Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
12-10-2024 23:04
Static task
static1
Behavioral task
behavioral1
Sample
Bewerbung-Lena-Kretschmer.exe
Resource
win7-20241010-en
General
-
Target
Bewerbung-Lena-Kretschmer.exe
-
Size
908KB
-
MD5
36ccd442755d482900b57188ae3a89a7
-
SHA1
8cd96603cdd2637cf5469aba8ed2b149c35ef699
-
SHA256
41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c
-
SHA512
0fcfc29a042342ccbf2529ac116e79698314778459d9dad2ca947b3eab2a7dec3d3622ce351b95909f88791c6d57a9943174ee352f13db246c706c9df1f57e9a
-
SSDEEP
24576:jRi7/DwOpfmVEyMrUnla/PJJF3NagKGPHpZkxCcI1rC1yOh:NiXJpfmVEXgnlKj9aMICcorC1yOh
Malware Config
Signatures
-
Renames multiple (154) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 20 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\en-US\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\uk-UA\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\it-IT\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\ja-JP\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\uk-UA\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\de-DE\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\en-US\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\es-ES\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\es-ES\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\fr-FR\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation Bewerbung-Lena-Kretschmer.exe -
Drops startup file 2 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File opened (read-only) \??\E: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\M: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\R: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\T: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\X: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\H: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\I: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\J: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\U: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\Z: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\P: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\Q: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\S: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\B: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\K: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\L: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\N: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\O: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\A: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\G: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\V: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\W: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\Y: Bewerbung-Lena-Kretschmer.exe -
Drops file in System32 directory 64 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\prnms006.inf_amd64_c3bdcb6fc975b614\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic_guestinterface.inf_amd64_192114845ec44b66\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\it-IT\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Dism\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\es-ES\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mbtr8897w81x64.inf_amd64_0d8225e7d2696ece\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\scmvolume.inf_amd64_6957cfb7d6fea5c7\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0003\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\000b\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\Com\ja-JP\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\volsnap.inf_amd64_ce438b6e0c5b1af2\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_EnvironmentResource\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmusrsp.inf_amd64_4c83ce3a06d0048e\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AssignedAccess\uk-UA\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\Configuration\Registration\MSFT_FileDirectoryConfiguration\de-DE\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmgid.inf_amd64_3a0240393de08f95\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\Licenses\neutral\_Default\Professional\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\c_diskdrive.inf_amd64_1debcd2bd95e9c0c\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Management\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\Tasks\Microsoft\Windows\RemoteApp and Desktop Connections Update\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmaiwa4.inf_amd64_b74e18ebf47de72a\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\uk-UA\Licenses\OEM\Professional\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\wbem\tmf\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\fr\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_WaitForAll\fr-FR\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\DiagSvcs\ja-JP\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\c_cashdrawer.inf_amd64_a648ee708660440c\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\netwmbclass.inf_amd64_dba6eeaf0544a4e0\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\SMI\Store\Machine\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\MsDtc\es\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\VpnClient\es-ES\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WCN\fr-FR\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_UserResource\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\c_floppydisk.inf_amd64_bc7bd9dca28933ec\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmega.inf_amd64_f35131186d3026aa\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\001a\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnttp.inf_amd64_527c415254a7e378\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\ykinx64.inf_amd64_0bbd8466b526ef26\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\de-DE\Licenses\OEM\Professional\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\slmgr\0411\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\audioendpoint.inf_amd64_4fc4a632c1490033\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\c_fsencryption.inf_amd64_b4b4845819a23338\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcpv.inf_amd64_906547002cc7c58e\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_19eb30e94285f2a6\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\Com\es-ES\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\ConfigCI\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\Bthprops\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.ODataUtils\ja-JP\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCClassResources\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\Speech_OneCore\Engines\TTS\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\wbem\Logs\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\it\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\ServiceSet\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\c_firmware.inf_amd64_36e4e17f210128ab\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms007.inf_amd64_8bbf44975c626ac5\Amd64\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\CimCmdlets\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\GroupPolicyUsers\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\config\RegBack\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms014.inf_amd64_faec3fc366f8e1fa\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription pid process target process PID 2276 set thread context of 3552 2276 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\tr-tr\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fi-fi\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\tool\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themes\dark\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Photo Viewer\de-DE\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Common Files\System\msadc\en-US\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\de\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Views\Utilities\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jre-1.8\bin\dtplugin\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hu-hu\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\fi-fi\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\AppxMetadata\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\dc-annotations\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\sq\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\he-il\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\PhotosApp\Assets\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\Microsoft.UI.Xaml\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ko-kr\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\lua\sd\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_2019.19071.12548.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-il\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\loc_archives\en\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\ar\LC_MESSAGES\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Google\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-125_8wekyb3d8bbwe\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\ach\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\fr-fr\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\nl-nl\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\de-de\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\nb-no\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\Java\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\node_modules\reactxp-experimental-navigation\NavigationExperimental\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactNative\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-tw\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\plugins\rhp\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Portal\1033\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\tr-tr\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Drops file in Windows directory 64 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-p..randprintui-printui_31bf3856ad364e35_10.0.19041.1237_none_50f80c4a292ea581\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-directui.resources_31bf3856ad364e35_10.0.19041.1_ar-sa_99d28305f49e925e\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-msxml30_31bf3856ad364e35_10.0.19041.844_none_70ba370b2a07f375\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-virtualcameramanager_31bf3856ad364e35_10.0.19041.746_none_df0740eb95df8fad\f\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationClientsideProviders.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..ironment-dvd-efisys_31bf3856ad364e35_10.0.19041.264_none_4082885e41be161c\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ests-onecoreuap-net_31bf3856ad364e35_10.0.19041.1_none_2938604e0119c52e\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-d..rtcards-phone-winrt_31bf3856ad364e35_10.0.19041.746_none_4a4c1a043950275c\f\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-resourcemanager-client_31bf3856ad364e35_10.0.19041.746_none_5cca29da5efd6883\r\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\x86_netfx4-filetrackerui_dll_ln_b03f5f7f11d50a3a_4.0.15805.0_none_fe69e989bde97a71\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\diagnostics\system\Apps\fr-FR\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..rformancemonitoring_31bf3856ad364e35_10.0.19041.1_none_677a60dc537bd64a\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wininit-adm.resources_31bf3856ad364e35_10.0.19041.1_it-it_a67b3517b58e441a\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-virtualdiskapilibrary_31bf3856ad364e35_10.0.19041.1266_none_6c7d1e21f203fb8f\f\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Windows.Diagnosis.SDEngine\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..rprovider.resources_31bf3856ad364e35_10.0.19041.1_en-us_bd12916a82295478\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p...appxmain.resources_31bf3856ad364e35_10.0.19041.964_en-us_f337cf878e4da36d\r\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft.dtc.power..l.scripts.