Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

5a17eb22c9...c0.exe

windows7-x64

10

5a17eb22c9...c0.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/01/2024, 02:56 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    5a17eb22c96dfbefb792493dac7618c0.exe

  • Size

    6.7MB

  • MD5

    5a17eb22c96dfbefb792493dac7618c0

  • SHA1

    178b7b1b0894ad100992f75b9529ae00d63a633c

  • SHA256

    deb121bac1823d2de090b6816cbaffe8739600299b69789c109ac97a9477d5aa

  • SHA512

    0c9d63c1f321df671e35463e9ad62b4ed1e6a6c2cb2cbc58cc652fde48bbde7f06a9325fc21f3c4c90c2aff62b402af75886962698781a885998932da164a297

  • SSDEEP

    196608:Dt29v7XLTPmNbF6n1O4zGuY7gdDoqH9s7uHFsDKEz:yXwF6FSuMgFoy9s7uHFGR

Score
10/10
babadedadarkvnccrypterdiscoveryloaderrat

Malware Config

Signatures

  • Babadeda

    Babadeda is a crypter delivered as a legitimate installer and used to drop other malware families.

    loadercrypterbabadeda
  • Babadeda Crypter 1 IoCs
  • DarkVNC

    DarkVNC is a malicious version of the famous VNC software.

    ratdarkvnc
  • DarkVNC payload 8 IoCs
    rat
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5a17eb22c96dfbefb792493dac7618c0.exe
    "C:\Users\Admin\AppData\Local\Temp\5a17eb22c96dfbefb792493dac7618c0.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4204
    • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\smart-reports.exe
      "C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\smart-reports.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe
        3⤵
          PID:4700
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 552
          3⤵
          • Program crash
          PID:1512
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4572 -ip 4572
      1⤵
        PID:804

