Edit tour

Windows Analysis Report
Payment Remittance.pdf

Overview

General Information

Sample name:	Payment Remittance.pdf
Analysis ID:	1654239
MD5:	be4a536d9ea34d6419fbdb13f161e43f
SHA1:	b41fb15173937f5e601a4ea88d975d73c5961567
SHA256:	3983e55a461d3dda073b3f654b155032bae5e096744c358357a92ee0c2516cc3
Infos:

Detection

Score:	60
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

AI detected landing page (webpage, office document or email)

Creates files inside the system directory

Deletes files inside the Windows folder

Form action URLs do not match main URL

HTML body contains low number of good links

HTML title does not match URL

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

Suspicious form URL found

Unable to load, office file is protected or invalid

Classification

Process Tree

System is w10x64

Acrobat.exe (PID: 4104 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Payment Remittance.pdf" MD5: 24EAD1C46A47022347DC0F05F6EFBB8C)

AcroCEF.exe (PID: 7184 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

AcroCEF.exe (PID: 7388 cmdline: "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1588,i,12727439123907870177,15176298521270964230,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8 MD5: 9B38E8E8B6DD9622D24B53E095C5D9BE)

chrome.exe (PID: 9204 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 8460 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=280,i,5399740859030042710,15862493063084477710,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2124 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 9120 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Source: https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is classified as 'wellknown'., The URL 'res2.showcaseworkshop.com' does not match the legitimate domain 'microsoft.com'., The domain 'showcaseworkshop.com' is unrelated to Microsoft, which is suspicious., The presence of input fields for 'Email' and 'Password' on an unrelated domain increases the risk of phishing., The URL does not contain any direct reference to Microsoft, which is a common tactic in phishing attempts. DOM: 0.0.pages.csv

AI detected landing page (webpage, office document or email)

Source: PDF document	Joe Sandbox AI: Page contains button: 'VIEW PAYMENT COPY HERE' Source: 'PDF document'
Source: PDF document	Joe Sandbox AI: PDF document contains prominent button: 'view payment copy here'

HTTP Parser: Form action: https://thynkfinance.co.za/admin/save/mer.php showcaseworkshop co

HTTP Parser: Number of links: 0

HTTP Parser: Title: REMITTANCE does not match URL

HTTP Parser: Form action: https://thynkfinance.co.za/admin/save/mer.php

HTTP Parser: <input type="password" .../> found

Source: https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51	HTTP Parser: No favicon
Source: https://i.ibb.co/nBXYTs4/wrong-details.jpg	HTTP Parser: No favicon

HTTP Parser: No <meta name="author".. found

HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.96:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.96:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.0.165.249:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.0.165.249:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.251:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.4.104:443 -> 192.168.2.4:49756 version: TLS 1.2

Source: Joe Sandbox View	IP Address: 207.174.26.219 207.174.26.219
Source: Joe Sandbox View	IP Address: 104.76.101.49 104.76.101.49

Source: Joe Sandbox View

ASN Name: AMAZON-02US AMAZON-02US

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.40.99
Source: unknown	TCP traffic detected without corresponding DNS query: 52.113.196.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51 HTTP/1.1Host: res2.showcaseworkshop.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: res2.showcaseworkshop.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /nBXYTs4/wrong-details.jpg HTTP/1.1Host: i.ibb.coConnection: keep-aliveCache-Control: max-age=0Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://res2.showcaseworkshop.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: i.ibb.coConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://i.ibb.co/nBXYTs4/wrong-details.jpgAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.png HTTP/1.1Host: simgbb.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://i.ibb.co/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /images/favicon.png HTTP/1.1Host: simgbb.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: /If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Microsoft-CryptoAPI/10.0Host: x1.i.lencr.org

Source: global traffic	DNS traffic detected: DNS query: x1.i.lencr.org
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: res2.showcaseworkshop.com
Source: global traffic	DNS traffic detected: DNS query: thynkfinance.co.za
Source: global traffic	DNS traffic detected: DNS query: i.ibb.co
Source: global traffic	DNS traffic detected: DNS query: simgbb.com

Source: unknown

HTTP traffic detected: POST /admin/save/mer.php HTTP/1.1Host: thynkfinance.co.zaConnection: keep-aliveContent-Length: 47Cache-Control: max-age=0sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Origin: https://res2.showcaseworkshop.comContent-Type: application/x-www-form-urlencodedUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentReferer: https://res2.showcaseworkshop.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: 77EC63BDA74BD0D0E0426DC8F80085060.2.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: 2D85F72862B55C4EADD9E66E06947F3D0.2.dr	String found in binary or memory: http://x1.i.lencr.org/
Source: Payment Remittance.pdf	String found in binary or memory: https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/
Source: chromecache_182.21.dr	String found in binary or memory: https://thynkfinance.co.za/admin/save/mer.php

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443

Source: unknown	HTTPS traffic detected: 142.251.40.132:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.96:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.168.73.96:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.0.165.249:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.0.165.249:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 207.174.26.219:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.251:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.4.104:443 -> 192.168.2.4:49756 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir9204_508398426

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir9204_508398426

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Window title found: save password for res2.showcaseworkshop.com?

Source: classification engine

Classification label: mal60.phis.winPDF@39/56@13/8

Source: Payment Remittance.pdf	Initial sample: https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51
Source: Payment Remittance.pdf	Initial sample: https://res2.showcaseworkshop.com/ge395ea18yup75v94s5b2uzoz164ismu4z3s6giq/r/4krjua8ra90ucyiduasooe/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5292

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.6.20320.6 2025-04-02 01-12-50-425.log

Jump to behavior

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\SystemCertificates\CA

Jump to behavior

Source: unknown	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Payment Remittance.pdf"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1588,i,12727439123907870177,15176298521270964230,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=280,i,5399740859030042710,15862493063084477710,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2124 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51"
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1588,i,12727439123907870177,15176298521270964230,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=280,i,5399740859030042710,15862493063084477710,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2124 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: Payment Remittance.pdf	Initial sample: PDF keyword /JS count = 0
Source: Payment Remittance.pdf	Initial sample: PDF keyword /JavaScript count = 0

Source: Payment Remittance.pdf

Initial sample: PDF keyword /EmbeddedFile count = 0

Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	11 Masquerading	OS Credential Dumping	1 System Information Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Payment Remittance.pdf	8%	ReversingLabs

Source	Detection	Scanner	Label
https://thynkfinance.co.za/admin/save/mer.php	100%	Avira URL Cloud	phishing
https://res2.showcaseworkshop.com/favicon.ico	100%	Avira URL Cloud	phishing
https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/	100%	Avira URL Cloud	phishing

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
e8652.dscx.akamaiedge.net	104.76.101.49	true	false	high
simgbb.com	172.67.131.251	true	false	high
www.google.com	142.251.40.132	true	false	high
thynkfinance.co.za	154.0.165.249	true	false	unknown
res2.showcaseworkshop.com	3.168.73.96	true	true	unknown
i.ibb.co	207.174.26.219	true	false	high
x1.i.lencr.org	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51	true		unknown
https://thynkfinance.co.za/admin/save/mer.php	false	Avira URL Cloud: phishing	unknown
https://simgbb.com/images/favicon.png	false		high
http://x1.i.lencr.org/	false		high
http://c.pki.goog/r/gsr1.crl	false		high
http://c.pki.goog/r/r4.crl	false		high
https://res2.showcaseworkshop.com/favicon.ico	false	Avira URL Cloud: phishing	unknown
https://i.ibb.co/favicon.ico	false		high
https://i.ibb.co/nBXYTs4/wrong-details.jpg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/	Payment Remittance.pdf	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
207.174.26.219	i.ibb.co	United States	6079	RCN-ASUS	false
104.76.101.49	e8652.dscx.akamaiedge.net	United States	16625	AKAMAI-ASUS	false
172.67.131.251	simgbb.com	United States	13335	CLOUDFLARENETUS	false
3.168.73.96	res2.showcaseworkshop.com	United States	16509	AMAZON-02US	true
142.251.40.132	www.google.com	United States	15169	GOOGLEUS	false
104.21.4.104	unknown	United States	13335	CLOUDFLARENETUS	false
154.0.165.249	thynkfinance.co.za	South Africa	37611	AfrihostZA	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1654239
Start date and time:	2025-04-02 07:11:46 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowspdfcookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	26
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Payment Remittance.pdf
Detection:	MAL
Classification:	mal60.phis.winPDF@39/56@13/8
Cookbook Comments:	Found application associated with file extension: .pdf Found PDF document Close Viewer

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, sppsvc.exe, RuntimeBroker.exe, ShellExperienceHost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.51.56.185, 52.6.155.20, 52.22.41.97, 3.233.129.217, 3.219.243.226, 23.219.161.132, 172.64.41.3, 162.159.61.3, 23.203.176.221, 23.206.121.16, 23.206.121.6, 23.206.121.11, 23.206.121.13, 23.206.121.52, 23.206.121.18, 23.206.121.25, 23.206.121.53, 23.206.121.28, 142.251.40.227, 142.250.65.174, 172.217.165.142, 172.253.122.84, 142.251.40.110, 142.251.40.174, 142.250.65.206, 142.250.80.74, 142.250.80.10, 142.250.81.234, 142.251.40.234, 142.250.65.202, 142.250.176.202, 142.250.80.42, 142.250.72.106, 142.251.40.202, 142.250.65.170, 142.251.41.10, 142.250.80.106, 142.250.64.106, 142.250.65.234, 142.251.40.170, 172.217.165.138, 142.250.64.110, 142.251.40.106, 142.251.35.170, 142.251.32.106, 142.251.40.138, 142.250.81.238, 142.250.80.78, 142.251.40.142, 142.250.65.227, 142.251.35.174, 142.251.32.99, 142.250.80.110, 142.250.65.238, 23.204.23.20, 23.47.168.24, 20.109.210.53
Excluded domains from analysis (whitelisted): e4578.dscg.akamaiedge.net, chrome.cloudflare-dns.com, slscr.update.microsoft.com, clientservices.googleapis.com, a767.dspw65.akamai.net, acroipm2.adobe.com, clients2.google.com, ocsp.digicert.com, redirector.gvt1.com, ssl-delivery.adobe.com.edgekey.net, a122.dscd.akamai.net, update.googleapis.com, c.pki.goog, wu-b-net.trafficmanager.net, clients1.google.com, fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, acroipm2.adobe.com.edgesuite.net, ctldl.windowsupdate.com.delivery.microsoft.com, ctldl.windowsupdate.com, p13n.adobe.io, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net, edgedl.me.gvt1.com, armmf.adobe.com, clients.l.google.com, geo2.adobe.com, passwordsleakcheck-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenFile calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:12:59	API Interceptor	2x Sleep call for process: AcroCEF.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
207.174.26.219	F Notice Docx 433 (1).html	Get hash	malicious	HTMLPhisher	Browse
	https://orgfarm-4ccb539e27-dev-ed.develop.my.salesforce-sites.com/	Get hash	malicious	Unknown	Browse
	Presentation Of Court Order_Letter.pptx	Get hash	malicious	HTMLPhisher	Browse
	Presentation Of Court Order_Letter.pptx	Get hash	malicious	HTMLPhisher	Browse
	roblox.exe	Get hash	malicious	XWorm	Browse
	WizClient.exe	Get hash	malicious	XWorm	Browse
	XC.exe	Get hash	malicious	XWorm	Browse
	FINAL -Legal Notice Presentation (1).pptx	Get hash	malicious	HTMLPhisher	Browse
	Formal Legal Notice Presentation (Approved).pptx	Get hash	malicious	HTMLPhisher	Browse
	Presentation Of Legal Notice.pptx	Get hash	malicious	HTMLPhisher	Browse
104.76.101.49	CLAIM3456709.lnk.bin.lnk	Get hash	malicious	DanaBot	Browse	x1.i.lencr.org/
	Contract Invoice Approval.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	x1.i.lencr.org/
	460138.pdf	Get hash	malicious	Unknown	Browse	x1.i.lencr.org/
	t8f2gm11IC.pdf	Get hash	malicious	HTMLPhisher	Browse	x1.i.lencr.org/
	https://whatsapp.dianjin-inc.com	Get hash	malicious	Unknown	Browse	x1.c.lencr.org/
104.21.4.104	Payment.pdf	Get hash	malicious	HTMLPhisher	Browse
	AGREEMENT AND APPROVAL REPORT DIAMOND TRAILER 2024-502244_6.5.248.pdf	Get hash	malicious	Unknown	Browse
	https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	Get hash	malicious	HTMLPhisher	Browse
172.67.131.251	Payment.pdf	Get hash	malicious	HTMLPhisher	Browse
172.67.131.251	https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	Get hash	malicious	HTMLPhisher	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
i.ibb.co	F Notice Docx 433 (1).html	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	https://orgfarm-4ccb539e27-dev-ed.develop.my.salesforce-sites.com/	Get hash	malicious	Unknown	Browse	207.174.26.219
	Presentation Of Court Order_Letter.pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Presentation Of Court Order_Letter.pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	roblox.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	WizClient.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	XC.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	FINAL -Legal Notice Presentation (1).pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Formal Legal Notice Presentation (Approved).pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Presentation Of Legal Notice.pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
e8652.dscx.akamaiedge.net	Remittance Details Bellpotter_207YtLX_4397_.pdf	Get hash	malicious	Unknown	Browse	23.46.224.249
	FA-43-02-2025.pdf	Get hash	malicious	Unknown	Browse	23.39.37.95
	Employee Plan Selection.pdf	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	23.46.224.249
	AR Care.pdf	Get hash	malicious	Unknown	Browse	23.48.144.248
	mara.roth-Handbook_DocuSign6h0-3958.pdf	Get hash	malicious	Fake Captcha	Browse	23.216.136.238
	email.eml	Get hash	malicious	Unknown	Browse	23.197.253.105
	Petroleum Systems Services Corporation WAV Caller.pdf	Get hash	malicious	HTMLPhisher	Browse	23.216.136.238
	7ivgZ6j7.pdf	Get hash	malicious	Unknown	Browse	23.46.224.249
	Hess Vioce Message.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
	ATT02683-1.pdf	Get hash	malicious	Unknown	Browse	23.216.136.238
res2.showcaseworkshop.com	https://res2.showcaseworkshop.com/UC48PXNB6W73ISX1PK71FS0DPANMIH4LQ45SLW8M/r/5HNAJDHGY5IZWPP9MCCDAS/5877514.html?response-content-disposition=attachment%3Bfilename%3D%22Letter%2520of%2520demand.html%22&e=1746316800&s2=838245666bc16fd83e0d8def624300a64e3df0609db970c9443011fc72e137c831b27b9c938762f1ef0ea039a2ee0be8e6ac0583670dddb9609dfa7abd5a509c	Get hash	malicious	Unknown	Browse	3.168.73.74
res2.showcaseworkshop.com	https://app.showcaseworkshop.com/share/qv84v9	Get hash	malicious	HTMLPhisher	Browse	18.66.122.26
simgbb.com	Payment.pdf	Get hash	malicious	HTMLPhisher	Browse	104.21.4.104
	AGREEMENT AND APPROVAL REPORT DIAMOND TRAILER 2024-502244_6.5.248.pdf	Get hash	malicious	Unknown	Browse	104.21.4.104
	https://tap-rt-prod1-t.campaign.adobe.com/r/?id=h9ecb88b,c1e96b3,69fe0fb&p1=zoom-meeting.top/scJF1SSXVzFB/zFBa2scJF17067/HkeS73tjSSXV1331248624633021?HkeS73tjSSXV1331248624633021=Yy5iYWtrZXJAbWVkaXJldmEubmw=	Get hash	malicious	HTMLPhisher	Browse	104.21.4.104

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	Remittance Details Bellpotter_207YtLX_4397_.pdf	Get hash	malicious	Unknown	Browse	23.46.224.249
	Black Myth Wukong Sigma Downloader.zip	Get hash	malicious	Unknown	Browse	104.71.182.190
	Black Myth Wukong Sigma Downloader.zip	Get hash	malicious	Unknown	Browse	104.71.182.190
	i1myxYUbbP.exe	Get hash	malicious	Vidar	Browse	104.71.182.190
	BIGIPEdgeClient 2024.exe	Get hash	malicious	Unknown	Browse	23.46.226.182
	BIGIPEdgeClient.exe	Get hash	malicious	Unknown	Browse	23.197.253.43
	BIGIPEdgeClient 2024.exe	Get hash	malicious	Unknown	Browse	23.39.37.29
	https://sprayfoamsys.com/service-center/	Get hash	malicious	Unknown	Browse	23.196.3.202
	https://microwaveeng-dot-m365view-318723.uc.r.appspot.com/	Get hash	malicious	HTMLPhisher	Browse	23.56.162.51
	i486.elf	Get hash	malicious	Unknown	Browse	104.106.110.98
AMAZON-02US	OC-8563 PURCHASE ORDER.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	SHIPPING DOCUMENT.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	vejfa5.elf	Get hash	malicious	Unknown	Browse	34.243.160.129
	efefa7.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
	jfeeps.elf	Get hash	malicious	Unknown	Browse	54.247.62.1
	Payment Copy.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	vjwe68k.elf	Get hash	malicious	Unknown	Browse	34.254.182.186
	arm.elf	Get hash	malicious	Unknown	Browse	54.247.62.1
	sh4.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	https://snu2i.mjt.lu/lnk/AVUAAGf9XKgAAAAAAAAAA9xrFsMAAYKJjLUAAAAAAC68kgBn7Bfqac3lXyTWRGaDtKriXw3emQAq56U/1/cdW9bHmcUWqJ_AB7I3vlvw/aHR0cHM6Ly9jb25zdC5mb3Jtc3RhY2suY29tL2Zvcm1zL2l0Zg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	54.231.166.192
RCN-ASUS	F Notice Docx 433 (1).html	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	https://orgfarm-4ccb539e27-dev-ed.develop.my.salesforce-sites.com/	Get hash	malicious	Unknown	Browse	207.174.26.219
	Presentation Of Court Order_Letter.pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Presentation Of Court Order_Letter.pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	roblox.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	WizClient.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	XC.exe	Get hash	malicious	XWorm	Browse	207.174.26.219
	FINAL -Legal Notice Presentation (1).pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	Formal Legal Notice Presentation (Approved).pptx	Get hash	malicious	HTMLPhisher	Browse	207.174.26.219
	k03ldc.arm.elf	Get hash	malicious	Unknown	Browse	208.59.25.232
CLOUDFLARENETUS	wVpIwnZk2zaRDkQ.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.32.1
	SHIPPING DOCUMENT.exe	Get hash	malicious	FormBook	Browse	104.21.22.160
	https://url.us.m.mimecastprotect.com/s/_DzwCmZV9XHP6wOBoIGf1UR62E_?domain=minkagroup.on.spiceworks.com	Get hash	malicious	Unknown	Browse	104.18.19.130
	Payment Copy.exe	Get hash	malicious	FormBook	Browse	104.21.96.1
	BestPlayer102.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.192.221
	BestPlayer102.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.192.221
	Datasheet.pdf.exe	Get hash	malicious	AgentTesla, PureLog Stealer	Browse	104.26.12.205
	https://snu2i.mjt.lu/lnk/AVUAAGf9XKgAAAAAAAAAA9xrFsMAAYKJjLUAAAAAAC68kgBn7Bfqac3lXyTWRGaDtKriXw3emQAq56U/1/cdW9bHmcUWqJ_AB7I3vlvw/aHR0cHM6Ly9jb25zdC5mb3Jtc3RhY2suY29tL2Zvcm1zL2l0Zg	Get hash	malicious	HTMLPhisher, Invisible JS, Tycoon2FA	Browse	104.26.0.100
	EQui6HmTFg.exe	Get hash	malicious	Unknown	Browse	162.159.135.232
	http://www.ravinn.com	Get hash	malicious	RedLine	Browse	104.21.27.152

Process:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	292
Entropy (8bit):	5.155889861454642
Encrypted:	false
SSDEEP:	6:iORvLXiOq2Pwkn2nKuAl9OmbnIFUtDvLX5ZZmw9vLX5zkwOwkn2nKuAl9OmbjLJ:7RvLPvYfHAahFUtDvLD/9vLZ5JfHAaSJ
MD5:	6AA8DA5DD6DCF46CF592A6B70481EA11
SHA1:	5EF5739B218277496CEA59DFD2699C39CA0F2562
SHA-256:	A6BCFDEF45F79D7B0E7F1C7A2E8113D2DEAD637BA8C8D7E9011A7A6EA6C8E634
SHA-512:	B8A153F8CEDBA7ED4EB0CADDD3F702020CA904FC2962F90E3D9806286264FBE4487FF64E49BF3E432655744A03125632EE92F2C4D40D3E14A838FC6EC8586930
Malicious:	false
Reputation:	low
Preview:	2025/04/02-01:12:48.850 1c40 Reusing MANIFEST C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/MANIFEST-000001.2025/04/02-01:12:48.853 1c40 Recovering log #3.2025/04/02-01:12:48.853 1c40 Reusing old log C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache/000003.log .