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c547c9c9570907db\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasman_31bf3856ad364e35_10.0.19041.1081_none_ebd8da483974189f\r\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-settingsync_31bf3856ad364e35_10.0.19041.1_none_51607663cdf347a7\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-actionqueue.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_fae0a0b9eaafe4be\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..erexperience-common_31bf3856ad364e35_10.0.19041.1_none_44c920eaf5f2c5df\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-component_31bf3856ad364e35_10.0.19041.1237_none_a6ef3a2e62766c5c\f\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_smdiagnostics.resources_b77a5c561934e089_4.0.15805.0_es-es_d0121f246da0cedb\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\f\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_windows-gaming-ui-gamebar-component_31bf3856ad364e35_10.0.19041.746_none_be75e3e54abda527\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wlangpclient.resources_31bf3856ad364e35_10.0.19041.1_it-it_19ded556c8f3d6c9\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..nese_nec98_usb_only_31bf3856ad364e35_10.0.19041.1_none_9b8755a98da50082\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-fsutil.resources_31bf3856ad364e35_10.0.19041.1_en-us_1f1aced26e36b255\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1_none_19d22204a1f3fcaf\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msmq-bpa.resources_31bf3856ad364e35_10.0.19041.1_de-de_9af7b1b078108d85\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sctasks.resources_31bf3856ad364e35_10.0.19041.1_de-de_30185e5ef962b94d\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-tm_31bf3856ad364e35_10.0.19041.1202_none_c1d5764939090b5e\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-v..model-tilemigration_31bf3856ad364e35_10.0.19041.1288_none_f5c70e1effc3c18f\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-user32_31bf3856ad364e35_10.0.19041.1288_none_4c54bd1d56ecfd46\f\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\msil_microsoft.transactions.bridge.resources_b03f5f7f11d50a3a_10.0.19041.1_ja-jp_06d1957789ffc9fd\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-security-webauthn_31bf3856ad364e35_10.0.19041.1_none_bf6b3cc9bf82a75d\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_ialpss2i_i2c_bxt_p.inf.resources_31bf3856ad364e35_10.0.19041.1_de-de_2728a1282da563c7\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-c..r-name-ui.resources_31bf3856ad364e35_10.0.19041.1_en-us_6f53611a3c9fe9e8\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..-vaultcmd.resources_31bf3856ad364e35_10.0.19041.1_de-de_d9913fc26aa1dc0c\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..itybroker.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_9c43487e336176e3\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft.windows.winhttpcom_31bf3856ad364e35_5.1.19041.1_none_2583f6d83be26175\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_whvcrash.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_6500266b3dff5e21\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft.processmitigations.commands_31bf3856ad364e35_10.0.19041.1_none_029d77ef50910bdd\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.ManagementConsole.Resources\3.0.0.0_de_31bf3856ad364e35\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..iagnostic.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_109d77f83071f838\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysdm.resources_31bf3856ad364e35_10.0.19041.1_fr-fr_8eade99277d99f5d\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-waasmedic.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_c088f2ee495d2d00\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webservices.resources_31bf3856ad364e35_10.0.19041.1_es-es_c4738a0a15c46625\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-activationclient_31bf3856ad364e35_10.0.19041.1_none_b0a7a8cc2a443b3f\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mpr-extension_31bf3856ad364e35_10.0.19041.1_none_5d0cb97cc8af9b89\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\speech\080a\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.19041.1202_none_d8a1416ab7cccdcf\r\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..eyboard-korean_101c_31bf3856ad364e35_10.0.19041.1_none_3bb77c0fb9fb1a5e\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-raw-image-codec_31bf3856ad364e35_10.0.19041.746_none_5de782925eeebf9c\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-svc.resources_31bf3856ad364e35_10.0.19041.1_en-us_4299559dcbb02d80\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_netfx-aspnet_webadmin_users_b03f5f7f11d50a3a_10.0.19041.1_none_aaf2db146a6dad91\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-w..ileserver.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_90dd6d7e93f3800d\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\wow64_windows-applicationmodel-datasharingsvc_31bf3856ad364e35_10.0.19041.1_none_963ba0972837b459\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\x86_microsoft-windows-s..formers-shell-extra_31bf3856ad364e35_10.0.19041.262_none_6bcfd17023af3f25\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_dual_wvmbushid.inf_31bf3856ad364e35_10.0.19041.1_none_02d9a8dfa89062ce\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-bluetooth-userapis_31bf3856ad364e35_10.0.19041.546_none_49ae6b3d1ee49f98\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-f..ation-adm.resources_31bf3856ad364e35_10.0.19041.1_es-es_6fefc2ec1fba1026\cbBbW_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
Bewerbung-Lena-Kretschmer.exeBewerbung-Lena-Kretschmer.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bewerbung-Lena-Kretschmer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bewerbung-Lena-Kretschmer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exemsedge.exemsedge.exeidentity_helper.exepid process 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3552 Bewerbung-Lena-Kretschmer.exe 3064 msedge.exe 3064 msedge.exe 3192 msedge.exe 3192 msedge.exe 1160 identity_helper.exe 1160 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe 3192 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exeBewerbung-Lena-Kretschmer.exemsedge.exedescription pid process target process PID 2276 wrote to memory of 3552 2276 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 2276 wrote to memory of 3552 2276 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 2276 wrote to memory of 3552 2276 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 2276 wrote to memory of 3552 2276 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 3552 wrote to memory of 3192 3552 Bewerbung-Lena-Kretschmer.exe msedge.exe PID 3552 wrote to memory of 3192 3552 Bewerbung-Lena-Kretschmer.exe msedge.exe PID 3192 wrote to memory of 4296 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 4296 3192 msedge.exe msedge.exe PID 3552 wrote to memory of 3836 3552 Bewerbung-Lena-Kretschmer.exe cmd.exe PID 3552 wrote to memory of 3836 3552 Bewerbung-Lena-Kretschmer.exe cmd.exe PID 3552 wrote to memory of 3836 3552 Bewerbung-Lena-Kretschmer.exe cmd.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 396 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 3064 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 3064 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe PID 3192 wrote to memory of 2900 3192 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bewerbung-Lena-Kretschmer.exe"C:\Users\Admin\AppData\Local\Temp\Bewerbung-Lena-Kretschmer.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\Bewerbung-Lena-Kretschmer.exeC:\Users\Admin\AppData\Local\Temp\Bewerbung-Lena-Kretschmer.exe2⤵
- Drops file in Drivers directory
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\cbBbW_Entschluesselungs_Anleitung.html3⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff9d97c46f8,0x7ff9d97c4708,0x7ff9d97c47184⤵PID:4296
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:24⤵PID:396
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:34⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:84⤵PID:2900
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:14⤵PID:528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:14⤵PID:2340
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:84⤵PID:3080
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:84⤵
- Suspicious behavior: EnumeratesProcesses
PID:1160 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:14⤵PID:5004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:14⤵PID:3540
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:14⤵PID:912
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,12348383609083617245,16616896535550618584,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:14⤵PID:4404
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
- System Location Discovery: System Language Discovery
PID:3836
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:4976
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:5112
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1484
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5c015b287f3dbcc41ab8c329b1d6aa87e
SHA14baf624f8d2cb3b82330a7ffcd4d2194bf08536b
SHA256170a03eaa7cbab025db047f3190d520e299713773816c6f54a4429999fa4f879
SHA512240c583f5a9999e9e27fc7e74a67e3455a5aa3b9ab2e7aa825961fb079b3be367bd85917a159171c28c76862776a3edcb3ed33844ed2aadbbd6111293222cffb
-
Filesize
152B
MD561cef8e38cd95bf003f5fdd1dc37dae1
SHA111f2f79ecb349344c143eea9a0fed41891a3467f
SHA256ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
SHA5126fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
-
Filesize
152B
MD50a9dc42e4013fc47438e96d24beb8eff
SHA1806ab26d7eae031a58484188a7eb1adab06457fc
SHA25658d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
SHA512868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
-
Filesize
6KB
MD59e05d1e6b0f6322474d56f5b026c61cd
SHA1fb5f2910c6ed864f572171aeb261e12be381c3f9
SHA25609010d44b9f6cc2612f9783acb43294bd64e01a17864b83a9e2d5d5ee192f0c6
SHA5126f47a385ff09d6d94acffd71202af0116664a7e10703c0d400a300e333c00ff58669f6447ba692fc955729d6b3ff849fa3808c780d16f6ea1d35afe40f4854db
-
Filesize
6KB
MD56064fc5744d8d701ed1e596fc0681d9e
SHA1a07a04b769f72065cf07bc055cfbc5f373965ea7
SHA2561431a9e801e42ec5198a7b38ea22516872250b81fba3cc888526336b02d1b355
SHA51285844a3adc5ebdb55b7c88133ececce9226696ae1343942680cd6e71c6395ea1ab353b5bc73c6bef329d3b76c92742f922d1c5f8837b34e4a0e229b7707e3562
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
10KB
MD5f73c4a7d5c9b5f237f3401a9ba7104e5
SHA1d72701010a85b264178a746766a4bf49c0dfc831
SHA256c58b73254a68f1adbe7a769b5b2d25f3791e16a24f24ee5186fd573745dfdc05
SHA5127e2cd427b86c7a394a0aad2be178be6c42196eb63919b596f534f6a30b63cf15a296c2b112f6ad242190f0c68c767d853541c26cd9890dae58315d5f44ada721
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\cbBbW_Entschluesselungs_Anleitung.html
Filesize18KB
MD5f8d6593a280ba9e17c3771f10d4648b2
SHA165d13c8449b249cd5ad8a9259e9bd4a8eabc04e9
SHA256f155ccdf8ebef53c856c62dfd5cffcd380d66be3a036b8516824de38a5472b95
SHA51265a514d129b6fe419860fa70fcda3559e143b6c963fe317235f55d6ccadf125823c93fc3991410e9f8919dce179a809d8211a1989980049ad350f5c4c8ac4e9f
-
Filesize
18KB
MD5e01e5fa2ee6eb5c3278ddaf4db3361dc
SHA1825ac2bb2c4775895e43a59a3e0fcd05addedf7e
SHA256a0825cf1669cb55990b617c4c3ecbc70ddd2aca716c94be6ba8ccff6d96a7a52
SHA512422c0178b3eba80c1e12df7b1ad4c95b61048a36b7d6861a0f6ec7f4275e83bdf5249cfd23206f542ab0a9203193b1548c2d969405ca952b20031e84a48219af
-
MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e