      Network

      • flag-us
        DNS
        21.53.126.40.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        21.53.126.40.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        95.221.229.192.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        95.221.229.192.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        208.194.73.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        208.194.73.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        9.228.82.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        9.228.82.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        209.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        209.178.17.96.in-addr.arpa
        IN PTR
        Response
        209.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-209deploystaticakamaitechnologiescom
      • flag-us
        DNS
        180.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        180.178.17.96.in-addr.arpa
        IN PTR
        Response
        180.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-180deploystaticakamaitechnologiescom
      • flag-us
        DNS
        180.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        180.178.17.96.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        88.156.103.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        88.156.103.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        41.110.16.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        41.110.16.96.in-addr.arpa
        IN PTR
        Response
        41.110.16.96.in-addr.arpa
        IN PTR
        a96-16-110-41deploystaticakamaitechnologiescom
      • flag-us
        DNS
        59.128.231.4.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        59.128.231.4.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        50.23.12.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        50.23.12.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        18.31.95.13.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        18.31.95.13.in-addr.arpa
        IN PTR
      • flag-us
        DNS
        0.205.248.87.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        0.205.248.87.in-addr.arpa
        IN PTR
        Response
        0.205.248.87.in-addr.arpa
        IN PTR
        https-87-248-205-0lgwllnwnet
      • flag-us
        DNS
        tse1.mm.bing.net
        Remote address:
        8.8.8.8:53
        Request
        tse1.mm.bing.net
        IN A
        Response
        tse1.mm.bing.net
        IN CNAME
        mm-mm.bing.net.trafficmanager.net
        mm-mm.bing.net.trafficmanager.net
        IN CNAME
        dual-a-0001.a-msedge.net
        dual-a-0001.a-msedge.net
        IN A
        204.79.197.200
        dual-a-0001.a-msedge.net
        IN A
        13.107.21.200
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301655_1DZQZV6Z7ZOAU893W&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301655_1DZQZV6Z7ZOAU893W&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 394519
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: E405A9553B754E749DDA6C2E633D8C69 Ref B: LON04EDGE0619 Ref C: 2024-01-14T02:56:59Z
        date: Sun, 14 Jan 2024 02:56:59 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 628594
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 87E75FD393404262819FA238DE981288 Ref B: LON04EDGE0619 Ref C: 2024-01-14T02:56:59Z
        date: Sun, 14 Jan 2024 02:56:59 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301504_19NAUZ2WGU7U78P7T&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301504_19NAUZ2WGU7U78P7T&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 605112
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 65BAD3D841A34E9E80BFB196F7AFAAAA Ref B: LON04EDGE0619 Ref C: 2024-01-14T02:56:59Z
        date: Sun, 14 Jan 2024 02:56:59 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317300925_1WNJI31X17K21EZ5K&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317300925_1WNJI31X17K21EZ5K&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 327646
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: D31A207AE6784242A5C7BFF7C70A73B8 Ref B: LON04EDGE0619 Ref C: 2024-01-14T02:56:59Z
        date: Sun, 14 Jan 2024 02:56:59 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301071_1DQ5OX7SYTK2NY123&pid=21.2&w=1920&h=1080&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301071_1DQ5OX7SYTK2NY123&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 417214
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: BD284EB6DC1B4F9C903B60230B6AA749 Ref B: LON04EDGE0619 Ref C: 2024-01-14T02:56:59Z
        date: Sun, 14 Jan 2024 02:56:59 GMT
      • flag-us
        GET
        https://tse1.mm.bing.net/th?id=OADD2.10239317301358_1ZPBGXJ99CUBJXGTN&pid=21.2&w=1080&h=1920&c=4
        Remote address:
        204.79.197.200:443
        Request
        GET /th?id=OADD2.10239317301358_1ZPBGXJ99CUBJXGTN&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
        host: tse1.mm.bing.net
        accept: */*
        accept-encoding: gzip, deflate, br
        user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
        Response
        HTTP/2.0 200
        cache-control: public, max-age=2592000
        content-length: 323910
        content-type: image/jpeg
        x-cache: TCP_HIT
        access-control-allow-origin: *
        access-control-allow-headers: *
        access-control-allow-methods: GET, POST, OPTIONS
        timing-allow-origin: *
        report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
        nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
        accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
        x-msedge-ref: Ref A: 8A149FCD64834C95BE6878BA78874DEB Ref B: LON04EDGE0619 Ref C: 2024-01-14T02:57:00Z
        date: Sun, 14 Jan 2024 02:56:59 GMT
      • flag-us
        DNS
        200.197.79.204.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        200.197.79.204.in-addr.arpa
        IN PTR
        Response
        200.197.79.204.in-addr.arpa
        IN PTR
        a-0001a-msedgenet
      • flag-us
        DNS
        177.178.17.96.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        177.178.17.96.in-addr.arpa
        IN PTR
        Response
        177.178.17.96.in-addr.arpa
        IN PTR
        a96-17-178-177deploystaticakamaitechnologiescom
      • flag-us
        DNS
        30.243.111.52.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        30.243.111.52.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        85.65.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        85.65.42.20.in-addr.arpa
        IN PTR
        Response
      • flag-us
        DNS
        85.65.42.20.in-addr.arpa
        Remote address:
        8.8.8.8:53
        Request
        85.65.42.20.in-addr.arpa
        IN PTR
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.3kB
         10.1kB
         18
        15
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.3kB
         8.7kB
         17
        14
      • 204.79.197.200:443
        https://tse1.mm.bing.net/th?id=OADD2.10239317301358_1ZPBGXJ99CUBJXGTN&pid=21.2&w=1080&h=1920&c=4
        tls, http2
        101.0kB
         2.8MB
         2036
        2030

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301655_1DZQZV6Z7ZOAU893W&pid=21.2&w=1080&h=1920&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301246_1WJH3TXXVOGBRWUGS&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301504_19NAUZ2WGU7U78P7T&pid=21.2&w=1080&h=1920&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317300925_1WNJI31X17K21EZ5K&pid=21.2&w=1920&h=1080&c=4

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301071_1DQ5OX7SYTK2NY123&pid=21.2&w=1920&h=1080&c=4

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Response

        200

        HTTP Request

        GET https://tse1.mm.bing.net/th?id=OADD2.10239317301358_1ZPBGXJ99CUBJXGTN&pid=21.2&w=1080&h=1920&c=4

        HTTP Response

        200
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.3kB
         8.7kB
         17
        14
      • 204.79.197.200:443
        tse1.mm.bing.net
        tls, http2
        1.3kB
         8.7kB
         17
        14
      • 45.147.229.254:443
        WerFault.exe
        260 B
         5
      • 45.147.229.254:443
        WerFault.exe
        260 B
         5
      • 45.147.229.254:443
        WerFault.exe
        260 B
         5
      • 45.147.229.254:443
        WerFault.exe
        260 B
         5
      • 45.147.229.254:443
        WerFault.exe
        208 B
         4
      • 45.147.229.254:443
        WerFault.exe
        208 B
         4
      • 8.8.8.8:53
        21.53.126.40.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        21.53.126.40.in-addr.arpa

      • 8.8.8.8:53
        95.221.229.192.in-addr.arpa
        dns
        73 B
         144 B
         1
        1

        DNS Request

        95.221.229.192.in-addr.arpa

      • 8.8.8.8:53
        208.194.73.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        208.194.73.20.in-addr.arpa

      • 8.8.8.8:53
        9.228.82.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        9.228.82.20.in-addr.arpa

      • 8.8.8.8:53
        209.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        209.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        180.178.17.96.in-addr.arpa
        dns
        144 B
         137 B
         2
        1

        DNS Request

        180.178.17.96.in-addr.arpa

        DNS Request

        180.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        88.156.103.20.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        88.156.103.20.in-addr.arpa

      • 8.8.8.8:53
        41.110.16.96.in-addr.arpa
        dns
        71 B
         135 B
         1
        1

        DNS Request

        41.110.16.96.in-addr.arpa

      • 8.8.8.8:53
        59.128.231.4.in-addr.arpa
        dns
        71 B
         157 B
         1
        1

        DNS Request

        59.128.231.4.in-addr.arpa

      • 8.8.8.8:53
        50.23.12.20.in-addr.arpa
        dns
        70 B
         156 B
         1
        1

        DNS Request

        50.23.12.20.in-addr.arpa

      • 8.8.8.8:53
        18.31.95.13.in-addr.arpa
        dns
        140 B
         144 B
         2
        1

        DNS Request

        18.31.95.13.in-addr.arpa

        DNS Request

        18.31.95.13.in-addr.arpa

      • 8.8.8.8:53
        0.205.248.87.in-addr.arpa
        dns
        71 B
         116 B
         1
        1

        DNS Request

        0.205.248.87.in-addr.arpa

      • 8.8.8.8:53
        tse1.mm.bing.net
        dns
        62 B
         173 B
         1
        1

        DNS Request

        tse1.mm.bing.net

        DNS Response

        204.79.197.200
        13.107.21.200

      • 8.8.8.8:53
        200.197.79.204.in-addr.arpa
        dns
        73 B
         106 B
         1
        1

        DNS Request

        200.197.79.204.in-addr.arpa

      • 8.8.8.8:53
        177.178.17.96.in-addr.arpa
        dns
        72 B
         137 B
         1
        1

        DNS Request

        177.178.17.96.in-addr.arpa

      • 8.8.8.8:53
        30.243.111.52.in-addr.arpa
        dns
        72 B
         158 B
         1
        1

        DNS Request

        30.243.111.52.in-addr.arpa

      • 8.8.8.8:53
        85.65.42.20.in-addr.arpa
        dns
        140 B
         156 B
         2
        1

        DNS Request

        85.65.42.20.in-addr.arpa

        DNS Request

        85.65.42.20.in-addr.arpa

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\base.xml
        Filesize

        153KB

        MD5

        e5ec46902cefd0660100572c6579d99e

        SHA1

        32f8085a1f929915ef2d5499986aa78a9714aab8

        SHA256

        c4dcc2efea6830ff42324c0036fd42ff63570c2ac5ef1eb165b1f6e8d9b7f6f7

        SHA512

        f5e3bd515a963e9994ec073f680e598e32b67effcf02c7b0dd105d3e1118b92bfc8a911329205a89a9e3d28b16d774305344e360724423ef62e04fbd290e1022

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\gtk-2.0\gtkrc.default
        Filesize

        79B

        MD5

        ddd31f8fc20ab0835c1e135f80d6db51

        SHA1

        2d598c52c17bbf076ee4c3b9e58e4fff6144ab6d

        SHA256

        fb749ac4812ba307bbb4c1e0b30175a88668fcb2eed702f780bd7da5987f9004

        SHA512

        d514da7b2f68096cd6bd258d28ac5948a594c9cca4cd9ff79364b50c85641f2e11befaf81508e42841373459647cbe7e7e7f9daa675bcdf4c93ea85dea0c1a42

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\libftype-5.dll
        Filesize

        620KB

        MD5

        922cbda9db03264d92b763a1f56d3513

        SHA1

        28361496a5c0a5bcef95e3eba252a2a751cef011

        SHA256

        38c08cd6ab92f1ec985772028c4c86b2ed23446be256f18720c65036f8f18965

        SHA512

        8718358ac42c2959653b610580a63e4bf2cd97f0798ebb82f5238fefd7e683d0a17ea4c6c4103ee5610107745dfbf34717fbb8482c363d2d4aaed619b112189e

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\libftype-5.dll
        Filesize

        489KB

        MD5

        064fd0c14fcdc05fd21b8865897c61f0

        SHA1

        5351a1247c3a4c2736f948300116330cdc0e9071

        SHA256

        4cdd4644908bc246a337e6a2d7456cd785864ba8d67d948eb3f1706d06955889

        SHA512

        e7c564cdd21b48722cecf7a9448aa305697c18b024e3d38a9d822cab9a9d3b6463d8a7bfdf80a70a0e9c757126725693d3738b09a365c3cf98c770698aaf2bef

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\res\public\en\html\startpage_banner.html
        Filesize

        490B

        MD5

        5d1f7da1c3d95020a0708118145364d0

        SHA1

        02f630e7ac8b8d400af219bd8811aa3a22f7186e

        SHA256

        d2d828c2c459b72ee378db6c5ac295315b8a783b7049032f92ed4fcb2a89684a

        SHA512

        6bbdaaef1478ffd9e9d3a95d300f35b9ac6f3ce6564e80734445a827ad8761233db36c679fac117f363bae27918983520f0e2f408205d3549b001fc4ae4c920c

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\res\public\en\html\startpage_connect_to_data_no_mru.html
        Filesize

        1KB

        MD5

        20bbd307866f19a5af3ae9ebd5104018

        SHA1

        8e03c9b18b9d27e9292ee154b773553493df1157

        SHA256

        e4fe51c170e02a01f30a4db8b458fb9b8dee13a7740f17765ba4873fac62c5f7

        SHA512

        420a132ad4ba3a67f5b66a3e463c4fa495b7941d58d6d669a8c984380607a03f0afa1c92bcf1f8d1fc5d93838ea611f7f9cf439bb3ada0142431b119ddfad40d

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\res\public\en\html\startpage_connect_to_data_with_mru.html
        Filesize

        1KB

        MD5

        e6bc0d078616dd5d5f72d46ab2216e89

        SHA1

        f70534bb999bcb8f1db0cf25a7279757e794499f

        SHA256

        e8f50f17c994f394239350951a40c3454e9b52b0ca95cf342f2577828f390a54

        SHA512

        6ccd6e19ec63f20c86a28ccaffa609a2d0de7991a8eb2d6ea016bcc5d0e9f2fc28c33a15c4af891f28a9e1e4131f38f84f8e1a8859e020d6f267977075f7c66a

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\res\public\en\html\startpage_landing.html
        Filesize

        720B

        MD5

        0a5b47256c14570b80ef77ecfd2129b7

        SHA1

        69210a7429c991909c70b6b6b75fe4bc606048ae

        SHA256

        1934657d800997dedba9f4753150f7d8f96dd5903a9c47ed6885aabf563bf73d

        SHA512

        5ca22260d26ec5bb1d65c4af3e2f05356d7b144836790ac656bf8c1687dd5c7d67a8a46c7bde374ec9e59a1bedc0298a4609f229d997409a0cc5453ef102ecb2

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\res\public\en\html\startpage_topstrip_no_mru.html
        Filesize

        659B

        MD5

        eced86c9d5b8952ac5fb817c3ce2b8ba

        SHA1

        3ca24e69df7a4b81f799527a97282799fcd3f1e2

        SHA256

        3988afa43d3c716ecbe4e261ff13c32fe67baaaf1718eac790040cff2aa4e44d

        SHA512

        a21e88968c30f14363a73dfd7801cea34255acb968160fad59d813bb64352583c8c4f6cd9d45811676ca5ca90a4250601a53e80b6f41d6727465f3a57e7423a1

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\res\public\en\html\startpage_topstrip_with_mru.html
        Filesize

        798B

        MD5

        cc4d8a787ab1950c4e3aac5751c9fcde

        SHA1

        d026a156723a52c34927b5a951a2bb7d23aa2c45

        SHA256

        13683e06e737e83ca94505b1cd1cd70f4f8b2cc5e7560f121a6e02ed1a06e7ee

        SHA512

        e0b01f5ee4da60e35a4eb94490bed815aea00382f3b9822b7c29294cf86a2fe480dba704f086a38f9d7aaf39e8160f49cf806b6b6c44651de56e290249dd9ebe

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\res\public\en\stylesheets\start_page.css
        Filesize

        2KB

        MD5

        f2ab3e5fb61293ae8656413dbb6e5dc3

        SHA1

        53b3c3c4b57c3d5e2d9a36272b27786cd60f0eb5

        SHA256

        06db4d53adf4a1ecbc03ed9962af7f46fd3a54668d45907dc1737125e38ec192

        SHA512

        2c31cad868e1e5149a4308a149104ac3d88907894699fb0413860c8f578de32f6814b08d518de7a7fe3782f0cea173cb1766da7c25f2bcdddaffae7bc0da927c

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\res\public\en\stylesheets\start_page_landing.css
        Filesize

        282B

        MD5

        49617add7303a8fbd24e1ad16ba715d8

        SHA1

        31772218ccf51fe5955625346c12e00c0f2e539a

        SHA256

        b3a99eea19c469dab3b727d1324ed87d10999133d3268ed0fadd5a5c8d182907

        SHA512

        9d1198ca13a0c1f745b01aabc23b60b8e0df4f12d7fdf17e87e750f021fc3800ea808af6c875848b3850061070dfd54c2e34d92cea4e8a2bf4736fbcfd129d1e

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\smart-reports.exe
        Filesize

        2.9MB

        MD5

        91d96e9aad9f40a8758ed4300695dc53

        SHA1

        50ddf7f958766e134bd9f90a0b3c4daec71aa5b9

        SHA256

        d7e250b8cbfdf16407a12bd77640bb67db698eca2015d03f02de756e5e8d8bc7

        SHA512

        bcac09bd834de8036ff6c51ebc2f5050e1aa5167a5765fb2f40ef47faac64028ccc97e09456b91b64b50a4f80569992f227cb6e98eaecfaf2c37cbf3643c6bb0

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\smart-reports.exe
        Filesize

        569KB

        MD5

        6f1a77632d71176e5861409d6c734a7e

        SHA1

        955ccd6f4958aae88c269ef86bc8bf7f4592bf8a

        SHA256

        04dd04b396efaadfd0fba5c07087b131622488d5db4fcbeb2c4c1428d1344afe

        SHA512

        d7752fccb762ffab622b6f0ded15b344e9c382cbc2fb2c9058ddf356f9e758436e728a41e4131f982ee10b0e1d3e060a7a74f13cfab21e7ab9dd83bdd11053a1

        Download Submit

      • C:\Users\Admin\AppData\Roaming\SAP BusinessObjects\SBOP Crystal Reports\smart-reports.exe
        Filesize

        269KB

        MD5

        d80eb5893062c5dc7a733643e41265f8

        SHA1

        7700adf6d7f8a4c51b72eed49f2a7361c66b600d

        SHA256

        4da2d6e573a6694bcdd9dd830a13f0afa88781448920ba1702291591868450a4

        SHA512

        2fef0f8c5fa7666003fd23fca5628637258a52eabcf82a829ad8325ad14a662d4dea680a2cdb4725664f57ebb14cde06b54779c4f2bff9131d742717109bc266

        Download Submit

      • memory/4204-500-0x0000000000400000-0x000000000045B000-memory.dmp

        Filesize

        364KB

        Download

      • memory/4572-504-0x0000000000DC0000-0x00000000015F6000-memory.dmp

        Filesize

        8.2MB

        Download

      • memory/4572-517-0x0000000000DC0000-0x00000000015F6000-memory.dmp

        Filesize

        8.2MB

        Download

      • memory/4700-509-0x000001F7DFD10000-0x000001F7DFDDA000-memory.dmp

        Filesize

        808KB

        Download

      • memory/4700-508-0x000001F7DFD10000-0x000001F7DFDDA000-memory.dmp

        Filesize

        808KB

        Download

      • memory/4700-513-0x000001F7DFD10000-0x000001F7DFDDA000-memory.dmp

        Filesize

        808KB

        Download

      • memory/4700-516-0x000001F7DFD10000-0x000001F7DFDDA000-memory.dmp

        Filesize

        808KB

        Download

      • memory/4700-515-0x000001F7DFD10000-0x000001F7DFDDA000-memory.dmp

        Filesize

        808KB

        Download

      • memory/4700-514-0x000001F7DFD10000-0x000001F7DFDDA000-memory.dmp

        Filesize

        808KB

        Download

      • memory/4700-507-0x000001F7DFBF0000-0x000001F7DFBF1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/4700-518-0x000001F7DFD10000-0x000001F7DFDDA000-memory.dmp

        Filesize

        808KB

        Download

      We care about your privacy.

      This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.