========================================================================
  SENTINEL TRACK-BACK PLATFORM — FORENSIC EVIDENCE PACKAGE
========================================================================
Case ID          : SENTINEL-20260829-024859
Generated (UTC)  : 2026-08-29T02:48:59.662413+00:00
Collector        : SENTINEL Track-Back Platform (automated evidence collector)
Integrity SHA256 : cabd0d26f660c3f4eb88cbbd90a6ad9016a56b7b46fd0ebe2e73058006895dab
Forwarded to     : outbox/ (SIMULATED — in production: CISA / FBI IC3 via authenticated channel)

LEGAL NOTICE
------------------------------------------------------------------------
This package is PASSIVE defensive evidence gathered from decoy systems owned by the operator. No system belonging to any third party was accessed. Attribution fields are INDICATIVE ONLY. Pursuit and enforcement are performed solely by LAW ENFORCEMENT (CISA / FBI IC3), never by the platform operator.

CHAIN OF CUSTODY
------------------------------------------------------------------------
  [1] 2026-08-29T02:48:59.662421+00:00  SENTINEL Track-Back Platform (automated evidence collector)
       Collected honeypot events, track-back beacons, and simulated malware analysis from local evidence store.

EVIDENCE SUMMARY
------------------------------------------------------------------------
  Attacker interaction events : 40
  Track-back beacons fired    : 3
  Samples in microscope       : 9

ATTACKER INTERACTION EVENTS (decoy honeypot log)
------------------------------------------------------------------------
  #   1 2026-08-28T18:52:59.639259+00:00  198.51.100.23   POST  /admin/login  [login_attempt]
        credentials tried: 'administrator' / 'Passw0rd!'
  #   2 2026-08-28T15:27:59.639259+00:00  192.0.2.130     GET   /files  [file_access]
  #   3 2026-08-28T18:28:59.639259+00:00  203.0.113.88    POST  /admin/login  [login_attempt]
        credentials tried: 'sa' / 'sa'
  #   4 2026-08-28T15:40:59.639259+00:00  192.0.2.130     GET   /api/v1/keys  [probe]
  #   5 2026-08-29T00:20:59.639259+00:00  203.0.113.14    POST  /admin/login  [login_attempt]
        credentials tried: 'admin' / 'letmein'
  #   6 2026-08-28T22:13:59.639259+00:00  198.51.100.5    POST  /admin/login  [login_attempt]
        credentials tried: 'administrator' / 'Passw0rd!'
  #   7 2026-08-28T18:15:59.639259+00:00  192.0.2.130     GET   /.env  [probe]
  #   8 2026-08-28T20:42:59.639259+00:00  198.51.100.5    GET   /files  [file_access]
  #   9 2026-08-28T23:54:59.639259+00:00  192.0.2.44      POST  /admin/login  [login_attempt]
        credentials tried: 'admin' / 'admin'
  #  10 2026-08-29T00:21:59.639259+00:00  192.0.2.44      GET   /api/v1/keys  [probe]
  #  11 2026-08-29T00:59:59.639259+00:00  192.0.2.44      POST  /admin/login  [login_attempt]
        credentials tried: 'backup' / 'backup2024'
  #  12 2026-08-28T22:02:59.639259+00:00  203.0.113.14    GET   /files  [file_access]
  #  13 2026-08-28T15:00:59.639259+00:00  203.0.113.88    GET   /files  [file_access]
  #  14 2026-08-28T15:51:59.639259+00:00  198.51.100.23   POST  /admin/login  [login_attempt]
        credentials tried: 'sa' / 'sa'
  #  15 2026-08-29T01:35:59.639259+00:00  198.51.100.77   GET   /.git/config  [probe]
  #  16 2026-08-29T02:33:59.639259+00:00  203.0.113.88    POST  /admin/login  [login_attempt]
        credentials tried: 'sa' / 'sa'
  #  17 2026-08-28T20:16:59.639259+00:00  203.0.113.14    GET   /  [visit]
  #  18 2026-08-28T22:50:59.639259+00:00  203.0.113.201   GET   /api/v1/keys  [probe]
  #  19 2026-08-28T18:09:59.639259+00:00  203.0.113.201   GET   /files  [probe]
  #  20 2026-08-28T20:11:59.639259+00:00  198.51.100.77   GET   /files  [file_access]
  #  21 2026-08-28T15:58:59.639259+00:00  198.51.100.23   POST  /admin/login  [login_attempt]
        credentials tried: 'admin' / '12345678'
  #  22 2026-08-28T21:57:59.639259+00:00  198.51.100.23   GET   /files  [file_access]
  #  23 2026-08-28T23:50:59.639259+00:00  192.0.2.130     GET   /admin  [probe]
  #  24 2026-08-28T14:48:59.639259+00:00  198.51.100.5    POST  /admin/login  [login_attempt]
        credentials tried: 'sa' / 'sa'
  #  25 2026-08-28T18:35:59.639259+00:00  192.0.2.44      POST  /admin/login  [login_attempt]
        credentials tried: 'administrator' / 'Passw0rd!'
  #  26 2026-08-29T02:41:59.639259+00:00  203.0.113.201   POST  /admin/login  [login_attempt]
        credentials tried: 'sa' / 'sa'
  #  27 2026-08-28T18:14:59.639259+00:00  198.51.100.23   GET   /api/v1/keys  [probe]
  #  28 2026-08-28T17:13:59.639259+00:00  198.51.100.77   GET   /phpmyadmin  [probe]
  #  29 2026-08-28T23:11:59.639259+00:00  198.51.100.5    POST  /admin/login  [login_attempt]
        credentials tried: 'sa' / 'sa'
  #  30 2026-08-28T19:46:59.639259+00:00  192.0.2.130     POST  /admin/login  [login_attempt]
        credentials tried: 'root' / 'toor'
  #  31 2026-08-28T23:51:59.639259+00:00  203.0.113.88    GET   /files  [file_access]
  #  32 2026-08-28T16:47:59.639259+00:00  203.0.113.201   POST  /admin/login  [login_attempt]
        credentials tried: 'administrator' / 'Passw0rd!'
  #  33 2026-08-28T20:32:59.639259+00:00  198.51.100.23   GET   /files  [file_access]
  #  34 2026-08-28T16:41:59.639259+00:00  192.0.2.130     POST  /admin/login  [login_attempt]
        credentials tried: 'backup' / 'backup2024'
  #  35 2026-08-28T21:52:59.639259+00:00  203.0.113.88    POST  /admin/login  [login_attempt]
        credentials tried: 'root' / 'toor'
  #  36 2026-08-28T18:28:59.639259+00:00  198.51.100.23   GET   /files  [file_access]
  #  37 2026-08-28T16:41:59.639259+00:00  198.51.100.23   GET   /  [visit]
  #  38 2026-08-28T17:30:59.639259+00:00  203.0.113.14    POST  /admin/login  [login_attempt]
        credentials tried: 'root' / 'toor'
  #  39 2026-08-28T14:48:59.639259+00:00  203.0.113.88    POST  /admin/login  [login_attempt]
        credentials tried: 'admin' / '12345678'
  #  40 2026-08-28T23:47:59.639259+00:00  198.51.100.23   POST  /admin/login  [login_attempt]
        credentials tried: 'admin' / 'letmein'

TRACK-BACK BEACONS (bait opened on attacker's own machine)
------------------------------------------------------------------------
  #   1 2026-08-29T00:12:59.642860+00:00  token=sntl-78e61f0726654175  bait=passwords.xlsx  reporting_ip=192.0.2.44
  #   2 2026-08-29T01:10:59.642860+00:00  token=sntl-b053b9a6b3544d0e  bait=customer_db_backup.sql  reporting_ip=192.0.2.44
  #   3 2026-08-29T00:25:59.642860+00:00  token=sntl-e90ac3580f2349ca  bait=network_diagram.pdf  reporting_ip=198.51.100.5

MALWARE MICROSCOPE — SIMULATED ANALYSIS
------------------------------------------------------------------------
  #   1 invoice_2026.doc.bin  [Malicious score=100 Trojan.Generic.Sim]
        sha256: 7686432facfe8ad003be5c72d383f64b9bc6c1482044f272563fe86e715ec4a7
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): Toolmarks resemble a commodity crimeware kit (widely resold).
  #   2 update.js  [Malicious score=75 Trojan.Generic.Sim]
        sha256: 229d6e9abb1a1fd03bbfeb9191647ce2de49fafc2915b1b6b1a7be208b2e11c2
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): String artifacts suggest an automated/off-the-shelf builder.
  #   3 readme.txt  [Benign score=0 None]
        sha256: be5dd501d045c445c2481229314f081ed916fba22e0bfd17795f9fd9540cfb28
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): Locale/keyboard artifacts inconclusive; multiple regions plausible.
  #   4 cryptolocker_sim.bin  [Malicious score=90 Trojan.Generic.Sim]
        sha256: 96522d00e63c347a0102d3598eccb7c8c3bbc2de0643d443d91429df95f1c77f
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): Reused infrastructure pattern seen in prior opportunistic campaigns.
  #   5 photo.jpg  [Benign score=0 None]
        sha256: d0ea6574f395ef77c21fabd3b0f1aa82df8f67b89fba32bda306f7e2ce6ddde9
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): String artifacts suggest an automated/off-the-shelf builder.
  #   6 invoice_2026.doc.bin  [Malicious score=100 Trojan.Generic.Sim]
        sha256: 7686432facfe8ad003be5c72d383f64b9bc6c1482044f272563fe86e715ec4a7
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): Toolmarks resemble a commodity crimeware kit (widely resold).
  #   7 update.js  [Malicious score=75 Trojan.Generic.Sim]
        sha256: 229d6e9abb1a1fd03bbfeb9191647ce2de49fafc2915b1b6b1a7be208b2e11c2
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): String artifacts suggest an automated/off-the-shelf builder.
  #   8 readme.txt  [Benign score=0 None]
        sha256: be5dd501d045c445c2481229314f081ed916fba22e0bfd17795f9fd9540cfb28
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): Locale/keyboard artifacts inconclusive; multiple regions plausible.
  #   9 cryptolocker_sim.bin  [Malicious score=90 Trojan.Generic.Sim]
        sha256: 96522d00e63c347a0102d3598eccb7c8c3bbc2de0643d443d91429df95f1c77f
        INDICATIVE ONLY (for law-enforcement follow-up, NOT proof): Reused infrastructure pattern seen in prior opportunistic campaigns.

========================================================================
END OF PACKAGE — pursuit/enforcement is performed by LAW ENFORCEMENT.
========================================================================