Source: https://thynkfinance.co.za/admin/save/mer.php	Avira URL Cloud: Label: phishing
Source: https://res2.showcaseworkshop.com/favicon.ico	Avira URL Cloud: Label: phishing
Source: https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/	Avira URL Cloud: Label: phishing

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	28
Entropy (8bit):	4.208966082694623
Encrypted:	false
SSDEEP:	3:0jKcrR:0jKcrR
MD5:	4B7627631A08460D9E2249B74C6225DE
SHA1:	DE0356D98FB0316D77A86B7CFD6F762667632948
SHA-256:	E94B925E0EE76DBEEADBD45CDD1B633F1DFD1A14C9C3B9164C85CB4F2189B16B
SHA-512:	C7EC3E046DC4A92E6D2FD6BF2A9C44568154DEF4B417D05A7187A4C024E6140FEFCC07AB381D768DB554A04164B33127D26D12811C334E8047BE944143937944
Malicious:	false
URL:	https://content-autofill.googleapis.com/v1/pages/ChRDaHJvbWUvMTM0LjAuNjk5OC4zNhIgCTdrS1Y4scYlEgUNmdbFPRIFDYo-uLghoRpA7mjkAXw=?alt=proto
Preview:	ChIKBw2Z1sU9GgAKBw2KPri4GgA=

File type:	PDF document, version 1.7, 1 pages
Entropy (8bit):	7.64229441866097
TrID:	Adobe Portable Document Format (5005/1) 100.00%
File name:	Payment Remittance.pdf
File size:	31'526 bytes
MD5:	be4a536d9ea34d6419fbdb13f161e43f
SHA1:	b41fb15173937f5e601a4ea88d975d73c5961567
SHA256:	3983e55a461d3dda073b3f654b155032bae5e096744c358357a92ee0c2516cc3
SHA512:	e58c2509c3aad858c6f239ebf2402c3f74f97578ebf58ec2cbd6c79f27403e1ba9e5c1416d980b9d277364342e3676faab15831e1ebed323e64528d4da7f7ac0
SSDEEP:	768:yeIxjw/1Fr30hZuvYw9xc91UhhAhoBbF9dAmScGB36nhbo/O:gk/u+JzdZ9qp9B36hE/O
TLSH:	5EE2AF248C092CCDD56993E16F19344AFA9DB322B1C418E37CACCB9B5B10EA7DC1715A
File Content Preview:	%PDF-1.7..%......1 0 obj..<</Type/Catalog/Pages 2 0 R/Lang(en) /StructTreeRoot 14 0 R/MarkInfo<</Marked true>>/Metadata 35 0 R/ViewerPreferences 36 0 R>>..endobj..2 0 obj..<</Type/Pages/Count 1/Kids[ 3 0 R] >>..endobj..3 0 obj..<</Type/Page/Parent 2 0 R/R

General
Header:	%PDF-1.7
Total Entropy:	7.642294
Total Bytes:	31526
Stream Entropy:	7.742906
Stream Bytes:	27187
Entropy outside Streams:	5.227217
Bytes outside Streams:	4339
Number of EOF found:	2
Bytes after EOF:

Name	Count
obj	21
endobj	21
stream	7
endstream	7
xref	2
trailer	2
startxref	2
/Page	1
/Encrypt	0
/ObjStm	1
/URI	2
/JS	0
/JavaScript	0
/AA	0
/OpenAction	0
/AcroForm	0
/JBIG2Decode	0
/RichMedia	0
/Launch	0
/EmbeddedFile	0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2025 07:12:44.111064911 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 07:12:44.423311949 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 07:12:45.032721996 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 07:12:46.235714912 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 07:12:48.641951084 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 07:12:49.798207998 CEST	49680	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:52.879043102 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 07:12:53.194422007 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 07:12:53.585136890 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 07:12:53.803814888 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 07:12:55.014666080 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 07:12:57.425605059 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 07:12:59.328659058 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 07:12:59.613518000 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:59.613817930 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:59.613986015 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:59.628742933 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 07:12:59.703099966 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:12:59.703129053 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:12:59.703514099 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:12:59.704811096 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:12:59.704828024 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:12:59.704890013 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:59.704890013 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:59.705348015 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:59.705885887 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:12:59.705933094 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:59.705946922 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:12:59.705986977 CEST	49710	443	192.168.2.4	204.79.197.222
Apr 2, 2025 07:12:59.795327902 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:13:00.027182102 CEST	49724	80	192.168.2.4	142.251.40.99
Apr 2, 2025 07:13:00.117465973 CEST	80	49724	142.251.40.99	192.168.2.4
Apr 2, 2025 07:13:00.117544889 CEST	49724	80	192.168.2.4	142.251.40.99
Apr 2, 2025 07:13:00.117670059 CEST	49724	80	192.168.2.4	142.251.40.99
Apr 2, 2025 07:13:00.207315922 CEST	80	49724	142.251.40.99	192.168.2.4
Apr 2, 2025 07:13:00.207504034 CEST	80	49724	142.251.40.99	192.168.2.4
Apr 2, 2025 07:13:00.212203026 CEST	49724	80	192.168.2.4	142.251.40.99
Apr 2, 2025 07:13:00.238117933 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 07:13:00.302412033 CEST	80	49724	142.251.40.99	192.168.2.4
Apr 2, 2025 07:13:00.347505093 CEST	49724	80	192.168.2.4	142.251.40.99
Apr 2, 2025 07:13:00.689292908 CEST	49726	80	192.168.2.4	104.76.101.49
Apr 2, 2025 07:13:00.779035091 CEST	80	49726	104.76.101.49	192.168.2.4
Apr 2, 2025 07:13:00.779385090 CEST	49726	80	192.168.2.4	104.76.101.49
Apr 2, 2025 07:13:00.779386044 CEST	49726	80	192.168.2.4	104.76.101.49
Apr 2, 2025 07:13:00.868804932 CEST	80	49726	104.76.101.49	192.168.2.4
Apr 2, 2025 07:13:00.871630907 CEST	80	49726	104.76.101.49	192.168.2.4
Apr 2, 2025 07:13:00.871661901 CEST	80	49726	104.76.101.49	192.168.2.4
Apr 2, 2025 07:13:00.871855974 CEST	49726	80	192.168.2.4	104.76.101.49
Apr 2, 2025 07:13:01.448688984 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 07:13:02.245328903 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 07:13:03.186964035 CEST	49671	443	192.168.2.4	204.79.197.203
Apr 2, 2025 07:13:03.861681938 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 07:13:08.669292927 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 07:13:11.862478971 CEST	49678	443	192.168.2.4	20.189.173.27
Apr 2, 2025 07:13:11.995796919 CEST	49726	80	192.168.2.4	104.76.101.49
Apr 2, 2025 07:13:18.194672108 CEST	49740	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:13:18.194777012 CEST	443	49740	142.251.40.132	192.168.2.4
Apr 2, 2025 07:13:18.194979906 CEST	49740	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:13:18.195107937 CEST	49740	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:13:18.195127010 CEST	443	49740	142.251.40.132	192.168.2.4
Apr 2, 2025 07:13:18.281934023 CEST	49681	80	192.168.2.4	2.17.190.73
Apr 2, 2025 07:13:18.400533915 CEST	443	49740	142.251.40.132	192.168.2.4
Apr 2, 2025 07:13:18.400660992 CEST	49740	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:13:18.401870012 CEST	49740	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:13:18.401886940 CEST	443	49740	142.251.40.132	192.168.2.4
Apr 2, 2025 07:13:18.402380943 CEST	443	49740	142.251.40.132	192.168.2.4
Apr 2, 2025 07:13:18.453835011 CEST	49740	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:13:19.021559954 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.021645069 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.021801949 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.021917105 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.021939039 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.021976948 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.022062063 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.024698973 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.024699926 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.024826050 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.219486952 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.220586061 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.220587015 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.220649958 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.220985889 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.221504927 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.230283976 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.230555058 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.231111050 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.231128931 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.231616020 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.264332056 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.285327911 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.672584057 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.676568031 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.677187920 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.677248001 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.687253952 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.687402010 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.687473059 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.687535048 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.687575102 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.687580109 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.688308001 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.727667093 CEST	49742	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.727727890 CEST	443	49742	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.836190939 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.876274109 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.963433981 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.964072943 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:19.964247942 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.964809895 CEST	49741	443	192.168.2.4	3.168.73.96
Apr 2, 2025 07:13:19.964847088 CEST	443	49741	3.168.73.96	192.168.2.4
Apr 2, 2025 07:13:28.401312113 CEST	443	49740	142.251.40.132	192.168.2.4
Apr 2, 2025 07:13:28.401447058 CEST	443	49740	142.251.40.132	192.168.2.4
Apr 2, 2025 07:13:28.401622057 CEST	49740	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:13:29.643151045 CEST	49740	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:13:29.643219948 CEST	443	49740	142.251.40.132	192.168.2.4
Apr 2, 2025 07:13:35.229423046 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:35.229471922 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:35.229556084 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:35.230154991 CEST	49750	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:35.230160952 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:35.230180025 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:35.230240107 CEST	443	49750	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:35.230320930 CEST	49750	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:35.230477095 CEST	49750	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:35.230495930 CEST	443	49750	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:36.205883026 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:36.205960989 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:36.207099915 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:36.207112074 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:36.207448959 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:36.207767010 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:36.219791889 CEST	443	49750	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:36.219886065 CEST	49750	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:36.220582962 CEST	49750	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:36.220613003 CEST	443	49750	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:36.221366882 CEST	443	49750	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:36.248306990 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:36.265703917 CEST	49750	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:37.586007118 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:37.586177111 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:37.586447954 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:37.586482048 CEST	443	49749	154.0.165.249	192.168.2.4
Apr 2, 2025 07:13:37.586503029 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:37.586525917 CEST	49749	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:13:37.688658953 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:37.688746929 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:37.688833952 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:37.688973904 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:37.688992023 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:37.890775919 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:37.890975952 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:37.893390894 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:37.893415928 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:37.893834114 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:37.894366980 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:37.936269045 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.066890955 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.066947937 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.067106962 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.067137957 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.067195892 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.073422909 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.073647022 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.082318068 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.082513094 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.108561039 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.108771086 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.159972906 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.160217047 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.172336102 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.172533035 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.179003954 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.179188967 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.191339970 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.191549063 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.203274012 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.203469992 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.209882975 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.210093975 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.215584040 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.215789080 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.215786934 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.215853930 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.365129948 CEST	49751	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.365190983 CEST	443	49751	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.446620941 CEST	49752	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.446716070 CEST	443	49752	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.446793079 CEST	49752	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.446964025 CEST	49752	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.446990013 CEST	443	49752	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.636823893 CEST	443	49752	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.637008905 CEST	49752	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.637079000 CEST	443	49752	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.637170076 CEST	49752	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.637182951 CEST	443	49752	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.819314957 CEST	443	49752	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.819504976 CEST	443	49752	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.819669962 CEST	49752	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.832274914 CEST	49752	443	192.168.2.4	207.174.26.219
Apr 2, 2025 07:13:38.832326889 CEST	443	49752	207.174.26.219	192.168.2.4
Apr 2, 2025 07:13:38.939974070 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:38.940016985 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:38.940109015 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:38.940223932 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:38.940232992 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.160546064 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.160645962 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:39.164510965 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:39.164539099 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.164963007 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.165440083 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:39.208319902 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.393569946 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.393723965 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.393826008 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.393892050 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.393893957 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:39.393958092 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.394025087 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:39.394042015 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.394107103 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:39.394120932 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.394149065 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.394196987 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:39.394413948 CEST	49755	443	192.168.2.4	172.67.131.251
Apr 2, 2025 07:13:39.394440889 CEST	443	49755	172.67.131.251	192.168.2.4
Apr 2, 2025 07:13:39.504806042 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.504889011 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.505023003 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.505122900 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.505141973 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.715150118 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.715234041 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.715576887 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.715604067 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.715939999 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.716142893 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.756289959 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.968216896 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.968416929 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.968530893 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.968624115 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.968630075 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.968693018 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.968739986 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.968827009 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.968960047 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:13:39.968998909 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.969065905 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.969120979 CEST	49756	443	192.168.2.4	104.21.4.104
Apr 2, 2025 07:13:39.969156027 CEST	443	49756	104.21.4.104	192.168.2.4
Apr 2, 2025 07:14:00.610457897 CEST	49724	80	192.168.2.4	142.251.40.99
Apr 2, 2025 07:14:00.701368093 CEST	80	49724	142.251.40.99	192.168.2.4
Apr 2, 2025 07:14:00.701602936 CEST	49724	80	192.168.2.4	142.251.40.99
Apr 2, 2025 07:14:05.884512901 CEST	443	49750	154.0.165.249	192.168.2.4
Apr 2, 2025 07:14:05.884680033 CEST	443	49750	154.0.165.249	192.168.2.4
Apr 2, 2025 07:14:05.884784937 CEST	49750	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:14:07.644356012 CEST	49750	443	192.168.2.4	154.0.165.249
Apr 2, 2025 07:14:07.644427061 CEST	443	49750	154.0.165.249	192.168.2.4
Apr 2, 2025 07:14:18.159444094 CEST	49760	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:14:18.159529924 CEST	443	49760	142.251.40.132	192.168.2.4
Apr 2, 2025 07:14:18.159699917 CEST	49760	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:14:18.159840107 CEST	49760	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:14:18.159869909 CEST	443	49760	142.251.40.132	192.168.2.4
Apr 2, 2025 07:14:18.358462095 CEST	443	49760	142.251.40.132	192.168.2.4
Apr 2, 2025 07:14:18.359276056 CEST	49760	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:14:18.359333992 CEST	443	49760	142.251.40.132	192.168.2.4
Apr 2, 2025 07:14:28.349523067 CEST	443	49760	142.251.40.132	192.168.2.4
Apr 2, 2025 07:14:28.349695921 CEST	443	49760	142.251.40.132	192.168.2.4
Apr 2, 2025 07:14:28.349945068 CEST	49760	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:14:29.644438982 CEST	49760	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:14:29.644504070 CEST	443	49760	142.251.40.132	192.168.2.4
Apr 2, 2025 07:14:30.626632929 CEST	49708	443	192.168.2.4	52.113.196.254
Apr 2, 2025 07:14:30.954437971 CEST	49709	443	192.168.2.4	131.253.33.254
Apr 2, 2025 07:15:04.864495993 CEST	443	49710	204.79.197.222	192.168.2.4
Apr 2, 2025 07:15:18.221973896 CEST	49774	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:15:18.222068071 CEST	443	49774	142.251.40.132	192.168.2.4
Apr 2, 2025 07:15:18.222206116 CEST	49774	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:15:18.222352982 CEST	49774	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:15:18.222376108 CEST	443	49774	142.251.40.132	192.168.2.4
Apr 2, 2025 07:15:18.415644884 CEST	443	49774	142.251.40.132	192.168.2.4
Apr 2, 2025 07:15:18.415945053 CEST	49774	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:15:18.416009903 CEST	443	49774	142.251.40.132	192.168.2.4
Apr 2, 2025 07:15:28.445405960 CEST	443	49774	142.251.40.132	192.168.2.4
Apr 2, 2025 07:15:28.445471048 CEST	443	49774	142.251.40.132	192.168.2.4
Apr 2, 2025 07:15:28.445532084 CEST	49774	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:15:29.299500942 CEST	49774	443	192.168.2.4	142.251.40.132
Apr 2, 2025 07:15:29.299585104 CEST	443	49774	142.251.40.132	192.168.2.4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2025 07:13:00.564506054 CEST	56658	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:00.685718060 CEST	53	56658	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:13.562625885 CEST	53	61448	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:13.723701000 CEST	53	56125	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:14.330132008 CEST	53	63232	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:14.480143070 CEST	53	58710	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:18.095808983 CEST	54370	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:18.095973969 CEST	49822	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:18.193531036 CEST	53	54370	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:18.193619967 CEST	53	49822	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:18.909960032 CEST	64436	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:18.910300016 CEST	49620	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:19.013911009 CEST	53	49620	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:19.020582914 CEST	53	64436	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:19.901479006 CEST	53	49566	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:31.475255966 CEST	53	53169	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:34.405786037 CEST	62406	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:34.405936003 CEST	59250	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:35.219353914 CEST	53	59250	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:35.228806973 CEST	53	62406	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:37.588717937 CEST	54040	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:37.588844061 CEST	60443	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:37.687547922 CEST	53	54040	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:37.688162088 CEST	53	60443	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:38.524411917 CEST	53	49484	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:38.835001945 CEST	63154	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:38.835170984 CEST	60301	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:38.937726974 CEST	53	63154	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:38.939014912 CEST	53	60301	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:39.397953033 CEST	54753	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:39.398080111 CEST	49844	53	192.168.2.4	1.1.1.1
Apr 2, 2025 07:13:39.500200033 CEST	53	54753	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:39.504281998 CEST	53	49844	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:50.210386992 CEST	53	58122	1.1.1.1	192.168.2.4
Apr 2, 2025 07:13:52.599390984 CEST	138	138	192.168.2.4	192.168.2.255
Apr 2, 2025 07:14:12.734831095 CEST	53	64435	1.1.1.1	192.168.2.4
Apr 2, 2025 07:14:13.356865883 CEST	53	57040	1.1.1.1	192.168.2.4
Apr 2, 2025 07:14:16.506148100 CEST	53	63670	1.1.1.1	192.168.2.4
Apr 2, 2025 07:14:42.335766077 CEST	53	51684	1.1.1.1	192.168.2.4
Apr 2, 2025 07:15:29.399104118 CEST	53	53176	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2025 07:13:00.117670059 CEST	202	OUT	GET /r/gsr1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Tue, 07 Jan 2025 07:28:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 2, 2025 07:13:00.207504034 CEST	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 02 Apr 2025 04:42:01 GMT Expires: Wed, 02 Apr 2025 05:32:01 GMT Age: 1859 Last-Modified: Tue, 07 Jan 2025 07:28:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding
Apr 2, 2025 07:13:00.212203026 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 2, 2025 07:13:00.302412033 CEST	223	IN	HTTP/1.1 304 Not Modified Date: Wed, 02 Apr 2025 04:42:01 GMT Expires: Wed, 02 Apr 2025 05:32:01 GMT Age: 1859 Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT Cache-Control: public, max-age=3000 Vary: Accept-Encoding

Timestamp	Bytes transferred	Direction	Data
Apr 2, 2025 07:13:00.779386044 CEST	115	OUT	GET / HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Microsoft-CryptoAPI/10.0 Host: x1.i.lencr.org
Apr 2, 2025 07:13:00.871630907 CEST	1254	IN	HTTP/1.1 200 OK Server: nginx Content-Type: application/pkix-cert Last-Modified: Fri, 04 Aug 2023 20:57:56 GMT ETag: "64cd6654-56f" Content-Disposition: attachment; filename="ISRG Root X1.der" Cache-Control: max-age=77752 Expires: Thu, 03 Apr 2025 02:48:52 GMT Date: Wed, 02 Apr 2025 05:13:00 GMT Content-Length: 1391 Connection: keep-alive Data Raw: 30 82 05 6b 30 82 03 53 a0 03 02 01 02 02 11 00 82 10 cf b0 d2 40 e3 59 44 63 e0 bb 63 82 8b 00 30 0d 06 09 2a 86 48 86 f7 0d 01 01 0b 05 00 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 1e 17 0d 31 35 30 36 30 34 31 31 30 34 33 38 5a 17 0d 33 35 30 36 30 34 31 31 30 34 33 38 5a 30 4f 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 29 30 27 06 03 55 04 0a 13 20 49 6e 74 65 72 6e 65 74 20 53 65 63 75 72 69 74 79 20 52 65 73 65 61 72 63 68 20 47 72 6f 75 70 31 15 30 13 06 03 55 04 03 13 0c 49 53 52 47 20 52 6f 6f 74 20 58 31 30 82 02 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 02 0f 00 30 82 02 0a 02 82 02 01 00 ad e8 24 73 f4 14 37 f3 9b 9e 2b 57 28 1c 87 be dc b7 df 38 90 8c 6e 3c e6 57 a0 78 f7 75 c2 a2 fe f5 6a 6e f6 00 4f 28 db de 68 86 6c 44 93 b6 b1 63 fd 14 12 6b bf 1f d2 ea 31 9b 21 7e d1 33 [TRUNCATED] Data Ascii: 0k0S@YDcc0H0O10UUS1)0'U Internet Security Research Group10UISRG Root X10150604110438Z350604110438Z0O10UUS1)0'U Internet Security Research Group10UISRG Root X10"0H0$s7+W(8n<WxujnO(hlDck1!~3<Hy!KqiJffl~<p)"K~G\|H#S8Oo.IWt/8{p!u0<cOK~w.{JL%p)S$J?aQcq.o[\4ylv;by/&676urIAv5/(ldwnG7Y^hrA)>Y>&$ZL@F:Qn;}rxY>Qx/>{JKsP\|Ctt0[q600\H;}`)A\|;FHvvj=8d+(B"']ypN:'Qnd3COB0@0U0U00UyY{sXn0*HUXPi ')au
Apr 2, 2025 07:13:00.871661901 CEST	491	IN	Data Raw: 5c 8a 6e f8 82 e5 69 2f d5 f6 56 4b b9 b8 73 10 59 d3 21 97 7e e7 4c 71 fb b2 d2 60 ad 39 a8 0b ea 17 21 56 85 f1 50 0e 59 eb ce e0 59 e9 ba c9 15 ef 86 9d 8f 84 80 f6 e4 e9 91 90 dc 17 9b 62 1b 45 f0 66 95 d2 7c 6f c2 ea 3b ef 1f cf cb d6 ae 27 Data Ascii: \ni/VKsY!~Lq`9!VPYYbEf\|o;'}~"+"4[XT&3L-<W,N;1"ss993#L<U)"k;W:pMMl]+NEJ&rj,_(.{q{

Timestamp	Bytes transferred	Direction	Data
2025-04-02 05:13:19 UTC	898	OUT	GET /GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51 HTTP/1.1 Host: res2.showcaseworkshop.com Connection: keep-alive sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 05:13:19 UTC	706	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 18964 Connection: close x-amz-id-2: vAhwIksDiLW3oY2c0+mcafARLF6mMKW+ECTRM4oVJGE/aTU/Bh5jx3auSZCTt8HyGFB4s8kap5ATcRn3VqOMgccQvf7RQxglIiqJxstG2fs= x-amz-request-id: 9HBBTHG48DYADKJ6 Date: Wed, 02 Apr 2025 05:13:20 GMT Last-Modified: Wed, 02 Apr 2025 04:34:03 GMT ETag: "a84eb8ccb518dc96f1d4f0f2f53556df" x-amz-server-side-encryption: AES256 Cache-Control: max-age=7776000 Accept-Ranges: bytes Server: AmazonS3 X-Cache: Miss from cloudfront Via: 1.1 96514100085c5a3055b3debbca21d95c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: X1hcxTMOrxexRg7GpUnIfz5G77FcHUlqINaDVluV8A1fGBtw8OVLYA==
2025-04-02 05:13:19 UTC	8494	IN	Data Raw: 20 20 0d 0a 20 20 0d 0a 20 20 0d 0a 09 3c 74 69 74 6c 65 3e 52 45 4d 49 54 54 41 4e 43 45 3c 2f 74 69 74 6c 65 3e 20 20 0d 0a 09 3c 73 74 79 6c 65 3e 20 20 0d 0a 09 09 62 6f 64 79 20 7b 20 20 0d 0a 09 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 69 6d 61 67 65 3a 20 75 72 6c 28 27 64 61 74 61 3a 69 6d 61 67 65 2f 6a 70 65 67 3b 62 61 73 65 36 34 2c 2f 39 6a 2f 34 51 42 57 52 58 68 70 5a 67 41 41 54 55 30 41 4b 67 41 41 41 41 67 41 42 41 45 53 41 41 4d 41 41 41 41 42 41 41 45 41 41 41 45 61 41 41 55 41 41 41 41 42 41 41 41 41 50 67 45 62 41 41 55 41 41 41 41 42 41 41 41 41 52 67 45 6f 41 41 4d 41 41 41 41 42 41 41 49 41 41 41 41 41 41 41 41 41 41 41 43 51 41 41 41 41 41 51 41 41 41 4a 41 41 41 41 41 42 2f 2b 41 41 45 45 70 47 53 55 59 41 41 51 45 42 41 4a 41 41 Data Ascii: <title>REMITTANCE</title> <style> body { background-image: url('data:image/jpeg;base64,/9j/4QBWRXhpZgAATU0AKgAAAAgABAESAAMAAAABAAEAAAEaAAUAAAABAAAAPgEbAAUAAAABAAAARgEoAAMAAAABAAIAAAAAAAAAAACQAAAAAQAAAJAAAAAB/+AAEEpGSUYAAQEBAJAA
2025-04-02 05:13:19 UTC	10470	IN	Data Raw: 6f 75 45 4e 66 64 6f 37 77 37 64 70 39 34 4f 65 4f 43 67 6d 44 77 38 6f 2f 7a 6b 45 45 6e 35 71 6a 58 2b 64 4e 62 53 57 71 4b 51 32 56 34 71 43 38 4e 63 4d 65 69 73 66 71 66 58 31 4c 56 4d 32 32 70 7a 34 6e 59 4a 34 36 49 4a 4f 37 69 58 38 78 55 37 69 54 31 6b 4b 6a 35 32 74 39 58 4e 6c 63 33 34 4b 2f 61 47 38 63 65 71 7a 32 37 57 65 71 4b 71 68 71 5a 70 37 4f 39 6b 73 58 79 4e 78 31 51 65 36 37 68 2f 54 76 56 58 75 6e 34 77 4a 46 45 59 31 39 32 68 76 71 79 44 70 2b 51 52 6e 6a 4f 46 76 56 75 71 39 65 30 37 59 5a 71 65 30 75 65 48 44 7a 6a 48 52 42 4a 34 59 38 44 47 39 55 63 79 54 38 7a 43 38 4e 58 33 6e 56 34 74 4d 4e 79 70 36 45 39 36 34 5a 64 46 37 46 65 64 67 31 6e 32 67 79 56 63 66 66 32 64 37 49 53 63 48 68 42 4c 62 59 35 42 2b 4e 44 46 4c 36 50 55 Data Ascii: ouENfdo7w7dp94OeOCgmDw8o/zkEEn5qjX+dNbSWqKQ2V4qC8NcMeisfqfX1LVM22pz4nYJ46IJO7iX8xU7iT1kKj52t9XNlc34K/aG8ceqz27WeqKqhqZp7O9ksXyNx1Qe67h/TvVXun4wJFEY192hvqyDp+QRnjOFvVuq9e07YZqe0ueHDzjHRBJ4Y8DG9UcyT8zC8NX3nV4tMNyp6E964ZdF7Fedg1n2gyVcff2d7IScHhBLbY5B+NDFL6PU

Timestamp	Bytes transferred	Direction	Data
2025-04-02 05:13:19 UTC	836	OUT	GET /favicon.ico HTTP/1.1 Host: res2.showcaseworkshop.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 05:13:19 UTC	422	IN	HTTP/1.1 401 Unauthorised Content-Type: text/html Content-Length: 285 Connection: close Server: CloudFront Date: Wed, 02 Apr 2025 05:13:19 GMT Content-Encoding: UTF-8 X-Cache: LambdaGeneratedResponse from cloudfront Via: 1.1 1af2e71d065fc2eea37b6b349c843830.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P9 Alt-Svc: h3=":443"; ma=86400 X-Amz-Cf-Id: UaHqwH6y_19ATuJoapwxjGKJJOP-0hFawjoDzagpvXL4tIfy9Xr98A==
2025-04-02 05:13:19 UTC	285	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 20 20 20 20 20 20 20 20 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3a 20 55 6e 61 75 74 68 6f 72 69 73 65 64 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 68 31 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3a 20 55 6e 61 75 74 68 6f 72 69 73 65 64 3c 2f 68 31 3e 0a 20 20 20 20 20 Data Ascii: <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Access Denied: Unauthorised</title> </head> <body> <h1>Access Denied: Unauthorised</h1>

Timestamp	Bytes transferred	Direction	Data
2025-04-02 05:13:36 UTC	876	OUT	POST /admin/save/mer.php HTTP/1.1 Host: thynkfinance.co.za Connection: keep-alive Content-Length: 47 Cache-Control: max-age=0 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Origin: https://res2.showcaseworkshop.com Content-Type: application/x-www-form-urlencoded Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://res2.showcaseworkshop.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 05:13:36 UTC	47	OUT	Data Raw: 32 32 32 32 3d 70 73 6f 65 35 79 25 34 30 62 72 6c 69 6e 68 6a 2e 63 6f 6d 26 31 31 31 31 3d 62 35 25 32 42 64 25 33 41 55 54 58 6d 69 71 55 Data Ascii: 2222=psoe5y%40brlinhj.com&1111=b5%2Bd%3AUTXmiqU
2025-04-02 05:13:37 UTC	315	IN	HTTP/1.1 302 Moved Temporarily Server: nginx Date: Wed, 02 Apr 2025 05:13:37 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: close Location: https://i.ibb.co/nBXYTs4/wrong-details.jpg X-XSS-Protection: 1; mode=block X-Content-Type-Options: nosniff X-Server-Powered-By: nginx-ah

Timestamp	Bytes transferred	Direction	Data
2025-04-02 05:13:37 UTC	760	OUT	GET /nBXYTs4/wrong-details.jpg HTTP/1.1 Host: i.ibb.co Connection: keep-alive Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Referer: https://res2.showcaseworkshop.com/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 05:13:38 UTC	380	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 02 Apr 2025 05:13:38 GMT Content-Type: image/jpeg Content-Length: 42786 Connection: close Last-Modified: Mon, 18 Dec 2023 06:24:29 GMT Expires: Thu, 31 Dec 2037 23:55:55 GMT Cache-Control: max-age=315360000 Cache-Control: public Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET, OPTIONS Accept-Ranges: bytes
2025-04-02 05:13:38 UTC	3716	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 00 22 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 01 01 12 00 03 00 00 00 01 00 01 00 00 00 00 00 00 ff db 00 43 00 02 01 01 02 01 01 02 02 02 02 02 02 02 02 03 05 03 03 03 03 03 06 04 04 03 05 07 06 07 07 07 06 07 07 08 09 0b 09 08 08 0a 08 07 07 0a 0d 0a 0a 0b 0c 0c 0c 0c 07 09 0e 0f 0d 0c 0e 0b 0c 0c 0c ff db 00 43 01 02 02 02 03 03 03 06 03 03 06 0c 08 07 08 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c 0c ff c0 00 11 08 02 12 04 5f 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 Data Ascii: JFIF``"ExifMM*CC_"
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: 44 50 cb b7 6e dd bf c5 5e e7 fb 67 7c 3e d6 fc 7f fb 32 dd e9 3a 0e 97 71 ab 6b 11 bd 94 a9 67 0b a2 bc 9e 5c a8 cc 14 bb 2a fd d0 df 79 b6 d0 06 cf c3 9f da a7 43 f1 f7 8c a2 f0 ec fa 57 89 bc 2f ae dc c1 f6 8b 3b 3d 7a c3 ec ad 7d 1a fd e6 89 83 32 3e dc fc ca 1b 72 ff 00 76 ba cd 17 e2 df 85 fc 51 e2 7b ad 0f 4d f1 37 87 f5 0d 66 cc 1f b4 58 db 6a 30 cb 75 6f 8e bb e3 56 2c bf 88 af 08 d7 7e 1f 78 db f6 8f f8 91 e1 ad 46 e7 c3 37 de 03 d2 fc 1b 61 76 b1 4b a8 5c 45 25 dd e5 d4 f0 79 6b b5 62 66 55 45 fb db 99 be f7 f0 d7 19 f0 ff 00 f6 78 f1 85 c4 3f 0d 7c 3a be 07 ff 00 84 56 fb c0 b7 ef 71 a8 f8 9c 4b 07 97 7c bb 1d 4b 44 c8 de 6b 34 8c ca cd bd 57 ee d0 07 d4 92 7c 6b f0 78 f1 45 c6 8a de 2c f0 df f6 d5 9a 33 cf a7 ff 00 6a 42 2e a0 55 19 66 78 b7 Data Ascii: DPn^g\|>2:qkg\*yCW/;=z}2>rvQ{M7fXj0uoV,~xF7avK\E%ykbfUEx?\|:VqK\|KDk4W\|kxE,3jB.Ufx
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: f0 b2 5f fe 81 97 5f f7 f5 2b c3 ff 00 62 cf f9 37 bb 1f fb 0b eb 5f fa 76 bc af 56 a2 5f 10 1b 5f f0 b2 5f fe 81 97 5f f7 f5 28 ff 00 85 92 ff 00 f4 0c ba ff 00 bf a9 58 b4 50 06 d7 fc 2c 97 ff 00 a0 65 d7 fd fd 4a 3f e1 64 bf fd 03 2e bf ef ea 56 2d 14 01 b5 ff 00 0b 25 ff 00 e8 19 75 ff 00 7f 52 8f f8 59 2f ff 00 40 cb af fb fa 95 8b 45 00 6d 7f c2 c9 7f fa 06 5d 7f df d4 a3 fe 16 4b ff 00 d0 32 eb fe fe a5 62 d1 40 1b 5f f0 b2 5f fe 81 97 5f f7 f5 28 ff 00 85 92 ff 00 f4 0c ba ff 00 bf a9 58 b4 50 06 d7 fc 2c 87 ff 00 a0 65 d7 fd fd 4a 3f e1 64 bf fd 03 2e bf ef ea 56 2d 14 01 b5 ff 00 0b 25 ff 00 e8 19 75 ff 00 7f 52 8f f8 59 2f ff 00 40 cb af fb fa 95 8b 45 00 6d 7f c2 c9 7f fa 06 5d 7f df d4 a3 fe 16 4b ff 00 d0 32 eb fe fe a5 62 d1 40 1b 5f f0 b2 Data Ascii: __+b7_vV____(XP,eJ?d.V-%uRY/@Em]K2b@___(XP,eJ?d.V-%uRY/@Em]K2b@_
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 40 05 14 51 47 d9 d4 02 8a 28 a0 02 8a 28 a0 02 8a 28 a0 02 8a 28 a3 de 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 00 a2 8a 28 f5 2b 97 de 0a 28 a2 82 7d 42 8a 28 a0 02 8a 28 a0 3d de 81 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 45 14 50 01 5b 5e 08 ff 00 90 b4 9f f5 c8 ff 00 35 ac Data Ascii: Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@QG((((((((((+(}B((=EPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP[^5
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: 6b f6 c2 bf 02 ff 00 e0 b1 fa a3 ea 5f f0 51 4f 88 1b bf e5 dd ed 60 53 9d df 76 d6 2f f3 ff 00 01 a3 23 b3 ad 79 74 37 f1 3a b7 26 5a a1 dd 9f 2f 8e 6b b4 fd 9d fc 20 be 3e fd a0 3c 0f a1 ba ee 8f 56 d7 ac ac dc 7f b2 f3 a2 b7 fe 3b ba b8 bc d7 b6 7f c1 38 f4 f5 d5 3f 6e cf 85 71 32 ef 5f f8 48 2d dd 87 de fb ac cd bb fe 03 b7 75 7d 4d 7d 29 36 7e 17 94 53 e7 c6 53 5f de 47 f4 49 6d 0a db db c7 1a ae c5 8d 55 54 7f c0 57 e5 a9 28 ff 00 96 7f e7 fb d4 57 e7 cf e2 e6 3f ae 28 d3 e5 82 51 0a fe 7a ff 00 e0 a9 7e 0a 1e 03 ff 00 82 80 fc 51 b3 8a 3f 2a 1b 8d 5b ed a0 0f bb fe 90 89 3b 7f e3 d2 b5 7f 42 95 f8 4f ff 00 05 ca d2 d7 4c ff 00 82 89 78 99 97 fe 5e b4 ed 3e 76 3b 76 fc df 67 45 ff 00 d9 6b d9 c8 a5 6a cd 1f 9a f8 a1 4e f9 7c 27 e6 7c 8c bf fb 2d 7d Data Ascii: k_QO`Sv/#yt7:&Z/k ><V;8?nq2_H-u}M})6~SS_GImUTW(W?(Qz~Q?*[;BOLx^>v;vgEkjN\|'\|-}
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: 87 94 2f 52 47 e5 de 27 67 10 aa e1 83 a4 ef cb b8 dd f5 f5 a7 fc 11 27 e1 bc 9e 3c ff 00 82 82 78 5e e7 ca 66 b7 f0 dd ad d6 ab 3b ff 00 0a ed 89 91 3f f2 23 ad 7c 93 5f ad 9f f0 6e ff 00 ec ef 37 87 fe 1e f8 bb e2 5d f5 bb 42 de 20 95 74 8d 35 dd 7f e5 8c 4d ba 57 5f f6 5a 4d aa df ee 35 7a 79 85 6e 4c 3b 3e 37 82 f2 f9 62 b3 3a 71 5f 67 53 ec af f8 28 07 fc 99 2f c5 5f fb 16 6f bf f4 43 57 f3 97 ff 00 2c ab fa 5e fd a2 3e 15 cd f1 c3 e0 3f 8b bc 1f 6f 79 1e 9f 37 89 b4 9b 8d 39 2e 64 46 91 61 69 51 94 33 2a b2 ee db bb 76 dd df c3 5f 99 ff 00 f1 0d df 89 bc bf f9 2a 1a 0f aa ff 00 c4 a2 5f fe 3b 5e 36 4f 8c a5 49 38 cd ee 7e 8d e2 07 0f e3 b1 f5 e9 cb 0b 4e ea 27 e6 8e 7f da a3 b7 fe 83 5f a5 7f f1 0d c7 89 bf e8 a8 68 3f f8 27 97 ff 00 8e d1 ff 00 10 Data Ascii: /RG'g'<x^f;?#\|_n7]B t5MW_ZM5zynL;>7b:q_gS(/_oCW,^>?oy79.dFaiQ3v__;^6OI8~N'_h?'
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: c5 f7 a8 03 eb 2a 2b 90 f8 3b e0 3d 5b e1 fe 87 71 6f aa 78 b3 50 f1 6f 9d 2e f8 2e 6e d1 56 48 d3 6a ae dd ca cd bb e6 f9 b7 7c bf 7a ba fa 00 28 a2 8a 00 2b ca 7f 68 8f da 52 4f d9 ff 00 c4 be 19 b7 b8 d1 7e dd a6 6b d7 1f 67 96 f7 ed 5e 5f d9 5b 72 ab 7c bb 5b 76 d5 65 6f bc b5 ea d5 e3 7f b7 67 c3 7f f8 58 9f b3 de a8 d0 c7 be f3 45 65 bf 80 85 dc df 2f ca ca bf dd f9 59 9b fe 03 40 1e c5 1d c2 c9 6e b2 2b 7e ed 97 72 bf f0 ed fb db ab c3 7e 07 fe db 16 3f 19 be 34 6a 9e 13 5d 25 6c 12 d5 65 6b 3b b3 79 e6 35 d6 c6 da df 26 c5 da cc bf 37 de 6f e2 aa fa 5f ed 00 26 fd 85 9b c5 12 4d ba fa 3d 25 ac 98 bb 7c cd 71 fe a9 bf e0 5b be 6f f8 0d 78 3c 7f 0f e6 fd 9b f4 bf 84 3f 10 02 f9 72 5e 4a cb a9 1d bf 36 d9 59 9b 9f e1 ff 00 57 2b 2f fc 06 80 3e d0 f8 Data Ascii: *+;=[qoxPo..nVHj\|z(+hRO~kg^_[r\|[veogXEe/Y@n+~r~?4j]%lek;y5&7o_&M=%\|q[ox<?r^J6YW+/>
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: df 37 f7 b7 3b 7f c0 56 bd 2b fe 0a 75 ff 00 26 e3 0f fd 86 6d ff 00 f4 09 6b df 34 bf 0f d9 68 9b fe c3 63 67 67 e6 7c cf e4 40 b1 ee ff 00 7b 6a ae ea 93 52 d2 ad 75 8b 7f 26 f2 d6 de ea 1d db b6 4c 8b 22 ee fe f6 d6 f9 68 02 2d 03 fe 45 fb 1f fa f6 4f fd 05 6b e4 ef 84 fe 33 8f f6 33 f8 ed e3 2d 37 c6 16 f7 96 fa 2f 88 2e 3e d1 65 aa 24 0d 24 5b 55 99 97 76 d5 6f bc ac bf ee b2 d7 d7 ca bb 57 6a ae d5 fb aa 05 57 d4 b4 7b 5d 62 15 8e f2 d2 de ee 3f bc a9 2c 4b 22 ff 00 df 2c b4 01 f2 9f ed 47 f1 d3 4f fd a9 7c 3f a7 f8 0f e1 fc 37 5a f5 e6 a5 78 93 dc 5d a4 0d 1c 16 a8 bb 97 e6 66 0b fd ed cc df 75 55 7f 8b 77 cb a7 ff 00 05 04 f0 c2 f8 37 f6 42 f0 ee 92 ad e6 2e 9b a8 d9 5b ef c7 de db 04 eb bb ff 00 1d af a5 74 bf 0f e9 fa 18 6f b0 d9 59 d9 ee f9 5b Data Ascii: 7;V+u&mk4hcgg\|@{jRu&L"h-EOk33-7/.>e$$[UvoWjW{]b?,K",GO\|?7Zx]fuUw7B.[toY[
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: 8b 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 a2 80 0a 28 Data Ascii: ((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((
2025-04-02 05:13:38 UTC	4096	IN	Data Raw: ff 00 7f 7f fb 1a 00 86 8a 9b fb 13 50 ff 00 9f 58 7f ef ef ff 00 63 47 f6 26 a1 ff 00 3e b0 ff 00 df df fe c6 80 21 a2 a6 fe c4 d4 3f e7 d6 1f fb fb ff 00 d8 d1 fd 89 a8 7f cf ac 3f f7 f7 ff 00 b1 a0 08 68 a9 bf b1 35 0f f9 f5 87 fe fe ff 00 f6 34 7f 62 6a 1f f3 eb 0f fd fd ff 00 ec 68 02 1a 2a 6f ec 4d 43 fe 7d 61 ff 00 bf bf fd 8d 1f d8 9a 87 fc fa c3 ff 00 7f 7f fb 1a 00 86 8a 9b fb 13 50 ff 00 9f 58 7f ef ef ff 00 63 47 f6 26 a1 ff 00 3e b0 ff 00 df df fe c6 80 21 a2 a6 fe c4 d4 3f e7 d6 1f fb fb ff 00 d8 d1 fd 89 a8 7f cf ac 3f f7 f7 ff 00 b1 a0 08 68 a9 bf b1 35 0f f9 f5 87 fe fe ff 00 f6 34 7f 62 6a 1f f3 eb 0f fd fd ff 00 ec 68 02 1a 2a 6f ec 4d 43 fe 7d 61 ff 00 bf bf fd 8d 1f d8 9a 87 fc fa c3 ff 00 7f 7f fb 1a 00 86 8a 9b fb 13 50 ff 00 9f 58 Data Ascii: PXcG&>!??h54bjhoMC}aPXcG&>!??h54bjhoMC}aPX

Timestamp	Bytes transferred	Direction	Data
2025-04-02 05:13:38 UTC	604	OUT	GET /favicon.ico HTTP/1.1 Host: i.ibb.co Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://i.ibb.co/nBXYTs4/wrong-details.jpg Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 05:13:38 UTC	200	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Wed, 02 Apr 2025 05:13:38 GMT Content-Type: text/html Content-Length: 162 Connection: close Location: https://simgbb.com/images/favicon.png
2025-04-02 05:13:38 UTC	162	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

Timestamp	Bytes transferred	Direction	Data
2025-04-02 05:13:39 UTC	621	OUT	GET /images/favicon.png HTTP/1.1 Host: simgbb.com Connection: keep-alive sec-ch-ua-platform: "Windows" User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134" sec-ch-ua-mobile: ?0 Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-Fetch-Storage-Access: active Referer: https://i.ibb.co/ Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9
2025-04-02 05:13:39 UTC	358	IN	HTTP/1.1 200 OK Date: Wed, 02 Apr 2025 05:13:39 GMT Content-Type: image/png Content-Length: 7235 Connection: close Server: cloudflare Accept-Ranges: bytes Last-Modified: Tue, 09 Apr 2024 09:36:03 GMT Etag: "66150c03-1c43" Cache-Control: max-age=31536000 Cf-Cache-Status: HIT Age: 751 CF-RAY: 929dd694de1e1aea-EWR alt-svc: h3=":443"; ma=86400
2025-04-02 05:13:39 UTC	1011	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 01 2c 00 00 01 2c 08 06 00 00 00 79 7d 8e 75 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 00 09 70 48 59 73 00 00 0e c4 00 00 0e c4 01 95 2b 0e 1b 00 00 00 07 74 49 4d 45 07 e0 03 0e 14 38 02 9f 51 6a ba 00 00 1b d0 49 44 41 54 78 da ed 9d 79 90 1c d5 7d c7 bf 3d 3d f7 cc ce ec cc 6a 4f 69 25 21 81 84 ae 95 38 c4 61 10 b2 65 97 71 41 ca b1 71 25 26 d8 15 db 40 e1 38 d8 71 8c 8b c4 f1 51 b1 71 95 e3 d8 40 ca 89 83 03 06 93 04 6c a4 10 a7 f0 6d 07 db 18 90 c5 61 8c 8e d5 b5 92 76 b5 42 48 ab dd d5 ce ce ce 7d f4 91 3f 84 5c 84 43 da 99 9d d7 af df cc f7 f3 17 45 c1 cc f4 7e fb 7d fa f5 3b 7e 4f 5b ba 79 d4 06 21 84 28 80 87 7f 02 42 08 85 45 08 21 14 16 21 84 c2 22 84 10 0a 8b 10 42 28 2c Data Ascii: PNGIHDR,,y}ubKGDpHYs+tIME8QjIDATxy}==jOi%!8aeqAq%&@8qQq@lmavBH}?\CE~};~O[y!(BE!!"B(,
2025-04-02 05:13:39 UTC	1369	IN	Data Raw: fb 97 44 e1 d5 9c 1d 3f 88 e8 c0 92 36 79 c3 8d 65 c3 c2 3e 6e 5d 62 16 14 56 6d 5c bb 30 22 fd 37 b4 07 74 5c d9 13 72 f4 3b 07 3a 02 d0 3d f2 a2 da 3f 53 01 c7 db 99 05 85 55 23 6f e9 0e ba e2 77 5c e1 f0 ef 18 48 ca ed 55 ee 9a e2 80 3b b3 a0 b0 6a a2 33 e0 41 5f c4 e7 8a df 72 81 c3 63 18 b2 07 79 b9 c2 9d 59 50 58 35 b2 b8 cd eb a2 df e2 ac 38 07 92 1c e4 75 4f 0f 8b 59 50 58 b3 a0 2b e4 1e 61 b5 07 74 f8 1c 5a dd d0 13 f4 a0 3b 2c ef da 67 ca 26 46 9b 68 2f 25 b3 a0 b0 1c 21 ec d5 5a f2 f7 c8 9e 42 df 95 2a 03 1a cb ec 30 0b 0a ab 26 4c bb 35 7f 8f f4 45 8a 5c e1 ce 2c 28 ac da c9 57 2d d7 fc 16 cb b2 50 30 9c f9 3d 03 1d 72 67 a5 38 7e c5 2c 28 ac 3a 18 2b b8 e7 dd 7d bc 68 c2 72 60 13 b4 06 1b ab 13 72 1b c9 4e 36 12 66 41 61 d5 ce 48 b6 0a cb b2 Data Ascii: D?6ye>n]bVm\0"7t\r;:=?SU#ow\HU;j3A_rcyYPX58uOYPX+atZ;,g&Fh/%!ZB*0&L5E\,(W-P0=rg8~,(:+}hr`rN6fAaH
2025-04-02 05:13:39 UTC	1369	IN	Data Raw: a9 0d e4 34 97 76 85 f0 e0 c6 6e 84 25 0d 21 31 0b f7 64 a1 8c b0 64 77 c9 f7 a6 ab 8e 1d 47 0f 00 ab 12 7e f8 75 ae df 3d cd c5 9d 41 7c eb ca 2e 68 70 7e f4 97 59 b8 27 0b 65 84 25 fd 75 d0 f1 f1 2b 3f 5b c6 6b b8 a2 27 84 db 07 12 12 1e 96 cc c2 2d 59 b0 87 35 4b 9c de 74 2a fb 7a dd ca 2d 2b e2 d8 d8 13 64 16 2d 9a 85 12 c2 f2 c0 c6 ca 76 b9 63 08 4e 0f b8 af 4d b2 91 bc 19 5f bc 28 09 bf 87 59 b4 62 16 4a 08 6b 59 dc 87 b0 4f de 28 5f ea 8d 16 ed 09 a4 dd a7 61 61 9b 8f ad e1 4d e8 8f fa 70 eb ca 38 b3 68 b1 2c 94 11 96 ec 29 e5 c1 14 5f 07 dd c6 8d cb da 90 f0 6b cc a2 85 b2 50 46 58 b2 cf 81 73 fa 94 92 75 6c 24 67 25 e4 d3 f1 e1 65 31 66 d1 42 59 28 23 2c e9 c7 2a 4d 71 86 d0 8d 7c f0 dc 36 e1 eb 81 98 85 7b b2 38 13 ae 59 e9 1e f4 00 4b 25 8f 21 Data Ascii: 4vn%!1ddwG~u=A\|.hp~Y'e%u+?[k'-Y5Ktz-+d-vcNM_(YbJkYO(_aaMp8h,)_kPFXsul$g%e1fBY(#,Mq\|6{8YK%!
2025-04-02 05:13:39 UTC	1369	IN	Data Raw: a3 2d 56 12 59 d2 20 6f 87 c0 3a 49 93 45 93 59 28 9e 85 32 c2 1a 68 b1 a7 dc da 16 a8 1b fe 86 8d 24 28 b0 91 d4 db c3 62 16 ec 61 d5 82 df 03 2c 8b fb a4 de 34 4e 0e b8 7b 60 63 55 bb bc eb 75 7a 81 ec ab 11 59 eb bb 9e a7 3a b3 60 0f ab 66 56 27 fc f0 e9 f2 16 ed 4d 14 0c 9c 70 70 9b fc f2 b8 0f 21 9f bc 09 86 a1 99 2a 2a 96 9c ef 5e 2c 70 35 f9 44 1d 4f 75 66 e1 9e 2c 94 11 96 f4 0a 0d a9 d6 7a 1d dc 2e 69 90 17 00 16 45 c5 f4 66 0c d3 c2 c9 3a 1a 09 b3 70 4f 16 ea 08 ab e5 2a 34 b4 d6 8a fe ff df 48 c4 3c d5 8f e6 8d ba 0e 1f 65 16 ee c9 42 19 61 c9 ae d0 b0 b3 d5 2a 34 48 6c 24 cb 05 8d 55 d6 7b 02 0c b3 70 4f 16 4a 08 ab dd a7 61 61 9b bc 41 4f cb b2 1c 3d 25 27 a2 03 4b 63 f2 16 29 ce 94 4d 8c 66 0d 29 df dd 17 d6 91 10 74 84 56 3d 8d 84 59 b8 27 Data Ascii: -VY o:IEY(2h$(ba,4N{`cUuzY:`fV'Mpp!*^,p5DOuf,z.iEf:pO4H<eBa*4Hl$U{pOJaaAO=%'Kc)Mf)tV=Y'
2025-04-02 05:13:39 UTC	1369	IN	Data Raw: ab 31 0b 97 64 a1 8c b0 12 01 b9 c2 ca 09 9c 86 5d 97 f4 e3 b6 35 ed ae 0a 51 f4 df 7b 43 77 00 1f 12 b8 4f 2d 53 31 f1 cd 3d e9 86 7c 56 40 d7 98 85 4b b2 50 46 58 21 c9 37 8d 69 8b 11 56 7f 58 c7 bd 1b 3a 5d f3 2a 78 9a d5 02 37 fa f6 04 3d b8 f3 b2 79 f0 08 ac 6b f6 ed fd 33 98 ae 34 26 b3 80 47 63 16 2e c9 42 19 61 05 25 0b ab dd df f8 cb 8a fb 34 3c b0 b1 4b d8 8a e2 b9 70 51 87 1f 3e 01 7f f2 a0 07 b8 77 83 d8 6b 3e 96 ab e2 3b 43 8d 5b 49 6d d8 cc c2 2d 59 28 23 2c bf 64 61 9d df e0 6d 41 71 9f 86 07 37 76 09 1d 37 98 53 8f d6 a7 e3 ba 73 1a bb 3d c8 ab d9 b8 e7 ca 4e ac 12 bc 2f ef 0b bf 4f a1 91 45 61 4b a6 c5 2c 5c 92 85 32 c2 32 2c b9 8f b9 2b ba 83 f0 37 c8 99 0b c2 3a 1e d9 d4 83 81 8e a0 ab 83 bc 75 65 1c 8d 9a 9c f5 7b 80 7b ae e8 c2 55 bd Data Ascii: 1d]5Q{CwO-S1=\|V@KPFX!7iVX:]*x7=yk34&Gc.Ba%4<KpQ>wk>;C[Im-Y(#,damAq7v7Ss=N/OEaK,\22,+7:ue{{U
2025-04-02 05:13:39 UTC	748	IN	Data Raw: dc 8b 6f be a5 13 e7 48 3e 85 26 5f 35 f1 1f 07 b2 b8 6f 7f 06 39 87 ce 87 ba a6 3f 84 2f 5d 98 44 c2 85 c7 85 bd 96 67 c6 8b b8 6f df 0c 9e 1e 6f ce d7 0d 66 41 61 cd 9a a0 07 f8 ec 05 09 5c bf 24 2a f4 60 c8 37 62 bc 60 e0 bf 46 72 78 e8 60 06 29 09 b5 ac 13 7e 0d 1f 5f d5 8e eb 97 44 11 70 59 29 e6 92 61 e1 7f 5f 2e e0 3b 43 19 ec 4e 37 7f c5 0d 66 41 61 d5 c4 ea 84 0f 5f b8 20 29 bc d8 fe e9 32 c9 5b 46 72 78 fc e5 82 2b f6 55 cd 0f eb b8 69 79 0c ef 59 14 41 4c e2 0c 6a c9 38 f5 b7 f9 c5 cb 05 fc ec 68 1e 39 a3 f5 1a 02 b3 a0 b0 6a e2 92 ce 00 6e 5c de 86 8d 3d 21 f8 f4 c6 3c e9 d2 65 13 bf 3d 51 c4 2f 8f 17 f1 c4 f1 a2 63 af 7d f5 f4 36 af 59 18 c1 d5 0b c2 b8 bc 2b 20 bc 1e 79 c9 b0 b0 37 5d c1 0b 93 65 3c 37 51 c2 73 13 25 94 2c 36 06 66 41 61 d5 Data Ascii: oH>&_5o9?/]DgoofAa\$*`7b`Frx`)~_DpY)a_.;CN7fAa_ )2[Frx+UiyYALj8h9jn\=!<e=Q/c}6Y+ y7]e<7Qs%,6fAa

Target ID:	1
Start time:	01:12:46
Start date:	02/04/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\user\Desktop\Payment Remittance.pdf"
Imagebase:	0x7ff6a0340000
File size:	5'641'176 bytes
MD5 hash:	24EAD1C46A47022347DC0F05F6EFBB8C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	2
Start time:	01:12:47
Start date:	02/04/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16777215
Imagebase:	0x7ff65b910000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	01:12:48
Start date:	02/04/2025
Path:	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.6.20320 Chrome/105.0.0.0" --lang=en-US --user-data-dir="C:\Users\user\AppData\Local\CEF\User Data" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2236 --field-trial-handle=1588,i,12727439123907870177,15176298521270964230,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
Imagebase:	0x7ff65b910000
File size:	3'581'912 bytes
MD5 hash:	9B38E8E8B6DD9622D24B53E095C5D9BE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	20
Start time:	01:13:11
Start date:	02/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Target ID:	21
Start time:	01:13:12
Start date:	02/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=280,i,5399740859030042710,15862493063084477710,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2124 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Payment Remittance.pdf

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Phishing

Compliance

Networking

System Summary

Hooking and other Techniques for Hiding and Protection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\5d68394d-6f5f-4dfa-91be-509282bed852.tmp

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Network\Network Persistent State (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old (copy)

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-250402051252Z-162.bmp

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2D85F72862B55C4EADD9E66E06947F3D

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.5292

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst (copy)

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\ACROBAT_READER_MASTER_SURFACEID

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Home_View_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_FirstMile_Right_Sec_Surface

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_READER_LAUNCH_CARD

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Convert_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Banner

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Disc_LHP_Retention

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\DC_Reader_Edit_LHP_Banner

Windows Analysis Report
Payment Remittance.pdf

Target ID:	22
Start time:	01:13:17
Start date:	02/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://res2.showcaseworkshop.com/GE395EA18YUP75V94S5B2UZOZ164ISMU4Z3S6GIQ/r/4KRJUA8RA90UCYIDUASOOE/5881585.html?e=1746403200&s2=801f060ed37b69949cfe64de9631a1b9dc830004143f29d4460257e26362b79b97a3e0aa793407e995ecabcb7e5a99bf4f0727b44a0e089b35fcb2de9c07ea51"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Description:	Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems. Spearphishing with a link is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments. Spearphishing may also involve social engineering techniques, such as posing as a trusted source.
Tactics:	Initial Access
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre