Edit tour

Windows Analysis Report
https://abstrktion.co.za/deep/collabo.html

Overview

General Information

Sample URL:	https://abstrktion.co.za/deep/collabo.html
Analysis ID:	1676563
Infos:

Detection

Score:	21
Range:	0 - 100
Confidence:	80%

Signatures

AI detected suspicious Javascript

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML title does not match URL

Classification

Process Tree

System is w10x64

chrome.exe (PID: 568 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5704 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2480,i,12182408685030035214,10457824280967504998,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2512 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 5944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://abstrktion.co.za/deep/collabo.html" MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

HTTP traffic detected: GET /r/r4.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMTUser-Agent: Microsoft-CryptoAPI/10.0Host: c.pki.goog

Source: 0.0..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://abstrktion.co.za/deep/collabo.html... This script demonstrates several high-risk behaviors, including dynamic code execution, data exfiltration, and obfuscated URLs. It disables right-click and keyboard shortcuts, likely to prevent users from accessing developer tools. The script also sets up a click-based trigger to execute the 'setupStealthAccess' function, which collects the user's email address and sends it to a suspicious, obfuscated URL. Additionally, the script includes a 'honeypot' field, which is a common technique used in malicious forms to detect and filter out automated submissions. Overall, the script exhibits a high degree of malicious intent and should be considered a significant security risk.
Source: 1.1..script.csv	Joe Sandbox AI: Detected suspicious JavaScript with source url: https://yxmo0vfcf8nxkwdfegsw.nzbjyd.es/jdh1239/?re... This script exhibits several high-risk behaviors, including dynamic code execution, data exfiltration, and the use of obfuscated code/URLs. The script appears to be attempting to execute malicious code and collect sensitive user data, which is a clear indication of malicious intent.

Source: https://abstrktion.co.za/deep/collabo.html	HTTP Parser: No favicon
Source: https://yxmo0vfcf8nxkwdfegsw.nzbjyd.es/jdh1239/?ref=xt9fmt@cfyv.com	HTTP Parser: No favicon

Source: unknown	HTTPS traffic detected: 142.250.69.4:443 -> 192.168.2.4:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.29.183.29:443 -> 192.168.2.4:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.29.183.29:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 102.219.84.139:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 102.219.84.139:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 102.219.84.139:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.139:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.139:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.139:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.179:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.55.241.179:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.4:49753 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 2.17.190.73
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 184.29.183.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.27
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 131.253.33.254
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 192.178.49.195
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.222

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: abstrktion.co.za
Source: global traffic	DNS traffic detected: DNS query: cdn-icons-png.flaticon.com
Source: global traffic	DNS traffic detected: DNS query: yxmo0vfcf8nxkwdfegsw.nzbjyd.es
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com

Source: chromecache_63.2.dr	String found in binary or memory: https://cdn-icons-png.flaticon.com/512/337/337946.png
Source: chromecache_63.2.dr	String found in binary or memory: https://fonts.googleapis.com/css2?family=Inter&display=swap

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2480,i,12182408685030035214,10457824280967504998,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2512 /prefetch:3
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://abstrktion.co.za/deep/collabo.html"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2480,i,12182408685030035214,10457824280967504998,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2512 /prefetch:3	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	1 Process Injection	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Rootkit	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Name	IP	Active	Malicious	Reputation
a.nel.cloudflare.com	35.190.80.1	true	false	high
www.google.com	142.250.69.4	true	false	high
a1990.dscd.akamai.net	23.55.241.139	true	false	high
abstrktion.co.za	102.219.84.139	true	true	unknown
yxmo0vfcf8nxkwdfegsw.nzbjyd.es	104.21.112.1	true	true	unknown
cdn-icons-png.flaticon.com	unknown	unknown	false	high

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.69.4	www.google.com	United States	15169	GOOGLEUS	false
102.219.84.139	abstrktion.co.za	unknown	36926	CKL1-ASNKE	true
104.21.112.1	yxmo0vfcf8nxkwdfegsw.nzbjyd.es	United States	13335	CLOUDFLARENETUS	true
23.55.241.139	a1990.dscd.akamai.net	United States	20940	AKAMAI-ASN1EU	false
23.55.241.179	unknown	United States	20940	AKAMAI-ASN1EU	false
35.190.80.1	a.nel.cloudflare.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1676563
Start date and time:	2025-04-28 20:10:57 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 6s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://abstrktion.co.za/deep/collabo.html
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	SUS
Classification:	sus21.win@22/17@14/7

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8183
Entropy (8bit):	7.398234430204932
Encrypted:	false
SSDEEP:	192:4L76TRDpHglaKFp5BJ/HZ9Ir22aCeRqNXlW8:c7+A/nJRar16wc8
MD5:	9A85752042AE270B88114895B82DA2C1
SHA1:	008289668D0D6E8B68F9D5120B863556D4E44E84
SHA-256:	5EEDB987A0D26A60527854460E67BB0762DE152F45B5BE580DE5AA21E524D309
SHA-512:	82CC33EADF5AFE4480357D994B8C1A1376EF02F286438C9A6873BEDB33D49013CD73ACCA69D35D1E57716D48D7758D427590E529266DA645AC6616BD3F0E1DA6
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR..............x......sBIT....\|.d.....pHYs.........B(.x....tEXtSoftware.www.inkscape.org..<....tIDATx.....$u}.._.}......\....a..^."...(^H<..(.`....1....A.. *......x, r..,......T.....;.=3.]..K...lf~.S.oWwW...j...\....lK.m.f.......V.....}.I0....%...........d.1...n.-fN.&.....w%7oO...m.dk3..~..D..."....!......vf......e..u.....]m....t.O.._.l.$.b................L...........5.../L.D...\|,..Kn~.l............h..%[.........?...d;9..&."..@>\|$..d. .@........... ...9Y..O.......D.. '........?@. .r...U?@. .r......P..D.. ?...~..L.....\|92..1.@. ....+...I.".../o....D.. w.6.@. .rd..U....M.....\|y........y..."...#.W..On^b...@......c...@....#.D.. .... .....@. .....@.........."...... .........".....@.. .........".....@.. ........."@.. .........".....@.. .........".....@.. .........".....@.. ........."@....... ........."@....... ........."@.. .D...@. .......D........@. .......D..... ..@.........D..... ..@.........D..... ..@.........D..... ..@.........D...@. .......D..... ..@.....

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Web Open Font Format (Version 2), TrueType, length 23692, version 1.0
Category:	downloaded
Size (bytes):	23692
Entropy (8bit):	7.991897162752029
Encrypted:	true
SSDEEP:	384:rfabeuzsqm+MAlOitodpHq9WS5TO+cig4RKuIc7OhiVaCcHKLgFT1GS:rfEeuzM+MFSoHqgS5TOjr+QTUVPuSQ5X
MD5:	F837D382A885A07C34A3D4BF4F49373D
SHA1:	68DDCEEF1D164A48D9D01D4A74F26B7897323229
SHA-256:	DD05E326CF8EAC3B55ACECF29C842ED73E6E6DD06491CF47F7E8800680AB3E33
SHA-512:	EF010D89971C4F69AF7BF541430364C56245A5B63ED730FE628E49F48FA9E201C7F42B1E104EB14C3193BF79DD7CE20244F6B963E9996EB8308C0D61F444ECE6
Malicious:	false
Reputation:	low
URL:	https://fonts.gstatic.com/s/inter/v18/UcCO3FwrK3iLTeHuS_nVMrMxCp50SjIw2boKoduKmMEVuLyfAZ9hiA.woff2
Preview:	wOF2......\...........\)..........................P......p.`?STAT^..>........>.....6.$.... ..\........Ghv_.v@oV.v.......AZXzn..i=.:.a.....'...?'..a......=....Nl.....j..6N^Y....u..3ot#.....W..w.h.^.&."......%._...NA...3......3.-o...=t...x..}.A.lH....r...]i........g...b.M..`.%.$N...,.<..Z.....\a...Ih...os...].vW...!..:...S]...'"3..>...g.F...=.........-.O..dO...)KL....6.A.......I2.-...cd.[F...eh.m...~.T..s....... ..L..c.`cc........(b.H.. #.@lB1.;.R.....S..y...Xb..Em...%....m...P.C..p..RP.....%.!D.)....d....pM.PG$.#t..x...Z~.x/.?................].L.Z~c.'.#.yq.h...`E....<.;1G;D...o.NQt...k=+..V..Z..J.$........1.+G.J.H..v.NR........}......z6...h\...z.bC.-..?u......O......4....w...P.I..U...A....['........s.O.:..>1..-M#......a.9..d0P5@.n!$.%.&.m..3..0./....T+..).R:.s...<......?..1.....X...q.D.....hNE.S....@w.Z@.....d.G.....d6.>.?.......3w...i..........{[....d...D.Y.'._.....n....:.:.Lu@.(.C;ys...@S/D.;...^ .7B..gTa..m...,d...H...S.!..=..).\..k..j ...

Name	Malicious	Reputation
http://c.pki.goog/r/r4.crl	false	high
https://yxmo0vfcf8nxkwdfegsw.nzbjyd.es/jdh1239/?ref=xt9fmt@cfyv.com	false	unknown
https://abstrktion.co.za/deep/collabo.html	true	unknown

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 28, 2025 20:11:59.724445105 CEST	53	53337	1.1.1.1	192.168.2.4
Apr 28, 2025 20:11:59.725061893 CEST	53	53262	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:00.404791117 CEST	53	63106	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:00.581053972 CEST	53	60897	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:03.592293024 CEST	53083	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:03.592925072 CEST	59427	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:03.732707977 CEST	53	53083	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:03.737550020 CEST	53	59427	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:05.025114059 CEST	54976	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:05.025785923 CEST	58927	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:06.046811104 CEST	52149	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:06.047148943 CEST	49823	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:06.048573971 CEST	53	58927	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:06.048708916 CEST	53	54976	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:06.220571995 CEST	53	49823	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:06.229011059 CEST	53	52149	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:07.396385908 CEST	57431	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:07.396385908 CEST	60124	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:07.535948038 CEST	53	60832	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:07.574476957 CEST	53	60124	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:07.579257011 CEST	53	57431	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:08.239468098 CEST	57740	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:08.239625931 CEST	65348	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:08.309993029 CEST	53	59829	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:08.380269051 CEST	53	57740	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:08.392627001 CEST	53	65348	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:17.688477993 CEST	53	57701	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:24.975856066 CEST	62593	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:24.976089001 CEST	57312	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:25.147300959 CEST	53	57312	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:25.159367085 CEST	53	62593	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:27.012533903 CEST	59152	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:27.012696028 CEST	53881	53	192.168.2.4	1.1.1.1
Apr 28, 2025 20:12:27.152956009 CEST	53	59152	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:27.153474092 CEST	53	53881	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:36.642776966 CEST	53	51527	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:59.232161045 CEST	53	56722	1.1.1.1	192.168.2.4
Apr 28, 2025 20:12:59.642010927 CEST	53	54127	1.1.1.1	192.168.2.4
Apr 28, 2025 20:13:03.644848108 CEST	138	138	192.168.2.4	192.168.2.255

Timestamp	Bytes transferred	Direction	Data
Apr 28, 2025 20:12:09.693664074 CEST	200	OUT	GET /r/r4.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: / If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT User-Agent: Microsoft-CryptoAPI/10.0 Host: c.pki.goog
Apr 28, 2025 20:12:09.842674017 CEST	1243	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 530 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Mon, 28 Apr 2025 17:30:42 GMT Expires: Mon, 28 Apr 2025 18:20:42 GMT Cache-Control: public, max-age=3000 Age: 2487 Last-Modified: Thu, 03 Apr 2025 14:18:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Data Raw: 30 82 02 0e 30 82 01 93 02 01 01 30 0a 06 08 2a 86 48 ce 3d 04 03 03 30 47 31 0b 30 09 06 03 55 04 06 13 02 55 53 31 22 30 20 06 03 55 04 0a 13 19 47 6f 6f 67 6c 65 20 54 72 75 73 74 20 53 65 72 76 69 63 65 73 20 4c 4c 43 31 14 30 12 06 03 55 04 03 13 0b 47 54 53 20 52 6f 6f 74 20 52 34 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 17 0d 32 36 30 32 32 38 30 37 35 39 35 39 5a 30 81 e9 30 2f 02 10 6e 47 a9 ce 4f 46 c2 3d e2 49 ea cc 38 94 53 73 17 0d 31 39 30 39 33 30 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 f0 9c 5b 70 05 a6 dc 86 e2 f9 9e f3 17 0d 32 30 30 31 33 31 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 01 fe a5 81 44 7e 3b fd 3b b8 1c 24 98 17 0d 32 33 30 36 31 33 30 30 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 16 68 25 e1 70 04 40 61 24 91 f5 40 17 0d 32 35 30 34 30 33 30 38 30 30 30 30 5a 30 0c 30 0a 06 03 55 1d 15 04 03 0a 01 05 30 2c 02 0d 02 00 8e b2 58 e7 b5 94 0c 1f f9 00 44 17 0d 32 35 30 [TRUNCATED] Data Ascii: 000H=0G10UUS1"0 UGoogle Trust Services LLC10UGTS Root R4250403080000Z260228075959Z00/nGOF=I8Ss190930000000Z00U0,[p200131000000Z00U0,D~;;$230613000000Z00U0,h%p@a$@250403080000Z00U0,XD250403080000Z00U/0-0U0U#0LtI6>j0H=i0f1>2en:IN@g=;bQZ~`NX1?^4y[$\4{;$zDeU6O

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 28, 2025 20:12:04.053545952 CEST	142.250.69.4	443	192.168.2.4	49725	CN=www.google.com CN=WE2, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=WE2, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Mon Mar 31 10:56:27 CEST 2025 Wed Dec 13 10:00:00 CET 2023 Wed Nov 15 04:43:21 CET 2023	Mon Jun 23 10:56:26 CEST 2025 Tue Feb 20 15:00:00 CET 2029 Fri Jan 28 01:00:42 CET 2028	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,11-16-10-13-27-0-65281-18-35-5-23,29-23-24,0	0707d2d733a18ebcf46be3f940610dcb
					CN=WE2, O=Google Trust Services, C=US	CN=GTS Root R4, O=Google Trust Services LLC, C=US	Wed Dec 13 10:00:00 CET 2023	Tue Feb 20 15:00:00 CET 2029
					CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Nov 15 04:43:21 CET 2023	Fri Jan 28 01:00:42 CET 2028
Apr 28, 2025 20:12:05.261245966 CEST	184.29.183.29	443	192.168.2.4	49726	CN=fs.microsoft.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure ECC TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 07 00:01:04 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Mon Jun 02 00:01:04 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure ECC TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038
Apr 28, 2025 20:12:06.198616982 CEST	184.29.183.29	443	192.168.2.4	49727	CN=fs.microsoft.com, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure ECC TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=Microsoft Azure ECC TLS Issuing CA 04, O=Microsoft Corporation, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jun 07 00:01:04 CEST 2024 Thu Jun 08 02:00:00 CEST 2023 Thu Aug 01 14:00:00 CEST 2013	Mon Jun 02 00:01:04 CEST 2025 Wed Aug 26 01:59:59 CEST 2026 Fri Jan 15 13:00:00 CET 2038	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-16-23-65281,29-23-24,0	28a2c9bd18a11de089ef85a160da29e4
					CN=Microsoft Azure ECC TLS Issuing CA 04, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 08 02:00:00 CEST 2023	Wed Aug 26 01:59:59 CEST 2026
					CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Aug 01 14:00:00 CEST 2013	Fri Jan 15 13:00:00 CET 2038
Apr 28, 2025 20:12:06.923397064 CEST	102.219.84.139	443	192.168.2.4	49729	CN=*.abstrktion.co.za CN=R10, O=Let's Encrypt, C=US	CN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Mar 03 13:04:35 CET 2025 Wed Mar 13 01:00:00 CET 2024	Sun Jun 01 14:04:34 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,13-18-16-5-35-11-65281-27-0-23-10,29-23-24,0	1de7c82abc0ecc834017cfce1c4c5d21
Apr 28, 2025 20:12:06.923397064 CEST	102.219.84.139	443	192.168.2.4	49729	CN=R10, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		1de7c82abc0ecc834017cfce1c4c5d21
Apr 28, 2025 20:12:06.927087069 CEST	102.219.84.139	443	192.168.2.4	49728	CN=*.abstrktion.co.za CN=R10, O=Let's Encrypt, C=US	CN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Mar 03 13:04:35 CET 2025 Wed Mar 13 01:00:00 CET 2024	Sun Jun 01 14:04:34 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-35-0-65281-13-11-27-5-23-10-18,29-23-24,0	bcf5e803c08636f0dbd7b8fa7951010e
Apr 28, 2025 20:12:06.927087069 CEST	102.219.84.139	443	192.168.2.4	49728	CN=R10, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		bcf5e803c08636f0dbd7b8fa7951010e
Apr 28, 2025 20:12:07.033821106 CEST	102.219.84.139	443	192.168.2.4	49730	CN=*.abstrktion.co.za CN=R10, O=Let's Encrypt, C=US	CN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Mar 03 13:04:35 CET 2025 Wed Mar 13 01:00:00 CET 2024	Sun Jun 01 14:04:34 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,35-18-11-27-16-65281-23-5-10-0-13,29-23-24,0	7c34b91b8976c3684b89fc5f1f737b52
Apr 28, 2025 20:12:07.033821106 CEST	102.219.84.139	443	192.168.2.4	49730	CN=R10, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		7c34b91b8976c3684b89fc5f1f737b52
Apr 28, 2025 20:12:07.912059069 CEST	23.55.241.139	443	192.168.2.4	49736	CN=*.flaticon.com CN=E6, O=Let's Encrypt, C=US	CN=E6, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Apr 28 15:33:52 CEST 2025 Wed Mar 13 01:00:00 CET 2024	Sun Jul 27 15:33:51 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-13-16-35-10-11-27-65281-5-18-23,29-23-24,0	b9884492804301598ede5b4396bb70ac
Apr 28, 2025 20:12:07.912059069 CEST	23.55.241.139	443	192.168.2.4	49736	CN=E6, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		b9884492804301598ede5b4396bb70ac
Apr 28, 2025 20:12:07.983694077 CEST	23.55.241.139	443	192.168.2.4	49738	CN=*.flaticon.com CN=E6, O=Let's Encrypt, C=US	CN=E6, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Apr 28 15:33:52 CEST 2025 Wed Mar 13 01:00:00 CET 2024	Sun Jul 27 15:33:51 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-13-11-10-18-27-23-65281-0-35,29-23-24,0	b87e4014f5a45fac9d31456662bdd77e
Apr 28, 2025 20:12:07.983694077 CEST	23.55.241.139	443	192.168.2.4	49738	CN=E6, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		b87e4014f5a45fac9d31456662bdd77e
Apr 28, 2025 20:12:08.722311020 CEST	23.55.241.179	443	192.168.2.4	49741	CN=*.flaticon.com CN=E6, O=Let's Encrypt, C=US	CN=E6, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Apr 28 15:33:52 CEST 2025 Wed Mar 13 01:00:00 CET 2024	Sun Jul 27 15:33:51 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,5-35-16-10-27-65281-0-18-11-13-23,29-23-24,0	079db901942b65e47c4bf1087151340c
Apr 28, 2025 20:12:08.722311020 CEST	23.55.241.179	443	192.168.2.4	49741	CN=E6, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		079db901942b65e47c4bf1087151340c
Apr 28, 2025 20:12:08.839524031 CEST	23.55.241.179	443	192.168.2.4	49743	CN=*.flaticon.com CN=E6, O=Let's Encrypt, C=US	CN=E6, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Mon Apr 28 15:33:52 CEST 2025 Wed Mar 13 01:00:00 CET 2024	Sun Jul 27 15:33:51 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-5-16-23-11-13-65281-18-35-27-10,29-23-24,0	a4211741bca9b20afe5f51f8aad3db17
Apr 28, 2025 20:12:08.839524031 CEST	23.55.241.179	443	192.168.2.4	49743	CN=E6, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		a4211741bca9b20afe5f51f8aad3db17
Apr 28, 2025 20:12:25.510307074 CEST	104.21.112.1	443	192.168.2.4	49750	CN=nzbjyd.es CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sun Apr 13 01:13:33 CEST 2025 Wed Dec 13 10:00:00 CET 2023 Wed Nov 15 04:43:21 CET 2023	Sat Jul 12 02:12:18 CEST 2025 Tue Feb 20 15:00:00 CET 2029 Fri Jan 28 01:00:42 CET 2028	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-5-11-0-13-65281-27-23-10-35-18,29-23-24,0	a3959d1fdc0c66216900ee22dcb89490
					CN=WE1, O=Google Trust Services, C=US	CN=GTS Root R4, O=Google Trust Services LLC, C=US	Wed Dec 13 10:00:00 CET 2023	Tue Feb 20 15:00:00 CET 2029
					CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Nov 15 04:43:21 CET 2023	Fri Jan 28 01:00:42 CET 2028
Apr 28, 2025 20:12:25.510948896 CEST	104.21.112.1	443	192.168.2.4	49751	CN=nzbjyd.es CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sun Apr 13 01:13:33 CEST 2025 Wed Dec 13 10:00:00 CET 2023 Wed Nov 15 04:43:21 CET 2023	Sat Jul 12 02:12:18 CEST 2025 Tue Feb 20 15:00:00 CET 2029 Fri Jan 28 01:00:42 CET 2028	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,16-27-0-5-11-18-23-35-13-65281-10,29-23-24,0	63217edae18f9a97bd44cf9dafc05633
					CN=WE1, O=Google Trust Services, C=US	CN=GTS Root R4, O=Google Trust Services LLC, C=US	Wed Dec 13 10:00:00 CET 2023	Tue Feb 20 15:00:00 CET 2029
					CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Nov 15 04:43:21 CET 2023	Fri Jan 28 01:00:42 CET 2028
Apr 28, 2025 20:12:25.582763910 CEST	104.21.112.1	443	192.168.2.4	49752	CN=nzbjyd.es CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=WE1, O=Google Trust Services, C=US CN=GTS Root R4, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Sun Apr 13 01:13:33 CEST 2025 Wed Dec 13 10:00:00 CET 2023 Wed Nov 15 04:43:21 CET 2023	Sat Jul 12 02:12:18 CEST 2025 Tue Feb 20 15:00:00 CET 2029 Fri Jan 28 01:00:42 CET 2028	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,23-11-0-5-13-65281-35-16-18-10-27,29-23-24,0	350d97481528cc28b0fd531109d9af25
					CN=WE1, O=Google Trust Services, C=US	CN=GTS Root R4, O=Google Trust Services LLC, C=US	Wed Dec 13 10:00:00 CET 2023	Tue Feb 20 15:00:00 CET 2029
					CN=GTS Root R4, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Nov 15 04:43:21 CET 2023	Fri Jan 28 01:00:42 CET 2028
Apr 28, 2025 20:12:27.473828077 CEST	35.190.80.1	443	192.168.2.4	49753	CN=gcp.nel.cloudflare.com CN=R10, O=Let's Encrypt, C=US	CN=R10, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	Sun Apr 13 07:41:53 CEST 2025 Wed Mar 13 01:00:00 CET 2024	Sat Jul 12 07:41:52 CEST 2025 Sat Mar 13 00:59:59 CET 2027	771,49195-49199-49196-49200-52393-52392-49171-49172-156-157-47-53,0-27-23-16-18-35-10-13-5-11-65281,29-23-24,0	de1e2f4ba905719737380a1c8dd790cc
Apr 28, 2025 20:12:27.473828077 CEST	35.190.80.1	443	192.168.2.4	49753	CN=R10, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Wed Mar 13 01:00:00 CET 2024	Sat Mar 13 00:59:59 CET 2027		de1e2f4ba905719737380a1c8dd790cc

Target ID:	1
Start time:	14:11:54
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	14:11:58
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2480,i,12182408685030035214,10457824280967504998,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2512 /prefetch:3
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	10
Start time:	14:12:04
Start date:	28/04/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://abstrktion.co.za/deep/collabo.html"
Imagebase:	0x7ff786830000
File size:	3'388'000 bytes
MD5 hash:	E81F54E6C1129887AEA47E7D092680BF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://abstrktion.co.za/deep/collabo.html

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 54

Chrome Cache Entry: 55

Chrome Cache Entry: 56

Chrome Cache Entry: 57

Chrome Cache Entry: 58

Chrome Cache Entry: 59

Chrome Cache Entry: 60

Chrome Cache Entry: 61

Chrome Cache Entry: 63

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Connections

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: chrome.exePID: 568, Parent PID: 892

General

File Activities

File Opened

Windows Analysis Report
https://abstrktion.co.za/deep/collabo.html

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre