ZEKASTRA case pack VP-04 - acquisition log - SYNTHETIC TRAINING DATA
Matter: report of a possibly harvested sign-in on 7 April 2026 at Linden Print Works Ltd. (synthetic)
Item 1: raw message as stored in the recipient mailbox, saved as phishing-message.eml. Headers and body only.
Item 2: web proxy access log for the four-hour window in export-metadata.txt, saved as proxy-log.csv. The export stopped at its row limit.
Item 3: DNS resolver query log, saved as dns-log.csv.
Item 4: DHCP lease export, saved as dhcp-leases.csv.
Item 5: parameters of the three exports, saved as export-metadata.txt.
Collected by: IT administrator (role only), on the day of the report. The examiner received the copies the same day.
Clock: examiner's workstation, UTC+3. Collection time: 2026-04-07 16:20:00 +03:00.
Handling: the files were copied and were not opened in a mail client or a spreadsheet application that rewrites them. SHA-256 values below were recorded at collection, before examination.

SHA-256 at collection
b29e3081fe4e7dd20af6c50c426a63c93e9e55c3da61462bd5ca1dc812f6314c  export-metadata.txt
62caf83755da2b265f12bbbe91a3c2a946bb7b00b51c93c477a8332e8cf6d9a4  phishing-message.eml
d5bcf623f6b7a1ee79b0af3c3e9f57e1e708b013425ca19a83979072249356b1  proxy-log.csv
e5ca437fcb75b94b2389426acf8b9272e06b132fd04b41a63b95c1e622bfe70b  dns-log.csv
c0874d5904fed5e26045887ad63b97cbb1cd8315658ecd9929cf356fc19f7e6c  dhcp-leases.csv