hxxp://dunafacility[.]partners/wp-includes/tannerbaum.php
XLS: app.any.run/tasks/ab9808d6…
DLL: app.any.run/tasks/4e4a8162…
Follow-up malware: app.any.run/tasks/d94c1428…
Paste: pastebin.com/s5iRrWRj
Pastebin raw: pastebin.com/raw/s5iRrWRj
Blog with #pcap and other data: malware-traffic-analysis.net/2020/07/16/ind…
If anyone knows what the follow-up malware is, let us all know. I don't recognize it.