cmd	Get hash	malicious	Batch Injector, XWorm	Browse	199.232.38.172
	crypted.exe	Get hash	malicious	Vidar	Browse	199.232.38.172
	8L1kW88HYO.msi	Get hash	malicious	Unknown	Browse	199.232.38.172
	hv1A8vuC6I.exe	Get hash	malicious	Unknown	Browse	199.232.38.172
	sypoZWXQNe.exe	Get hash	malicious	Unknown	Browse	199.232.38.172
e8652.dscx.akamaiedge.net	mara.roth-Handbook_DocuSign6h0-3958.pdf	Get hash	malicious	Fake Captcha	Browse	23.216.136.238
	email.eml	Get hash	malicious	Unknown	Browse	23.197.253.105
	Petroleum Systems Services Corporation WAV Caller.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	7ivgZ6j7.pdf	Get hash	malicious	Unknown	Browse	23.46.224.249
	Hess Vioce Message.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	ATT02683-1.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	23.197.253.105
	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	https://app.eraser.io/workspace/ISn1eLCg7dzDBCScfS1e?origin=share	Get hash	malicious	Unknown	Browse	23.216.136.238
	345778.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.184162797819037
Encrypted:	false
SSDEEP:	6:iOEePUkVq2Pwkn2nKuAl9OmbnIFUtqePUJuegZmwAePUJueIkwOwkn2nKuAl9Omt:7CkVvYfHAahFUtMJueg/OJueI5JfHAae
MD5:	88A463801552E23E2358AE69D73FFA0A
SHA1:	B51BF2D7EC046081F01E09016686C739070B0C7E
SHA-256:	0B8C712BC57D978D35EC27951EFBC45F2818448496C33A80819CCA29C2CBC359
SHA-512:	BF3C1EA0302E2C8281D1AB8DFC570646D6E422C5D5595E668046C8814805088C85951717F5E23687A42B745CD3294782C24AF5578D309AD408B70BEBD949461C
Malicious:	false
Reputation:	low
Preview:	2025/03/31-11:32:16.203 1fd4 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/31-11:32:16.206 1fd4 Recovering log #3.2025/03/31-11:32:16.206 1fd4 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	243
Entropy (8bit):	4.804672457629345
Encrypted:	false
SSDEEP:	6:hxuJzhqIziYvfAbpl+O+mTZ+EdxlzIEsXnBA4X4QL:hYkuOI4xO9XloQL
MD5:	13D70AE483107BE11FD796D86ACA6829
SHA1:	53180A8253440BD14C18B5B1C24722EC429A56B9
SHA-256:	E5805CCCE9532A696C4103997AD9E6D34037DFAC71E46DD615641CD7869B3956
SHA-512:	8CC6A0B3A57AF384EDA7222708F79D84D781BC60AC25CC68EF16CFB0426829A54BEA722C08D934DCD29B362D43FF7C61FC601DF92FB5550B4084069AB4289A2C
Malicious:	false
URL:	https://g7868d.onrender.com/favicon.ico
Preview:	<!DOCTYPE html>.<html lang="en">.<head>. <meta charset="UTF-8">. <meta name="viewport" content="width=device-width, initial-scale=1" />. <title>Service Suspended</title>.</head>.<body>.This service has been suspended..</body>.</html>.

File type:	PDF document, version 1.5
Entropy (8bit):	7.971358274035555
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	AR Care.pdf
File size:	70'640 bytes
MD5:	3f4fce75f73e2833fcfd4daf7e776247
SHA1:	27360ba18d8c41a6b827fefeb5bf3ffe2dc64bc7
SHA256:	5fff95ecd9a376d87ce626273a765836871875e03ce5c60c4002103b11e9da0d
SHA512:	cee1027d81b48596b54fa73c4a71aefd3bac8aa32410c89bc3710ff2670713dbc0280fb631ad21e9d942140f78cd57cf5427e09f939c9e14916f7a93a855fde3
SSDEEP:	1536:1anRLLLLLLLLLLLLLLAeClUic6rzKVqBS1Kc29qNzUrjdfdi+u2c:1aHgUiNKV70qNzYjdfQ2c
TLSH:	C863E0C664A0587A484398FD8C08A3A7748A010B15DC3F73CD68679F257F9B06DAD6FE
File Content Preview:	%PDF-1.5.%.....2 0 obj.<<./Type /Catalog./Pages 4 0 R./AcroForm 5 0 R./Version /1#2E5.>>.endobj.10 0 obj.<<./Filter /FlateDecode./Length 10.>>.stream..x.+......\|..endstream.endobj.11 0 obj.<<./Filter /FlateDecode./Length 244.>>.stream..x.m..N.0...}.).....

General
Header:	%PDF-1.5
Total Entropy:	7.971358
Total Bytes:	70640
Stream Entropy:	7.973598
Stream Bytes:	69107
Entropy outside Streams:	5.066530
Bytes outside Streams:	1533
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	16
endobj	16
stream	14
endstream	14
xref	0
trailer	0
startxref	1
/Page	0
/Encrypt	0
/ObjStm	1
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	1
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 17:32:10.909681082 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 17:32:11.221010923 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 17:32:11.830398083 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 17:32:13.033483028 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 17:32:15.443830013 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 17:32:19.713979959 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 17:32:20.016953945 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 17:32:20.254300117 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 17:32:20.622306108 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 17:32:21.900624037 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 17:32:24.303819895 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 17:32:26.830806971 CEST	49681	80	192.168.2.4	2.17.190.73
Mar 31, 2025 17:32:27.136442900 CEST	49681	80	192.168.2.4	2.17.190.73
Mar 31, 2025 17:32:27.301480055 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.302388906 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.304722071 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.418657064 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.419740915 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.420835972 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.420897007 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.421272993 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.421317101 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.421909094 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.422872066 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.422924995 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.424000978 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.424036026 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.424076080 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.432799101 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.537331104 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.546117067 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.547801971 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.547841072 CEST	443	49709	131.253.33.254	192.168.2.4
Mar 31, 2025 17:32:27.547952890 CEST	49709	443	192.168.2.4	131.253.33.254
Mar 31, 2025 17:32:27.745810986 CEST	49681	80	192.168.2.4	2.17.190.73
Mar 31, 2025 17:32:28.546984911 CEST	49725	80	192.168.2.4	23.48.144.248
Mar 31, 2025 17:32:28.650950909 CEST	80	49725	23.48.144.248	192.168.2.4
Mar 31, 2025 17:32:28.651036978 CEST	49725	80	192.168.2.4	23.48.144.248
Mar 31, 2025 17:32:28.653264046 CEST	49725	80	192.168.2.4	23.48.144.248
Mar 31, 2025 17:32:28.763468981 CEST	80	49725	23.48.144.248	192.168.2.4
Mar 31, 2025 17:32:28.763533115 CEST	49725	80	192.168.2.4	23.48.144.248
Mar 31, 2025 17:32:28.766649961 CEST	80	49725	23.48.144.248	192.168.2.4
Mar 31, 2025 17:32:28.766693115 CEST	80	49725	23.48.144.248	192.168.2.4
Mar 31, 2025 17:32:28.766747952 CEST	49725	80	192.168.2.4	23.48.144.248
Mar 31, 2025 17:32:28.948931932 CEST	49681	80	192.168.2.4	2.17.190.73
Mar 31, 2025 17:32:29.105197906 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 17:32:29.778692007 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:32:29.871139050 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 17:32:29.883506060 CEST	80	49731	142.251.35.163	192.168.2.4
Mar 31, 2025 17:32:29.886337996 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:32:29.887649059 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:32:29.994963884 CEST	80	49731	142.251.35.163	192.168.2.4
Mar 31, 2025 17:32:29.995446920 CEST	80	49731	142.251.35.163	192.168.2.4
Mar 31, 2025 17:32:30.003963947 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:32:30.306134939 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:32:30.616679907 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:32:30.764410019 CEST	80	49731	142.251.35.163	192.168.2.4
Mar 31, 2025 17:32:30.811388016 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:32:31.351331949 CEST	49681	80	192.168.2.4	2.17.190.73
Mar 31, 2025 17:32:36.155360937 CEST	49681	80	192.168.2.4	2.17.190.73
Mar 31, 2025 17:32:38.712337971 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 17:32:39.280690908 CEST	49725	80	192.168.2.4	23.48.144.248
Mar 31, 2025 17:32:45.753315926 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:45.753386974 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:45.753468990 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:45.753644943 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:45.753679037 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:45.767730951 CEST	49681	80	192.168.2.4	2.17.190.73
Mar 31, 2025 17:32:46.636960030 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:46.637106895 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:46.638115883 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:46.638130903 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:46.638564110 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:46.689618111 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:48.347570896 CEST	49743	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.347609997 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:48.347676039 CEST	49743	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.349742889 CEST	49744	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.349796057 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:48.349862099 CEST	49744	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.350090027 CEST	49744	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.350106001 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:48.350270033 CEST	49743	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.350281954 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:48.572107077 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:48.572189093 CEST	49744	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.573338985 CEST	49744	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.573365927 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:48.573609114 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:48.574594975 CEST	49744	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:48.616271019 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:49.139867067 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:49.139925957 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:49.140162945 CEST	49744	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:49.140885115 CEST	49744	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:49.140912056 CEST	443	49744	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:49.307493925 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:49.348277092 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:49.476990938 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:49.481565952 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:49.481765985 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:49.482305050 CEST	49742	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:32:49.482332945 CEST	443	49742	142.251.32.100	192.168.2.4
Mar 31, 2025 17:32:50.647754908 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:50.647844076 CEST	49743	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:50.648471117 CEST	49743	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:50.648480892 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:50.648797035 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:50.649110079 CEST	49743	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:50.692281008 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:51.012360096 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:51.012536049 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:32:51.012593031 CEST	49743	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:51.013995886 CEST	49743	443	192.168.2.4	216.24.57.252
Mar 31, 2025 17:32:51.014014006 CEST	443	49743	216.24.57.252	192.168.2.4
Mar 31, 2025 17:33:37.814296961 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:33:37.919251919 CEST	80	49731	142.251.35.163	192.168.2.4
Mar 31, 2025 17:33:37.919384956 CEST	49731	80	192.168.2.4	142.251.35.163
Mar 31, 2025 17:33:45.706953049 CEST	49751	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:33:45.706984997 CEST	443	49751	142.251.32.100	192.168.2.4
Mar 31, 2025 17:33:45.707050085 CEST	49751	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:33:45.707241058 CEST	49751	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:33:45.707253933 CEST	443	49751	142.251.32.100	192.168.2.4
Mar 31, 2025 17:33:46.645313978 CEST	443	49751	142.251.32.100	192.168.2.4
Mar 31, 2025 17:33:46.645766973 CEST	49751	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:33:46.645786047 CEST	443	49751	142.251.32.100	192.168.2.4
Mar 31, 2025 17:33:56.234148026 CEST	443	49751	142.251.32.100	192.168.2.4
Mar 31, 2025 17:33:56.234286070 CEST	443	49751	142.251.32.100	192.168.2.4
Mar 31, 2025 17:33:56.234363079 CEST	49751	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:33:57.472687960 CEST	49751	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:33:57.472716093 CEST	443	49751	142.251.32.100	192.168.2.4
Mar 31, 2025 17:33:58.143074036 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 17:34:45.769243002 CEST	49765	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:34:45.769305944 CEST	443	49765	142.251.32.100	192.168.2.4
Mar 31, 2025 17:34:45.769401073 CEST	49765	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:34:45.769622087 CEST	49765	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:34:45.769640923 CEST	443	49765	142.251.32.100	192.168.2.4
Mar 31, 2025 17:34:45.987225056 CEST	443	49765	142.251.32.100	192.168.2.4
Mar 31, 2025 17:34:45.987555981 CEST	49765	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:34:45.987591982 CEST	443	49765	142.251.32.100	192.168.2.4
Mar 31, 2025 17:34:55.995112896 CEST	443	49765	142.251.32.100	192.168.2.4
Mar 31, 2025 17:34:55.995174885 CEST	443	49765	142.251.32.100	192.168.2.4
Mar 31, 2025 17:34:55.995245934 CEST	49765	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:34:57.473064899 CEST	49765	443	192.168.2.4	142.251.32.100
Mar 31, 2025 17:34:57.473100901 CEST	443	49765	142.251.32.100	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 17:32:28.389760017 CEST	50644	53	192.168.2.4	1.1.1.1
Mar 31, 2025 17:32:28.487066984 CEST	53	50644	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:41.316071033 CEST	53	50472	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:41.485574961 CEST	53	62057	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:42.289242029 CEST	53	64706	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:42.425961018 CEST	53	53594	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:44.477009058 CEST	53	57386	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:45.650538921 CEST	61083	53	192.168.2.4	1.1.1.1
Mar 31, 2025 17:32:45.650675058 CEST	57168	53	192.168.2.4	1.1.1.1
Mar 31, 2025 17:32:45.751934052 CEST	53	61083	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:45.751976013 CEST	53	57168	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:47.226263046 CEST	53954	53	192.168.2.4	1.1.1.1
Mar 31, 2025 17:32:47.227895975 CEST	58021	53	192.168.2.4	1.1.1.1
Mar 31, 2025 17:32:47.346525908 CEST	53	58021	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:48.240766048 CEST	61666	53	192.168.2.4	1.1.1.1
Mar 31, 2025 17:32:48.346643925 CEST	53	61666	1.1.1.1	192.168.2.4
Mar 31, 2025 17:32:54.480581999 CEST	53	51397	162.159.36.2	192.168.2.4
Mar 31, 2025 17:33:02.422677994 CEST	53	63635	1.1.1.1	192.168.2.4
Mar 31, 2025 17:33:19.169604063 CEST	138	138	192.168.2.4	192.168.2.255
Mar 31, 2025 17:33:20.345159054 CEST	53	53584	1.1.1.1	192.168.2.4
Mar 31, 2025 17:33:40.958105087 CEST	53	65349	1.1.1.1	192.168.2.4
Mar 31, 2025 17:33:42.816164970 CEST	53	57055	1.1.1.1	192.168.2.4
Mar 31, 2025 17:34:13.266771078 CEST	53	62602	1.1.1.1	192.168.2.4
Mar 31, 2025 17:34:59.285013914 CEST	53	54287	1.1.1.1	192.168.2.4

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report AR Care.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ff09b2dc-2381-4352-9578-99a5ef90b2d3.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250331153221Z-234.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Home_LHP_Trial_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_More_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_RHP_Intent_Banner

Windows Analysis Report
AR Care.pdf

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 17:32:28.653264046 CEST	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 31, 2025 17:32:28.766649961 CEST	1031	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=75143 Expires: Tue, 01 Apr 2025 12:24:51 GMT Date: Mon, 31 Mar 2025 15:32:28 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urI*Av5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt
Mar 31, 2025 17:32:28.766693115 CEST	714	IN	Data Raw: 30 d4 5b 71 36 b4 07 ba c1 30 30 5c 48 b7 82 3b 98 a6 7d 60 8a a2 a3 29 82 cc ba bd 83 04 1b a2 83 03 41 a1 d6 05 f1 1b c2 b6 f0 a8 7c 86 3b 46 a8 48 2a 88 dc 76 9a 76 bf 1f 6a a5 3d 19 8f eb 38 f3 64 de c8 2b 0d 0a 28 ff f7 db e2 15 42 d4 22 d0 Data Ascii: 0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0HUXPi ')au\ni/VKsY!

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 17:32:29.887649059 CEST	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 31, 2025 17:32:29.995446920 CEST	223	IN	HTTP/1.1 304 Not Modified Date: Mon, 31 Mar 2025 14:49:48 GMT Expires: Mon, 31 Mar 2025 15:39:48 GMT Age: 2561 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Mar 31, 2025 17:32:30.003963947 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 31, 2025 17:32:30.306134939 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 31, 2025 17:32:30.616679907 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Mar 31, 2025 17:32:30.764410019 CEST	222	IN	HTTP/1.1 304 Not Modified Date: Mon, 31 Mar 2025 15:30:24 GMT Expires: Mon, 31 Mar 2025 16:20:24 GMT Age: 126 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
2025-03-31 15:32:48 UTC	825	OUT	GET /b765a52bd2c50a8e/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJiNzY1YTUyYmQyYzUwYThlIiwiaWF0IjoxNzM5MjkyMDg2fQ.QgLKBfHewGnX9JgoiBZq79fw-TDoD0F41eawEVZJyrY HTTP/1.1 Host: g7868d.onrender.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-31 15:32:49 UTC	286	IN	HTTP/1.1 503 Service Unavailable Date: Mon, 31 Mar 2025 15:32:49 GMT Content-Type: text/html; charset=utf-8 Content-Length: 243 Connection: close x-render-routing: suspend cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9290e6ccbaefc3f3-EWR alt-svc: h3=":443"; ma=86400
2025-03-31 15:32:49 UTC	243	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 72 76 69 63 65 20 53 75 73 70 65 6e 64 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 54 68 69 73 20 73 65 72 76 69 63 65 20 68 61 73 20 62 65 65 6e 20 73 75 73 70 65 6e 64 65 64 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1" /> <title>Service Suspended</title></head><body>This service has been suspended.</body></html>

Timestamp	Bytes transferred	Direction	Data
2025-03-31 15:32:49 UTC	579	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BCL7VzgEIgdbOAQjI3M4BCIrgzgEIruTOAQiL5c4B Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-31 15:32:49 UTC	1303	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 15:32:49 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-OoyUVT8r-nsjC5xicKEu0w' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Downlink Accept-CH: RTT Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2025-03-31 15:32:49 UTC	904	IN	Data Raw: 33 38 31 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6a 61 6c 69 6c 20 62 65 74 68 65 61 20 74 72 61 6e 73 66 65 72 20 70 6f 72 74 61 6c 20 64 65 63 69 73 69 6f 6e 22 2c 22 69 72 73 20 74 61 78 20 72 65 66 75 6e 64 20 61 70 72 69 6c 22 2c 22 6e 79 74 20 63 72 6f 73 73 77 6f 72 64 20 63 6c 75 65 73 22 2c 22 70 73 20 70 6c 75 73 20 61 70 72 69 6c 20 67 61 6d 65 73 22 2c 22 64 65 6c 74 61 20 61 69 72 6c 69 6e 65 73 20 66 6c 69 67 68 74 20 64 69 76 65 72 73 69 6f 6e 20 70 68 6f 65 6e 69 78 22 2c 22 6a 61 73 6f 6e 20 61 6e 64 65 72 73 6f 6e 20 73 65 61 74 74 6c 65 20 73 75 70 65 72 63 72 6f 73 73 22 2c 22 6c 6f 74 74 65 72 79 20 6d 65 67 61 20 6d 69 6c 6c 69 6f 6e 73 20 70 6f 77 65 72 62 61 6c 6c 20 6a 61 63 6b 70 6f 74 22 2c 22 6a 61 63 6b 20 72 65 61 63 68 65 72 Data Ascii: 381)]}'["",["jalil bethea transfer portal decision","irs tax refund april","nyt crossword clues","ps plus april games","delta airlines flight diversion phoenix","jason anderson seattle supercross","lottery mega millions powerball jackpot","jack reacher
2025-03-31 15:32:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-03-31 15:32:50 UTC	757	OUT	GET /favicon.ico HTTP/1.1 Host: g7868d.onrender.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://g7868d.onrender.com/b765a52bd2c50a8e/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJiNzY1YTUyYmQyYzUwYThlIiwiaWF0IjoxNzM5MjkyMDg2fQ.QgLKBfHewGnX9JgoiBZq79fw-TDoD0F41eawEVZJyrY Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-31 15:32:51 UTC	286	IN	HTTP/1.1 503 Service Unavailable Date: Mon, 31 Mar 2025 15:32:50 GMT Content-Type: text/html; charset=utf-8 Content-Length: 243 Connection: close x-render-routing: suspend cf-cache-status: DYNAMIC Server: cloudflare CF-RAY: 9290e6d9b9ea7281-EWR alt-svc: h3=":443"; ma=86400
2025-03-31 15:32:51 UTC	243	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 20 2f 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 53 65 72 76 69 63 65 20 53 75 73 70 65 6e 64 65 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 54 68 69 73 20 73 65 72 76 69 63 65 20 68 61 73 20 62 65 65 6e 20 73 75 73 70 65 6e 64 65 64 2e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1" /> <title>Service Suspended</title></head><body>This service has been suspended.</body></html>

Target ID:	1
Start time:	11:32:13
Start date:	31/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\AR Care.pdf"
Imagebase:	0x7ff6f9de0000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	11:32:15
Start date:	31/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff60c9b0000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	19
Start time:	11:32:38
Start date:	31/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	20
Start time:	11:32:39
Start date:	31/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2008,i,3824752678761937169,17390088200995456266,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2060 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	21
Start time:	11:32:46
Start date:	31/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://g7868d.onrender.com/b765a52bd2c50a8e/eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJrZXkiOiJiNzY1YTUyYmQyYzUwYThlIiwiaWF0IjoxNzM5MjkyMDg2fQ.QgLKBfHewGnX9JgoiBZq79fw-TDoD0F41eawEVZJyrY"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true