Edit tour

Windows Analysis Report
mara.roth-Handbook_DocuSign6h0-3958.pdf

Overview

General Information

Sample name:	mara.roth-Handbook_DocuSign6h0-3958.pdf
Analysis ID:	1652902
MD5:	85362b656b460d4fbe705b7b85130f4a
SHA1:	7ee05c5a941d6e45e7236bbd507c0a5e07e9b4d5
SHA256:	87aa5841fa52af7d4f2e455d2df5a35a4d2ff72ee490606b7bf0ea8689668ac6
Infos:

Detection

Fake Captcha

Score:	52
Range:	0 - 100
Confidence:	100%

Signatures

Yara detected Fake Captcha

AI detected landing page (webpage, office document or email)

Creates files inside the system directory

Deletes files inside the Windows folder

IP address seen in connection with other malware

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 7712 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\mara.roth-Handbook_DocuSign6h0-3958.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7908 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 8116 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1564,i,1962462157706799152,526781585758020601,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 7228 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument about:blank MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8256 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2304,i,8126060533632964085,3292062182765774855,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2340 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 9008 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://redcon1entertainment.com/jjsaecea MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_172	JoeSecurity_FakeCaptcha	Yara detected Fake Captcha	Joe Security

HTML

Source	Rule	Description	Author	Strings
0.0.pages.csv	JoeSecurity_FakeCaptcha	Yara detected Fake Captcha	Joe Security

HTTP traffic detected: HTTP/1.1 403 ForbiddenContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 31 Mar 2025 13:15:51 GMTVary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-SiteP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Strict-Transport-Security: max-age=31536000Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GoogleCloudUxWebAppCgcUi/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-euY4zRVAGDa1tw2yoRpAfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/GoogleCloudUxWebAppCgcUi/cspreport;worker-src 'self' blob:Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/ https://maps.googleapis.com https://googleads.g.doubleclick.net https://s.ytimg.com https://ssl.google-analytics.com https://www.googleadservices.com/pagead/ https://www.youtube.com https://youtube.com https://youtube.googleapis.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/GoogleCloudUxWebAppCgcUi/cspreport/allowlistAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*Transfer-Encoding: chunkedServer: ESFX-XSS-Protection: 0X-Content-Type-Options: nosniffSet-Cookie: NID=522=reirbNDZx0rmdd8dMghMgcMt_0PZ3bZISuZjIOk4lpkIfawuZ7jAk9cYtLwBX8KuygI6UcL27IJ_iroVNyZRb1N98WAlnrZRYtpvExVNE1jTDVWNH1shHh5lRpG8K4n-dFAuHUgX3Q19QtvSYIn1klHjas72JAohR_1E0JNHgrrsPHCB_VNm6ck79t21gqW7aM2KSw; expires=Tue, 30-Sep-2025 13:15:51 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=noneAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Connection: close

Source: 77EC63BDA74BD0D0E0426DC8F80085060.1.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.1.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: chromecache_172.4.dr	String found in binary or memory: https://img.icons8.com/android/24/000000/refresh.png
Source: chromecache_172.4.dr	String found in binary or memory: https://pub-246cb0db54c0496c9e2663418098b419.r2.dev/S.html

Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443

Source: unknown	HTTPS traffic detected: 198.57.151.223:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 198.57.151.223:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.68:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 109.61.91.195:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 109.61.91.197:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.251.40.238:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.80.68:443 -> 192.168.2.4:49755 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir7228_118078244

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir7228_118078244

Jump to behavior

Source: classification engine

Classification label: mal52.phis.winPDF@37/55@16/8

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7764

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-03-31 09-15-46-983.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\mara.roth-Handbook_DocuSign6h0-3958.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1564,i,1962462157706799152,526781585758020601,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2304,i,8126060533632964085,3292062182765774855,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2340 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://redcon1entertainment.com/jjsaecea
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1564,i,1962462157706799152,526781585758020601,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2304,i,8126060533632964085,3292062182765774855,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2340 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: mara.roth-Handbook_DocuSign6h0-3958.pdf	Initial sample: PDF keyword /JS count = 0
Source: mara.roth-Handbook_DocuSign6h0-3958.pdf	Initial sample: PDF keyword /JavaScript count = 0
Source: A91ah4ttl_kkdf6n_5zo.tmp.0.dr	Initial sample: PDF keyword /JS count = 0
Source: A91ah4ttl_kkdf6n_5zo.tmp.0.dr	Initial sample: PDF keyword /JavaScript count = 0

Source: mara.roth-Handbook_DocuSign6h0-3958.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File Deletion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
mara.roth-Handbook_DocuSign6h0-3958.pdf	0%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://pub-246cb0db54c0496c9e2663418098b419.r2.dev/S.html	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
1004834818.rsc.cdn77.org	109.61.91.195	true	false	high
e8652.dscx.akamaiedge.net	23.216.136.238	true	false	high
redcon1entertainment.com	198.57.151.223	true	false	unknown
cloud.google.com	142.251.40.238	true	false	high
www.google.com	142.250.80.68	true	false	high
x1.i.lencr.org	unknown	unknown	false	high
img.icons8.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://x1.i.lencr.org/	false	high
https://img.icons8.com/android/24/000000/refresh.png	false	high
https://cloud.google.com/security/products/recaptcha	false	high
https://redcon1entertainment.com/jjsaecea	false	unknown
https://www.google.com/recaptcha/intro/images/hero-street-bg.jpg	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://pub-246cb0db54c0496c9e2663418098b419.r2.dev/S.html	chromecache_172.4.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.80.68	www.google.com	United States	15169	GOOGLEUS	false
109.61.91.195	1004834818.rsc.cdn77.org	Hungary	197248	DRAVANET-ASHU	false
23.216.136.238	e8652.dscx.akamaiedge.net	United States	7016	CCCH-3US	false
142.251.40.238	cloud.google.com	United States	15169	GOOGLEUS	false
109.61.91.197	unknown	Hungary	197248	DRAVANET-ASHU	false
198.57.151.223	redcon1entertainment.com	United States	46606	UNIFIEDLAYER-AS-1US	false

Private

IP
192.168.2.4
192.168.2.6

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1652902
Start date and time:	2025-03-31 15:14:28 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 41s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	mara.roth-Handbook_DocuSign6h0-3958.pdf
Detection:	MAL
Classification:	mal52.phis.winPDF@37/55@16/8
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.9.183.29, 142.250.64.78, 142.251.179.84, 142.250.80.3, 142.251.40.142, 172.64.41.3, 162.159.61.3, 142.250.81.234, 142.251.32.106, 142.251.35.170, 142.251.40.106, 142.251.40.138, 142.251.40.170, 142.250.64.74, 142.250.64.106, 142.250.72.106, 142.250.80.10, 142.250.80.42, 142.250.80.74, 142.251.41.10, 142.250.65.170, 142.250.65.202, 142.250.65.234, 23.51.56.185, 23.203.176.221, 23.53.35.200, 23.53.35.208, 23.210.73.5, 23.210.92.197, 142.250.72.99, 131.253.33.254, 204.79.197.222, 20.12.23.50, 23.217.172.185, 52.6.155.20
Excluded domains from analysis (whitelisted): a-ring-fallback.msedge.net, fp.msedge.net, chrome.cloudflare-dns.com, e4578.dscg.akamaiedge.net, slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e16604.dscf.akamaiedge.net, acroipm2.adobe.com, clients2.google.com, redirector.gvt1.com, ocsp.digicert.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:15:57	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

QR Codes

Source	URL
Screenshot	https://redcon1entertainment.com/jjsaecea
Screenshot	https://redcon1entertainment.com/jjsaecea

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
23.216.136.238	Petroleum Systems Services Corporation WAV Caller.pdf	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	Hess Vioce Message.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	ATT02683-1.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	https://app.eraser.io/workspace/ISn1eLCg7dzDBCScfS1e?origin=share	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	345778.pdf	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	x1.i.lencr.org/
	windscribe.msi	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	https://www.transfernow.net/dl/20250327nEx48coZ	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	x1.i.lencr.org/
	taxCPAm.bat	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
109.61.91.197	finding3-26-25.zip	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
1004834818.rsc.cdn77.org	https://tfxluum7zobs.dippitydo.net?nczk=amFtaWUuYmVkbmFyQGNvdGVycmEuY29t	Get hash	malicious	Unknown	Browse	37.19.194.81
	https://hiiudvt8z.awbpartners.com.au/?yxbe=Y2Fyb2x5bi5tLndldHRlcmxpbkB4Y2VsZW5lcmd5LmNvbQ==	Get hash	malicious	Unknown	Browse	207.211.211.27
	https://richardsmylawyer.com/?YmJhbHRpbW9yZUBoYXJyaXN3aWxsaWFtcy5jb20=	Get hash	malicious	Unknown	Browse	37.19.194.80
	https://jdd3gqacof3n1x8.gmclhr.com	Get hash	malicious	Unknown	Browse	169.150.255.181
	https://gkq.soundestlink.com/ce/c/67bef427de06c30aeb085804/67bef4d94c5d631c24ae2eba/67bef4f247b1d331dcdb3b37?signature=bbeaa7f2656f41600d8b1041675ff610b82e4d46573c43684b09f33bce298ffb	Get hash	malicious	HtmlDropper	Browse	169.150.255.183
	https://gkq.soundestlink.com/ce/c/67bef427de06c30aeb085804/67bef4d94c5d631c24ae2eba/67bef4f247b1d331dcdb3b37?signature=bbeaa7f2656f41600d8b1041675ff610b82e4d46573c43684b09f33bce298ffb	Get hash	malicious	HtmlDropper	Browse	169.150.255.181
	https://us.content.exclaimer.net/?url=https%3A%2F%2Fgkq.soundestlink.com%2Fce%2Fc%2F67bef427de06c30aeb085804%2F67bf22b64c5d631c24ae3006%2F67bf22ce47b1d331dcdba128%3Fsignature%3Ddd521ec2ccbfc0003286a1eaa019e996f05b435e985c31912087f08c8a19342e&tenantid=ky73_-4KEe-QywAiSCk5gQ&templateid=9f5b2f234df4ef1190cb002248293981&excomponentid=nFEX-f7jNWeTfOzn2CEZDBNyzTqFqptsBHQZrvkNPgE&excomponenttype=Link&signature=VvbJSPPtLh3M2DPqBpZSgcTrNG2MsTwyb1OO2EXo2cXiwpFgtlA5Yor3vXIZOsLNIiHMX2FhHB4KNbIR-yfyHPLZBTnGT2HrRGBTbMOAmJ0y6AykX6KxnWzWWBZkevRwaaeUI4948TrPQc__eaEqGWYWi494ycWK2Qr-DsJqP6ipWBs9gbERuD4Px9K1TojbS4w-rpk1Ubt1JRFH4BdlneybGKWWUE_QG_rY3FvKjpE1oW5B5iK_w7Yru1a1zLWQkYQWPGwXTV6-8gzrqOd3hIyD8nDlLUlcFC-nCd-zwzgVrKO6iuOvGQtEwt8gH4y7B-spxQ-ppbo16wzeIc9ihw&v=1&imprintMessageId=d23772c5-50c0-4b46-9dab-a9cceabc7beb&c=E,1,_6ofPl04BGcoitM6SMrzQWgc6RGbUqFmiAHaAvVw_ykmG0oebzneVJtiF4VDxJlfmYJqjpr_Qz4AJrpvM2H_2STbWUiXhoiC6PdNURkMn-e5&typo=1	Get hash	malicious	HtmlDropper	Browse	195.181.175.41
	https://cle.soundestlink.com/ce/c/67af4e08a90b85f6c51e3649/67af4e37c622ca8b13b0643e/67af4e500930257798ab6691?signature=6622e2772a21e189f04bbff6dbd8020cb3c1977d0aa04e3285c329f387017382	Get hash	malicious	Unknown	Browse	169.150.255.184
	https://cle.soundestlink.com/ce/c/67af4e08a90b85f6c51e3649/67af4e37c622ca8b13b0643e/67af4e500930257798ab6691?signature=6622e2772a21e189f04bbff6dbd8020cb3c1977d0aa04e3285c329f387017382	Get hash	malicious	Unknown	Browse	169.150.255.180
	https://www.google.com/url?q=https%3A%2F%2Fus.content.exclaimer.net%2F%3Furl%3Dhttps%253A%252F%252F3x20r.r.sp1-brevo.net%252Fmk%252Fcl%252Ff%252Fsh%252F1t6Af4OiGsE8LW2I0PUT7QXsMWGieI%252F-xw8La-ebgZX%26tenantid%3Dky73_-4KEe-QywAiSCk5gQ%26templateid%3De201feacc3efef1190cb002248293981%26excomponentid%3DnFEX-f7jNWeTfOzn2CEZDBNyzTqFqptsBHQZrvkNPgE%26excomponenttype%3DLink%26signature%3DiM2LfAlPpPRmP0prRCJs6TAFoQMLZnqULNwSXA_47D1HdEQJ8-sfJfdWSvX6gPAMgqrVzm2Cy_xwedsxqBT0yYKa96o8saBFp4BFBzLpFiUVWx4ongob_w6SSCcP3UjkYYmXWt77SKYYzQQ67Ep1OhLigx87PnA_L4nyIL_Yt39daiJK-uGZtZXFyORM_HFANryMO_BfrldLb5pqd7gnCBJm5v3X82mo50ET4PICEJ9P-7e9fp1iy1BZGbF_g_vJXQVtDlF_V3Uods5Nfdv8AZoFgH5AskFS8J7ItPXscy7BZFpt6b_ye4vXfEU5uxVdPdjDe2fDLHRg16tpYtNoww%26v%3D1%26imprintMessageId%3D4a68531e-ad34-4aad-a29b-5bf493c5ec36&sa=D&sntz=1&usg=AOvVaw0yDfPTMkSG67FTLe5horH_	Get hash	malicious	Unknown	Browse	169.150.255.183
e8652.dscx.akamaiedge.net	email.eml	Get hash	malicious	Unknown	Browse	23.197.253.105
	Petroleum Systems Services Corporation WAV Caller.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	7ivgZ6j7.pdf	Get hash	malicious	Unknown	Browse	23.46.224.249
	Hess Vioce Message.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	ATT02683-1.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse	23.197.253.105
	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	https://app.eraser.io/workspace/ISn1eLCg7dzDBCScfS1e?origin=share	Get hash	malicious	Unknown	Browse	23.216.136.238
	345778.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.216.136.238

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DRAVANET-ASHU	https://luckyvybz.top/bonus/com-de-0912/global-bb.php?c=4gzk0c3pz5kz2&k=4500f9583a2e0b6101ea28c483a17e13&1743351160country_code=DE&carrier=-&country_name=Germany&region=Schleswig-Holstein&city=Bargteheide&isp=Vereinigte%20Stadtwerke%20Media%20GmbH&lang=de&os=&osv=&browser=Chrome&browserv=134&brand=Desktop&model=Desktop&marketing_name=Desktop&tablet=4&rheight=768&rwidth=768&e=5	Get hash	malicious	Unknown	Browse	109.61.91.230
	k03ldc.ppc.elf	Get hash	malicious	Unknown	Browse	109.61.16.1
	RuntimeBroker.exe	Get hash	malicious	XWorm	Browse	109.61.108.172
	https://aoocezieaoocezie.myfreshworks.com/invite/dc31162a-1c0b-4de0-9bee-658f89e887a0	Get hash	malicious	HTMLPhisher	Browse	109.61.86.70
	finding3-26-25.zip	Get hash	malicious	Unknown	Browse	109.61.91.230
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse	77.221.51.234
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	109.61.16.3
	armv7l.elf	Get hash	malicious	Unknown	Browse	109.61.88.172
	armv5l.elf	Get hash	malicious	Unknown	Browse	109.61.91.231
	armv4l.elf	Get hash	malicious	Unknown	Browse	109.61.88.187
UNIFIEDLAYER-AS-1US	MICWLeJAhJyHGJg.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	69.49.232.23
	http://6571564315.sbs	Get hash	malicious	Unknown	Browse	69.49.230.198
	https://get-razzed.online/krc	Get hash	malicious	HTMLPhisher	Browse	69.49.230.170
	RE0987656780000.bat.exe	Get hash	malicious	AgentTesla	Browse	162.241.62.63
	NDhcNzYq860Q9EI.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	69.49.232.23
	CONCLUSION_519886047_5860889964485988.pdf	Get hash	malicious	Unknown	Browse	50.6.3.64
	RCY-ENG-SPA-44-25-SPARES.xlsx.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	20253103-173812.pdf.bat.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	50.87.144.157
	http://pluralism.themancav.com	Get hash	malicious	Unknown	Browse	162.241.252.155
	http://pluralism.themancav.com	Get hash	malicious	Unknown	Browse	162.241.252.155
DRAVANET-ASHU	https://luckyvybz.top/bonus/com-de-0912/global-bb.php?c=4gzk0c3pz5kz2&k=4500f9583a2e0b6101ea28c483a17e13&1743351160country_code=DE&carrier=-&country_name=Germany&region=Schleswig-Holstein&city=Bargteheide&isp=Vereinigte%20Stadtwerke%20Media%20GmbH&lang=de&os=&osv=&browser=Chrome&browserv=134&brand=Desktop&model=Desktop&marketing_name=Desktop&tablet=4&rheight=768&rwidth=768&e=5	Get hash	malicious	Unknown	Browse	109.61.91.230
	k03ldc.ppc.elf	Get hash	malicious	Unknown	Browse	109.61.16.1
	RuntimeBroker.exe	Get hash	malicious	XWorm	Browse	109.61.108.172
	https://aoocezieaoocezie.myfreshworks.com/invite/dc31162a-1c0b-4de0-9bee-658f89e887a0	Get hash	malicious	HTMLPhisher	Browse	109.61.86.70
	finding3-26-25.zip	Get hash	malicious	Unknown	Browse	109.61.91.230
	cbr.m68k.elf	Get hash	malicious	Mirai	Browse	77.221.51.234
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	109.61.16.3
	armv7l.elf	Get hash	malicious	Unknown	Browse	109.61.88.172
	armv5l.elf	Get hash	malicious	Unknown	Browse	109.61.91.231
	armv4l.elf	Get hash	malicious	Unknown	Browse	109.61.88.187
CCCH-3US	Petroleum Systems Services Corporation WAV Caller.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	Hess Vioce Message.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	ATT02683-1.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	https://www.transfernow.net/en/bld?utm_source=20250321oYBy7zgb	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	https://app.eraser.io/workspace/ISn1eLCg7dzDBCScfS1e?origin=share	Get hash	malicious	Unknown	Browse	23.216.136.238
	345778.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	MetroHealthNow.com.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.216.136.238
	windscribe.msi	Get hash	malicious	Unknown	Browse	23.216.136.238
	forceGB.exe	Get hash	malicious	Unknown	Browse	23.216.136.238
	Tax_Docu.docx pif.exe	Get hash	malicious	Unknown	Browse	23.216.136.238

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.233817996957776
Encrypted:	false
SSDEEP:	6:iOEqRp1jL+q2Pwkn2nKuAl9OmbnIFUtqqREq1ZmwAqRE8LVkwOwkn2nKuAl9Omb5:79TjyvYfHAahFUtzx/5tR5JfHAaSJ
MD5:	A00B2F230F781E6612A28E0ADF887286
SHA1:	D65DD53BEB2BEC453839B8291A65E53F06EC0803
SHA-256:	319DA998F49F851EE6B6E93A1A6437FC0CFC679AED3E084845E268D2CD56F15A
SHA-512:	55F29498225DDF3C99033DD6BD9603AA33B10473746432FD0F7E799116A337FEC02E3E058AF43224E52B4C044A031B588864B1095D6D9393466F724709D293DD
Malicious:	false
Reputation:	low
Preview:	2025/03/31-09:15:42.817 1f18 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/03/31-09:15:42.820 1f18 Recovering log #3.2025/03/31-09:15:42.820 1f18 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Source: Yara match	File source: 0.0.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_172, type: DROPPED

Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.35.163
Source: unknown	TCP traffic detected without corresponding DNS query: 23.57.90.139
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.129
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.190.129
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /jjsaecea HTTP/1.1Host: redcon1entertainment.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /recaptcha/intro/images/hero-street-bg.jpg HTTP/1.1Host: www.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://redcon1entertainment.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /android/24/000000/refresh.png HTTP/1.1Host: img.icons8.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://redcon1entertainment.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /android/24/000000/refresh.png HTTP/1.1Host: img.icons8.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /security/products/recaptcha HTTP/1.1Host: cloud.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://redcon1entertainment.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: redcon1entertainment.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: img.icons8.com
Source: global traffic	DNS traffic detected: DNS query: cloud.google.com
Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, ASCII text, with very long lines (57582)
Category:	downloaded
Size (bytes):	61677
Entropy (8bit):	6.1226646368429805
Encrypted:	false
SSDEEP:	1536:qJ4inW7WtgOWHQ9uIigRpDx+vWUq/t4md+GHMF7fTs:q07WWw9WMx+N6dHHMG
MD5:	A09AD0565C677439CDC90D6679EFDC39
SHA1:	2F5200C0AFB7F001763C484096A9A5263308911E
SHA-256:	F9ECDEC0AEE8513978E121A389436F6EAA037A7844B5B4E4AC4AA67052DC6DA3
SHA-512:	6E8713D7DF4314589F4716DB151572F9AD088D9984DA026C32C773216FB06DB830BCC75753D1249C49E74C220DF8544F4A0C37552FEC9E8482500E7BF8D6D8CE
Malicious:	false
URL:	https://redcon1entertainment.com/jjsaecea
Preview:	<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"><meta name="robots" content="noindex, nofollow"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"><link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"><title>reCAPTCHA</title><style>body,html{height:100%}body{margin:0;background-image:url(https://www.google.com/recaptcha/intro/images/hero-street-bg.jpg);background-size:cover;background-position:center;display:flex;justify-content:center;align-items:center;font-family:Roboto,sans-serif}.captcha{background-color:#f9f9f9;border:2px solid #d3d3d3;border-radius:5px;color:#4c4a4b;display:flex;justify-content:center;align-items:center}@media screen and (max-width:500px){.captcha{flex-direction:column}.text{margin:.5em!important;text-align:center}.logo{align-self:center!important}.spinner{margin:2em .5em .5em .5em!important}}.text{font-size:1.75em;font-weight:500;margin-ri

File type:	PDF document, version 1.7, 0 pages
Entropy (8bit):	7.893813274892373
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	mara.roth-Handbook_DocuSign6h0-3958.pdf
File size:	27'508 bytes
MD5:	85362b656b460d4fbe705b7b85130f4a
SHA1:	7ee05c5a941d6e45e7236bbd507c0a5e07e9b4d5
SHA256:	87aa5841fa52af7d4f2e455d2df5a35a4d2ff72ee490606b7bf0ea8689668ac6
SHA512:	7d7738d7385358432bc778cafbe8c0cc11b71c3e438acbc3e22f1f8b3df75bf0405a900efbd6b6ea5e5b4c8c60de3e2ab26d15a50d36a53125386ab7c1c96cd3
SSDEEP:	768:9Gs58ASIY7BfRUeIe9RzkoXLQ4c0XBRHtZXWKAW2UF:9Gs5PSn7BfRUexRzXXLQ4jXBRJ6UF
TLSH:	BBC2D025F870D898FD4FCD64C46E74CD2D183253B9C038C15E185EA27B91E96F49EAD1
File Content Preview:	%PDF-1.7.1 0 obj.<< /Type /Catalog./Outlines 2 0 R./Pages 3 0 R >>.endobj.2 0 obj.<< /Type /Outlines /Count 0 >>.endobj.3 0 obj.<< /Type /Pages./Kids [6 0 R.]./Count 1./Resources <<./ProcSet 4 0 R./Font << ./F1 8 0 R./F2 9 0 R.>>./XObject << ./I1 10 0 R./

General
Header:	%PDF-1.7
Total Entropy:	7.893813
Total Bytes:	27508
Stream Entropy:	7.917222
Stream Bytes:	25386
Entropy outside Streams:	5.077512
Bytes outside Streams:	2122
Number of EOF found:	1
Bytes after EOF:

Name	Count
obj	16
endobj	16
stream	3
endstream	3
xref	1
trailer	1
startxref	1
/Page	1
/Encrypt	0
/ObjStm	0
/URI	0
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

ID	DHASH	MD5	Preview
10	003938986c2b3b00	f67dcb9ca51603d111c483d9436980c3
12	356d17250b155157	1dfb6de8a8d979d96939b32da1a4263c

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 15:15:38.644160032 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 15:15:38.956549883 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 15:15:39.221867085 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 15:15:39.566273928 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 15:15:40.768682003 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 15:15:43.177484035 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 15:15:43.503076077 CEST	49681	80	192.168.2.4	2.17.190.73
Mar 31, 2025 15:15:47.976720095 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 15:15:48.834821939 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:48.834918976 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:48.835025072 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:48.835705996 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:48.835735083 CEST	443	49733	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:48.835788965 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:48.891993046 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:48.892019033 CEST	443	49733	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:48.892180920 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:48.892216921 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.007097006 CEST	49671	443	192.168.2.4	204.79.197.203
Mar 31, 2025 15:15:49.208426952 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.208527088 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.209568024 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.209598064 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.209912062 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.210182905 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.210767031 CEST	443	49733	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.210840940 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.211194992 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.211205959 CEST	443	49733	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.211452007 CEST	443	49733	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.256273985 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.258794069 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.517302036 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.517327070 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.517393112 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.517426968 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.572712898 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.665759087 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.665772915 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.665848970 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.665916920 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.665949106 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.665987968 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.666033983 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.745265007 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.745352983 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.820792913 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.820895910 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.820945978 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.821018934 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.821109056 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.821190119 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.821228981 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.821285963 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.822252989 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.822318077 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.822371006 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.853441954 CEST	49732	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:49.853528976 CEST	443	49732	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:49.861953974 CEST	49735	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:49.861993074 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:49.862111092 CEST	49735	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:49.862256050 CEST	49735	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:49.862272024 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:50.080944061 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:50.081082106 CEST	49735	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:50.086997032 CEST	49735	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:50.087021112 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:50.087347031 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:50.087735891 CEST	49735	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:50.128273964 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:50.131285906 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:50.131375074 CEST	443	49733	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:50.131525993 CEST	443	49733	198.57.151.223	192.168.2.4
Mar 31, 2025 15:15:50.131586075 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:50.131726980 CEST	49733	443	192.168.2.4	198.57.151.223
Mar 31, 2025 15:15:50.231988907 CEST	49745	443	192.168.2.4	109.61.91.195
Mar 31, 2025 15:15:50.232039928 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:50.232177019 CEST	49745	443	192.168.2.4	109.61.91.195
Mar 31, 2025 15:15:50.232314110 CEST	49745	443	192.168.2.4	109.61.91.195
Mar 31, 2025 15:15:50.232321978 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:50.611596107 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:50.611690044 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:50.611839056 CEST	49735	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:50.653206110 CEST	49735	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:50.653233051 CEST	443	49735	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:50.884660959 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:50.884711981 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:50.884780884 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:50.894371986 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:50.894460917 CEST	49745	443	192.168.2.4	109.61.91.195
Mar 31, 2025 15:15:50.919707060 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:50.919735909 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:50.953692913 CEST	49745	443	192.168.2.4	109.61.91.195
Mar 31, 2025 15:15:50.953731060 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:50.954755068 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:50.996758938 CEST	49745	443	192.168.2.4	109.61.91.195
Mar 31, 2025 15:15:51.044282913 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:51.098946095 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:51.099114895 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:51.099201918 CEST	49745	443	192.168.2.4	109.61.91.195
Mar 31, 2025 15:15:51.100156069 CEST	49745	443	192.168.2.4	109.61.91.195
Mar 31, 2025 15:15:51.100178003 CEST	443	49745	109.61.91.195	192.168.2.4
Mar 31, 2025 15:15:51.204900026 CEST	49751	443	192.168.2.4	109.61.91.197
Mar 31, 2025 15:15:51.204960108 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.205048084 CEST	49751	443	192.168.2.4	109.61.91.197
Mar 31, 2025 15:15:51.205367088 CEST	49751	443	192.168.2.4	109.61.91.197
Mar 31, 2025 15:15:51.205379009 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.411310911 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.411376953 CEST	49751	443	192.168.2.4	109.61.91.197
Mar 31, 2025 15:15:51.411849022 CEST	49751	443	192.168.2.4	109.61.91.197
Mar 31, 2025 15:15:51.411858082 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.412072897 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.412298918 CEST	49751	443	192.168.2.4	109.61.91.197
Mar 31, 2025 15:15:51.456278086 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.520309925 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.520382881 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:51.521061897 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.521126986 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:51.522438049 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:51.522442102 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.522656918 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.522933006 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:51.568272114 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.620779037 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.620953083 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.621009111 CEST	49751	443	192.168.2.4	109.61.91.197
Mar 31, 2025 15:15:51.629682064 CEST	49751	443	192.168.2.4	109.61.91.197
Mar 31, 2025 15:15:51.629703045 CEST	443	49751	109.61.91.197	192.168.2.4
Mar 31, 2025 15:15:51.753582954 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.753678083 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:51.753688097 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.757019997 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.757057905 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:51.757062912 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.765156984 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:51.765229940 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:51.791914940 CEST	49750	443	192.168.2.4	142.251.40.238
Mar 31, 2025 15:15:51.791925907 CEST	443	49750	142.251.40.238	192.168.2.4
Mar 31, 2025 15:15:52.453557968 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:52.454201937 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:52.454201937 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:52.562954903 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:52.563859940 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:52.563872099 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:52.564825058 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:52.564872026 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:52.564901114 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:52.564928055 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:52.565499067 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:52.568676949 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:52.568691015 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:52.568783045 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:52.574001074 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:52.697807074 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:53.086000919 CEST	49755	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:53.086038113 CEST	443	49755	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:53.086113930 CEST	49755	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:53.086249113 CEST	49755	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:53.086261034 CEST	443	49755	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:53.281899929 CEST	443	49708	52.113.196.254	192.168.2.4
Mar 31, 2025 15:15:53.281990051 CEST	49708	443	192.168.2.4	52.113.196.254
Mar 31, 2025 15:15:53.312443018 CEST	443	49755	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:53.312525988 CEST	49755	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:53.448261976 CEST	49755	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:53.448292017 CEST	443	49755	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:53.448601007 CEST	443	49755	142.250.80.68	192.168.2.4
Mar 31, 2025 15:15:53.506738901 CEST	49755	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:15:57.580995083 CEST	49678	443	192.168.2.4	20.189.173.27
Mar 31, 2025 15:15:58.721421003 CEST	49760	80	192.168.2.4	23.216.136.238
Mar 31, 2025 15:15:58.821218967 CEST	80	49760	23.216.136.238	192.168.2.4
Mar 31, 2025 15:15:58.821319103 CEST	49760	80	192.168.2.4	23.216.136.238
Mar 31, 2025 15:15:58.821487904 CEST	49760	80	192.168.2.4	23.216.136.238
Mar 31, 2025 15:15:58.901015043 CEST	80	49760	23.216.136.238	192.168.2.4
Mar 31, 2025 15:15:58.901256084 CEST	49760	80	192.168.2.4	23.216.136.238
Mar 31, 2025 15:15:58.920042038 CEST	80	49760	23.216.136.238	192.168.2.4
Mar 31, 2025 15:15:58.920963049 CEST	80	49760	23.216.136.238	192.168.2.4
Mar 31, 2025 15:15:58.920977116 CEST	80	49760	23.216.136.238	192.168.2.4
Mar 31, 2025 15:15:58.921031952 CEST	49760	80	192.168.2.4	23.216.136.238
Mar 31, 2025 15:16:03.293049097 CEST	443	49755	142.250.80.68	192.168.2.4
Mar 31, 2025 15:16:03.293132067 CEST	443	49755	142.250.80.68	192.168.2.4
Mar 31, 2025 15:16:03.293188095 CEST	49755	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:16:03.935858965 CEST	49755	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:16:03.935900927 CEST	443	49755	142.250.80.68	192.168.2.4
Mar 31, 2025 15:16:07.225349903 CEST	49760	80	192.168.2.4	23.216.136.238
Mar 31, 2025 15:16:27.798841953 CEST	49714	80	192.168.2.4	142.251.35.163
Mar 31, 2025 15:16:27.898377895 CEST	80	49714	142.251.35.163	192.168.2.4
Mar 31, 2025 15:16:27.898515940 CEST	49714	80	192.168.2.4	142.251.35.163
Mar 31, 2025 15:16:28.817926884 CEST	49717	443	192.168.2.4	23.57.90.139
Mar 31, 2025 15:16:51.940085888 CEST	49774	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:16:51.940130949 CEST	443	49774	142.250.80.68	192.168.2.4
Mar 31, 2025 15:16:51.940274954 CEST	49774	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:16:51.940407991 CEST	49774	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:16:51.940414906 CEST	443	49774	142.250.80.68	192.168.2.4
Mar 31, 2025 15:16:52.834973097 CEST	443	49774	142.250.80.68	192.168.2.4
Mar 31, 2025 15:16:52.835302114 CEST	49774	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:16:52.835321903 CEST	443	49774	142.250.80.68	192.168.2.4
Mar 31, 2025 15:17:02.157202959 CEST	443	49774	142.250.80.68	192.168.2.4
Mar 31, 2025 15:17:02.157275915 CEST	443	49774	142.250.80.68	192.168.2.4
Mar 31, 2025 15:17:02.157382011 CEST	49774	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:17:03.925658941 CEST	49774	443	192.168.2.4	142.250.80.68
Mar 31, 2025 15:17:03.925704002 CEST	443	49774	142.250.80.68	192.168.2.4
Mar 31, 2025 15:17:14.336642027 CEST	49710	443	192.168.2.4	20.190.190.129
Mar 31, 2025 15:17:14.495933056 CEST	443	49710	20.190.190.129	192.168.2.4
Mar 31, 2025 15:17:14.496064901 CEST	49710	443	192.168.2.4	20.190.190.129

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 31, 2025 15:15:47.876154900 CEST	53	62748	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:48.127576113 CEST	53	53776	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:48.630779982 CEST	56639	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:48.630940914 CEST	59240	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:48.645555019 CEST	53	52011	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:48.787491083 CEST	53	56639	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:48.850481987 CEST	53	59240	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:49.761410952 CEST	64210	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:49.761590004 CEST	63407	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:49.858983040 CEST	54087	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:49.859116077 CEST	57453	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:49.861105919 CEST	53	64210	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:49.861133099 CEST	53	63407	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:50.085935116 CEST	53	60924	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:50.132381916 CEST	53150	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:50.132499933 CEST	49254	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:50.231266022 CEST	53	55684	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:50.231282949 CEST	53	53150	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:50.231296062 CEST	53	49254	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:50.662470102 CEST	51826	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:50.662786007 CEST	63525	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:50.762063026 CEST	53	51826	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:50.762237072 CEST	53	63525	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:51.106327057 CEST	53955	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:51.106507063 CEST	62149	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:51.204276085 CEST	53	53955	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:51.204299927 CEST	53	62149	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:51.913007021 CEST	60360	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:51.913621902 CEST	59335	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:52.021991014 CEST	53	59335	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:52.931780100 CEST	65504	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:53.016685009 CEST	53	65504	1.1.1.1	192.168.2.4
Mar 31, 2025 15:15:58.615228891 CEST	52181	53	192.168.2.4	1.1.1.1
Mar 31, 2025 15:15:58.717319965 CEST	53	52181	1.1.1.1	192.168.2.4
Mar 31, 2025 15:16:07.177846909 CEST	53	50835	1.1.1.1	192.168.2.4
Mar 31, 2025 15:16:27.083647966 CEST	53	62919	1.1.1.1	192.168.2.4
Mar 31, 2025 15:16:30.993525028 CEST	53	62066	162.159.36.2	192.168.2.4
Mar 31, 2025 15:16:47.437127113 CEST	53	58607	1.1.1.1	192.168.2.4
Mar 31, 2025 15:16:47.616941929 CEST	138	138	192.168.2.4	192.168.2.255
Mar 31, 2025 15:16:48.380970001 CEST	53	49598	1.1.1.1	192.168.2.4
Mar 31, 2025 15:17:19.359153032 CEST	53	51940	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Mar 31, 2025 15:15:58.821487904 CEST	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Mar 31, 2025 15:15:58.920963049 CEST	1031	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=83235 Expires: Tue, 01 Apr 2025 12:23:13 GMT Date: Mon, 31 Mar 2025 13:15:58 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urI*Av5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt
Mar 31, 2025 15:15:58.920977116 CEST	714	IN	Data Raw: 30 d4 5b 71 36 b4 07 ba c1 30 30 5c 48 b7 82 3b 98 a6 7d 60 8a a2 a3 29 82 cc ba bd 83 04 1b a2 83 03 41 a1 d6 05 f1 1b c2 b6 f0 a8 7c 86 3b 46 a8 48 2a 88 dc 76 9a 76 bf 1f 6a a5 3d 19 8f eb 38 f3 64 de c8 2b 0d 0a 28 ff f7 db e2 15 42 d4 22 d0 Data Ascii: 0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0HUXPi ')au\ni/VKsY!

Timestamp	Bytes transferred	Direction	Data
2025-03-31 13:15:49 UTC	682	OUT	GET /jjsaecea HTTP/1.1 Host: redcon1entertainment.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-31 13:15:49 UTC	208	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 13:15:49 GMT Server: Apache Upgrade: h2,h2c Connection: Upgrade, close Last-Modified: Fri, 28 Mar 2025 04:34:47 GMT Accept-Ranges: bytes Content-Length: 61677
2025-03-31 13:15:49 UTC	7984	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 3c 68 65 61 64 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 45 64 67 65 2c 63 68 72 6f 6d 65 3d 31 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 72 6f 62 6f 74 73 22 20 63 6f 6e 74 65 6e 74 3d 22 6e 6f 69 6e 64 65 78 2c 20 6e 6f 66 6f 6c 6c 6f 77 22 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 22 3e 3c 6c 69 Data Ascii: <!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=Edge,chrome=1"><meta name="robots" content="noindex, nofollow"><meta name="viewport" content="width=device-width,initial-scale=1,maximum-scale=1"><li
2025-03-31 13:15:49 UTC	8000	IN	Data Raw: 6d 65 63 62 54 76 70 38 62 70 78 6c 36 46 51 45 4a 48 72 4d 54 6b 4b 45 63 48 6e 77 44 4a 49 41 54 34 6b 50 6c 46 4d 64 37 51 68 61 35 64 71 57 4e 43 58 4e 2f 32 71 55 57 59 58 4d 4f 69 54 42 38 6e 79 76 6c 78 67 5a 71 6a 6c 37 54 31 58 49 75 30 62 6c 6b 5a 42 37 6f 5a 61 48 4e 45 63 53 4a 64 75 63 43 67 6c 4b 66 46 76 47 62 6e 62 39 73 5a 33 44 53 36 54 65 37 78 56 4f 6d 7a 56 4a 50 76 6d 6d 61 37 43 2b 5a 32 6d 6b 55 67 6b 4e 41 52 79 7a 41 33 32 70 44 36 6a 56 70 71 48 51 58 61 6b 6e 70 72 53 52 76 48 38 44 76 69 47 4f 36 4d 58 70 79 36 35 6e 5a 72 57 57 77 5a 32 78 4f 6f 6e 69 52 62 72 77 5a 65 2f 44 4e 31 6e 4e 34 66 62 59 64 4c 33 69 65 62 79 41 51 43 4b 75 61 32 79 33 6b 47 41 30 55 4b 70 53 4c 64 58 56 48 65 68 36 58 55 44 7a 69 75 38 37 38 31 49 Data Ascii: mecbTvp8bpxl6FQEJHrMTkKEcHnwDJIAT4kPlFMd7Qha5dqWNCXN/2qUWYXMOiTB8nyvlxgZqjl7T1XIu0blkZB7oZaHNEcSJducCglKfFvGbnb9sZ3DS6Te7xVOmzVJPvmma7C+Z2mkUgkNARyzA32pD6jVpqHQXaknprSRvH8DviGO6MXpy65nZrWWwZ2xOoniRbrwZe/DN1nN4fbYdL3iebyAQCKua2y3kGA0UKpSLdXVHeh6XUDziu8781I
2025-03-31 13:15:49 UTC	8000	IN	Data Raw: 66 4c 6f 76 71 31 57 55 50 6d 64 6f 33 6d 69 6a 33 4b 44 50 62 57 62 6c 2b 79 78 68 48 64 58 30 61 74 32 36 57 4a 35 35 65 30 32 64 72 76 71 4e 52 58 41 30 76 50 44 61 4f 6f 4a 32 5a 44 32 4c 70 78 36 44 64 47 4e 67 34 38 55 4a 39 30 50 38 71 4c 30 57 46 43 5a 37 6f 56 50 6a 2b 53 7a 4f 4d 77 75 2b 4e 2b 30 68 4f 47 7a 4b 64 62 79 70 79 67 44 63 6b 38 6f 54 2f 33 2f 36 39 6c 71 50 74 71 43 49 71 35 46 37 69 4d 2f 65 36 30 4a 4c 7a 6d 74 2b 61 4a 43 45 72 59 72 41 78 43 33 65 39 74 53 37 4c 78 6e 4e 62 32 6a 50 55 79 58 36 64 41 79 38 43 4d 58 77 4c 39 6d 6b 36 39 6c 73 64 49 57 71 52 64 61 55 70 77 5a 32 68 75 35 37 6e 65 31 64 76 50 72 76 37 4d 47 61 78 2f 6a 37 54 6d 7a 4f 33 66 36 59 78 72 56 77 38 75 4a 50 4d 72 6c 47 75 58 70 6a 31 52 6d 61 4d 4a 7a Data Ascii: fLovq1WUPmdo3mij3KDPbWbl+yxhHdX0at26WJ55e02drvqNRXA0vPDaOoJ2ZD2Lpx6DdGNg48UJ90P8qL0WFCZ7oVPj+SzOMwu+N+0hOGzKdbypygDck8oT/3/69lqPtqCIq5F7iM/e60JLzmt+aJCErYrAxC3e9tS7LxnNb2jPUyX6dAy8CMXwL9mk69lsdIWqRdaUpwZ2hu57ne1dvPrv7MGax/j7TmzO3f6YxrVw8uJPMrlGuXpj1RmaMJz
2025-03-31 13:15:49 UTC	8000	IN	Data Raw: 31 33 4d 6c 2b 48 6b 53 37 44 5a 72 78 2f 75 51 72 44 72 2b 32 39 35 53 4e 76 38 68 75 50 33 57 36 54 66 39 4c 65 57 45 71 46 6b 31 46 7a 34 71 32 52 56 2f 6d 72 79 50 64 61 53 76 33 34 4d 64 54 31 61 57 59 46 4c 46 2b 47 6f 64 50 50 61 5a 55 58 54 61 65 46 5a 59 34 4c 74 59 6e 70 75 2f 62 64 39 72 47 72 2f 65 72 44 33 37 53 4f 79 4a 70 4a 50 63 50 44 59 7a 6d 6b 33 71 6b 72 51 77 35 47 51 6b 39 67 36 78 41 76 39 32 41 4d 6c 4b 61 6e 2b 49 4b 64 71 4c 41 48 39 59 63 71 58 79 43 64 37 4a 79 35 4d 70 34 63 35 2f 6d 76 55 38 61 76 69 62 7a 5a 2b 31 4b 32 79 75 71 59 44 55 63 30 54 4f 75 6d 66 34 31 6f 4e 4c 38 51 6d 58 75 78 6d 38 57 73 4a 76 7a 65 48 5a 55 75 77 43 6d 57 6f 48 7a 69 53 66 45 38 62 46 70 4a 6e 54 4b 37 77 63 76 64 65 77 37 75 2b 62 75 72 6e Data Ascii: 13Ml+HkS7DZrx/uQrDr+295SNv8huP3W6Tf9LeWEqFk1Fz4q2RV/mryPdaSv34MdT1aWYFLF+GodPPaZUXTaeFZY4LtYnpu/bd9rGr/erD37SOyJpJPcPDYzmk3qkrQw5GQk9g6xAv92AMlKan+IKdqLAH9YcqXyCd7Jy5Mp4c5/mvU8avibzZ+1K2yuqYDUc0TOumf41oNL8QmXuxm8WsJvzeHZUuwCmWoHziSfE8bFpJnTK7wcvdew7u+burn
2025-03-31 13:15:49 UTC	8000	IN	Data Raw: 59 47 35 63 4a 79 72 70 6b 69 63 7a 49 2f 5a 33 36 6d 44 62 4e 54 4e 2f 66 6b 67 31 4d 68 56 44 71 30 4e 43 31 4c 34 66 62 4d 78 59 63 49 4c 42 42 32 61 50 67 7a 51 2b 6a 43 54 62 4b 67 6c 57 61 44 4d 71 49 46 6d 2b 71 2b 31 4d 68 62 46 73 46 6e 49 31 4c 56 39 70 47 5a 6c 67 47 72 6f 6e 42 4b 31 49 50 37 6b 6f 32 71 31 2f 34 67 49 6d 4f 4c 69 77 55 4b 56 7a 32 4e 77 76 4d 75 49 6e 45 74 39 69 44 4b 7a 75 4f 79 34 66 63 6e 62 62 61 4a 6e 79 48 38 38 39 30 6b 33 71 55 74 7a 51 50 7a 69 57 48 32 44 49 30 4e 6f 38 79 35 34 35 77 7a 4d 44 72 38 46 39 51 78 5a 42 34 72 63 39 47 52 46 58 5a 5a 32 6b 6b 74 30 35 63 35 58 79 5a 32 35 58 50 71 75 73 65 71 6b 32 57 43 30 42 75 74 4c 48 63 7a 46 6a 63 70 6f 4d 55 6c 76 62 46 46 65 70 42 65 67 74 6c 36 6d 73 39 54 32 Data Ascii: YG5cJyrpkiczI/Z36mDbNTN/fkg1MhVDq0NC1L4fbMxYcILBB2aPgzQ+jCTbKglWaDMqIFm+q+1MhbFsFnI1LV9pGZlgGronBK1IP7ko2q1/4gImOLiwUKVz2NwvMuInEt9iDKzuOy4fcnbbaJnyH8890k3qUtzQPziWH2DI0No8y545wzMDr8F9QxZB4rc9GRFXZZ2kkt05c5XyZ25XPquseqk2WC0ButLHczFjcpoMUlvbFFepBegtl6ms9T2
2025-03-31 13:15:49 UTC	8000	IN	Data Raw: 41 36 41 49 65 70 50 4c 6c 53 31 35 79 56 75 72 37 72 54 30 5a 48 43 7a 66 48 4b 56 35 6e 6e 33 78 34 64 76 71 53 4a 56 31 30 78 52 56 6e 79 73 68 78 58 57 33 63 48 55 77 32 76 4f 64 4d 79 4c 76 49 69 5a 6b 33 4a 6a 63 30 48 4e 6e 51 34 44 62 6d 36 30 38 50 36 64 55 72 6c 43 68 69 66 33 71 4c 51 6e 30 46 4a 5a 70 55 68 34 67 64 51 4f 67 41 6a 4a 4f 6c 62 62 76 4b 71 6c 55 4c 72 6a 7a 2f 66 4f 65 37 76 62 32 56 6c 30 31 7a 39 6b 53 2b 50 43 6d 4f 52 77 47 61 6d 6e 51 36 39 64 52 7a 4b 4d 66 4c 6f 36 4a 6b 4a 4f 68 66 6e 79 2f 58 4a 35 39 70 6e 6b 47 66 4d 41 52 64 76 46 62 51 32 53 75 49 58 74 69 68 78 6c 33 78 4a 57 53 65 41 78 41 36 41 47 4e 52 4f 6d 66 7a 61 6d 70 4b 6e 76 36 71 56 33 56 2f 78 50 4e 33 66 37 4a 72 6f 53 63 6a 34 4a 6d 58 4f 6e 63 42 70 Data Ascii: A6AIepPLlS15yVur7rT0ZHCzfHKV5nn3x4dvqSJV10xRVnyshxXW3cHUw2vOdMyLvIiZk3Jjc0HNnQ4Dbm608P6dUrlChif3qLQn0FJZpUh4gdQOgAjJOlbbvKqlULrjz/fOe7vb2Vl01z9kS+PCmORwGamnQ69dRzKMfLo6JkJOhfny/XJ59pnkGfMARdvFbQ2SuIXtihxl3xJWSeAxA6AGNROmfzampKnv6qV3V/xPN3f7JroScj4JmXOncBp
2025-03-31 13:15:49 UTC	8000	IN	Data Raw: 36 6e 6c 69 35 66 33 76 6d 4e 49 4f 69 2f 58 74 5a 72 44 2b 43 65 67 4e 44 6e 55 57 54 4f 4d 6e 64 36 4e 6d 2f 65 39 31 48 75 5a 6f 38 6a 63 36 55 6d 37 50 31 77 70 74 66 4f 7a 67 79 64 63 30 37 76 49 64 33 71 51 71 6a 79 2b 30 33 55 33 39 2f 33 2f 4a 4e 50 2f 76 70 7a 62 33 6a 44 68 58 66 71 65 6d 75 6e 71 6d 71 51 4f 67 51 4f 63 41 31 4f 65 36 51 75 70 62 35 53 52 75 70 33 62 74 38 2b 63 4d 33 77 63 4f 6b 58 51 6d 69 45 4c 76 69 35 52 55 4e 30 75 59 2b 4c 62 4d 56 55 2f 6f 35 36 4f 74 64 69 77 64 36 2b 62 64 76 49 64 59 57 43 2f 62 50 44 52 65 59 48 33 69 77 68 32 62 59 71 44 2b 32 41 77 33 48 69 78 41 37 63 62 66 2f 44 48 2f 37 34 4a 34 38 2f 33 76 39 35 31 77 32 72 2f 50 72 67 35 43 76 4c 6f 78 30 41 7a 50 53 31 4f 52 73 44 6c 55 72 46 6f 6d 52 53 34 Data Ascii: 6nli5f3vmNIOi/XtZrD+CegNDnUWTOMnd6Nm/e91HuZo8jc6Um7P1wptfOzgydc07vId3qQqjy+03U39/3/JNP/vpzb3jDhXfqemunqmqQOgQOcA1Oe6Qupb5SRup3bt8+cM3wcOkXQmiELvi5RUN0uY+LbMVU/o56Otdiwd6+bdvIdYWC/bPDReYH3iwh2bYqD+2Aw3HixA7cbf/DH/74J48/3v951w2r/Prg5CvLox0AzPS1ORsDlUrFomRS4
2025-03-31 13:15:49 UTC	5693	IN	Data Raw: 36 6c 30 30 70 61 53 6e 2b 52 46 34 67 46 67 77 57 72 4b 61 74 72 79 39 4f 70 78 4c 6d 71 46 72 35 57 79 6d 71 52 6c 4a 77 6d 49 33 64 44 76 6b 79 4b 48 32 75 36 49 71 4e 4a 6c 55 52 59 69 30 66 48 55 74 73 65 4f 4f 6d 75 4c 73 2b 44 68 58 57 38 6b 66 36 78 6e 68 2f 4c 39 4e 6a 4c 39 4f 72 66 4f 39 78 6b 77 46 6a 55 39 53 37 79 4d 47 6f 4d 78 5a 46 34 62 56 4b 69 79 6e 75 49 52 78 75 63 38 4e 63 35 6d 34 73 6c 6e 2b 2b 78 37 7a 56 4e 32 65 31 37 34 6e 48 58 43 35 37 66 73 4c 31 6e 31 33 4e 50 2f 72 72 30 2b 2b 39 37 58 33 38 79 31 62 52 37 59 4b 42 63 62 57 6c 4a 30 36 4a 46 54 62 56 65 44 35 56 4d 30 30 42 58 4f 67 41 51 4f 67 43 54 47 61 32 4f 4c 59 32 72 79 6b 2b 33 53 49 64 74 63 64 79 41 64 43 6d 75 52 4d 4c 4d 36 49 61 61 66 2f 6e 6c 6e 56 6c 64 54 Data Ascii: 6l00paSn+RF4gFgwWrKatry9OpxLmqFr5WymqRlJwmI3dDvkyKH2u6IqNJlURYi0fHUtseOOmuLs+DhXW8kf6xnh/L9NjL9OrfO9xkwFjU9S7yMGoMxZF4bVKiynuIRxuc8Nc5m4sln++x7zVN2e174nHXC57fsL1n13NP/rr0++97X38y1bR7YKBcbWlJ06JFTbVeD5VM00BXOgAQOgCTGa2OLY2ryk+3SIdtcdyAdCmuRMLM6Iaaf/nlnVldT

Timestamp	Bytes transferred	Direction	Data
2025-03-31 13:15:50 UTC	741	OUT	GET /recaptcha/intro/images/hero-street-bg.jpg HTTP/1.1 Host: www.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0B Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://redcon1entertainment.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-31 13:15:50 UTC	417	IN	HTTP/1.1 301 Moved Permanently Location: https://cloud.google.com/security/products/recaptcha Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 31 Mar 2025 13:15:50 GMT Expires: Mon, 31 Mar 2025 13:45:50 GMT Cache-Control: public, max-age=1800 Server: sffe Content-Length: 249 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-31 13:15:50 UTC	249	IN	Data Raw: 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 3c 54 49 54 4c 45 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 54 49 54 4c 45 3e 3c 2f 48 45 41 44 3e 3c 42 4f 44 59 3e 0a 3c 48 31 3e 33 30 31 20 4d 6f 76 65 64 3c 2f 48 31 3e 0a 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 0a 3c 41 20 48 52 45 46 3d 22 68 74 74 70 73 3a 2f 2f 63 6c 6f 75 64 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 73 65 63 75 72 69 74 79 2f 70 72 6f 64 75 63 74 73 2f 72 65 63 61 70 74 63 68 61 22 3e 68 65 72 65 3c 2f 41 3e 2e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"><TITLE>301 Moved</TITLE></HEAD><BODY><H1>301 Moved</H1>The document has moved<A HREF="https://cloud.google.com/security/products/recaptcha">here</A>.</BODY></HTML>

Timestamp	Bytes transferred	Direction	Data
2025-03-31 13:15:50 UTC	652	OUT	GET /android/24/000000/refresh.png HTTP/1.1 Host: img.icons8.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://redcon1entertainment.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-31 13:15:51 UTC	635	IN	HTTP/1.1 200 OK Date: Mon, 31 Mar 2025 13:15:51 GMT Content-Type: image/png Content-Length: 330 Connection: close access-control-allow-origin: * icon-id: 15469 icon-size: 24 icon-format: png last-modified: Fri, 28 Mar 2025 03:52:38 version: 0.0.29 from-mongo-cache: true from-redis-cache: false not-found-platform: false cache-control: public, max-age=302400 Strict-Transport-Security: max-age=15724800; includeSubDomains X-77-NZT: EgwBbT1bwQHXaYoDAAwBWbuxDAG3IgAAAA X-77-NZT-Ray: 068a823304d05b138795ea6768e05702 X-77-Cache: HIT X-77-Age: 232041 Server: CDN77-Turbo X-77-POP: ashburnUSVA Accept-Ranges: bytes
2025-03-31 13:15:51 UTC	330	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 18 00 00 00 18 08 06 00 00 00 e0 77 3d f8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 9a 9c 18 00 00 00 fc 49 44 41 54 78 9c ed 95 b1 0d c2 30 10 45 1f 05 34 40 49 c9 02 a4 40 a2 00 a6 60 16 26 01 91 11 32 03 1d 63 00 0d 2d 2d 55 a0 48 81 00 19 7d 4b 28 24 8e 8d e4 8e 27 9d 64 25 f7 fd e5 4b ee 0c 7f 02 19 28 2c 43 e0 02 3c 4b 71 03 0e c0 1a 48 7c 37 6f 01 5b 85 59 5b 16 c0 a3 c2 c4 c6 1d 48 81 4e 93 c1 f2 43 64 d6 2e ba c0 0c d8 00 85 34 3b 97 c9 e4 23 f1 a9 b5 79 e6 c3 18 38 4b 67 4e f2 45 1f 38 55 1c fd a4 77 be 26 85 ca 35 2a bf cc 1c f5 cd f0 27 95 66 e5 4a b2 1b ff c2 4c da 7d 2c 83 9e b4 79 2c 03 2f 7d 74 83 5c 09 bd 58 06 47 25 4c 63 19 ac 95 60 3a d4 97 2c e4 37 4f d4 2c 85 9a c7 Data Ascii: PNGIHDRw=pHYsIDATx0E4@I@`&2c--UH}K($'d%K(,C<KqH\|7o[Y[HNCd.4;#y8KgNE8Uw&5*'fJL},y,/}t\XG%Lc`:,7O,

Timestamp	Bytes transferred	Direction	Data
2025-03-31 13:15:51 UTC	729	OUT	GET /security/products/recaptcha HTTP/1.1 Host: cloud.google.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJWhywEInP7MAQiFoM0B Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://redcon1entertainment.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-03-31 13:15:51 UTC	2391	IN	HTTP/1.1 403 Forbidden Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 31 Mar 2025 13:15:51 GMT Vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/GoogleCloudUxWebAppCgcUi/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-euY4zRVAGDa1tw2yoRpAfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/GoogleCloudUxWebAppCgcUi/cspreport;worker-src 'self' blob: Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com https://support.google.com/inapp/ https://www.google.com/tools/feedback/ https://www.gstatic.com/inproduct_help/ https://www.gstatic.com/support/content/ https://maps.googleapis.com https://googleads.g.doubleclick.net https://s.ytimg.com https://ssl.google-analytics.com https://www.googleadservices.com/pagead/ https://www.youtube.com https://youtube.com https://youtube.googleapis.com https://www.googleapis.com/appsmarket/v2/installedApps/;report-uri /_/GoogleCloudUxWebAppCgcUi/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Transfer-Encoding: chunked Server: ESF X-XSS-Protection: 0 X-Content-Type-Options: nosniff Set-Cookie: NID=522=reirbNDZx0rmdd8dMghMgcMt_0PZ3bZISuZjIOk4lpkIfawuZ7jAk9cYtLwBX8KuygI6UcL27IJ_iroVNyZRb1N98WAlnrZRYtpvExVNE1jTDVWNH1shHh5lRpG8K4n-dFAuHUgX3Q19QtvSYIn1klHjas72JAohR_1E0JNHgrrsPHCB_VNm6ck79t21gqW7aM2KSw; expires=Tue, 30-Sep-2025 13:15:51 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2025-03-31 13:15:51 UTC	1665	IN	Data Raw: 36 37 61 0d 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 33 20 28 46 6f 72 62 69 64 64 65 6e 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 6b 6b 76 4e 59 4e 6b 46 4c 58 6c 30 6b 74 6d 34 61 4a 71 61 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 Data Ascii: 67a<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 403 (Forbidden)!!1</title><style nonce="pkkvNYNkFLXl0ktm4aJqaQ">*{margin:0;padding:0}html,code{font:15px/22px
2025-03-31 13:15:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	09:15:40
Start date:	31/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\mara.roth-Handbook_DocuSign6h0-3958.pdf"
Imagebase:	0x7ff78be20000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	09:15:41
Start date:	31/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff649300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	09:15:42
Start date:	31/03/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2232 --field-trial-handle=1564,i,1962462157706799152,526781585758020601,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff649300000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	09:15:45
Start date:	31/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument about:blank
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report mara.roth-Handbook_DocuSign6h0-3958.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

HTML

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

QR Codes

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\ad003e70-9b02-4fb6-8144-6a13cd5454e2.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250331131558Z-546.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.7764

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

Windows Analysis Report
mara.roth-Handbook_DocuSign6h0-3958.pdf

Target ID:	4
Start time:	09:15:46
Start date:	31/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2304,i,8126060533632964085,3292062182765774855,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2340 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	6
Start time:	09:15:47
Start date:	31/03/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://redcon1entertainment.com/jjsaecea
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre