Analysis
-
max time kernel
144s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-10-2024 23:08
Static task
static1
Behavioral task
behavioral1
Sample
Bewerbung-Lena-Kretschmer.exe
Resource
win7-20241010-en
General
-
Target
Bewerbung-Lena-Kretschmer.exe
-
Size
908KB
-
MD5
36ccd442755d482900b57188ae3a89a7
-
SHA1
8cd96603cdd2637cf5469aba8ed2b149c35ef699
-
SHA256
41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c
-
SHA512
0fcfc29a042342ccbf2529ac116e79698314778459d9dad2ca947b3eab2a7dec3d3622ce351b95909f88791c6d57a9943174ee352f13db246c706c9df1f57e9a
-
SSDEEP
24576:jRi7/DwOpfmVEyMrUnla/PJJF3NagKGPHpZkxCcI1rC1yOh:NiXJpfmVEXgnlKj9aMICcorC1yOh
Malware Config
Signatures
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (206) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops file in Drivers directory 28 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\es-ES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\it-IT\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\de-DE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\ja-JP\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\en-US\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\it-IT\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\es-ES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\de-DE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\es-ES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\it-IT\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\it-IT\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\ja-JP\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\de-DE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\es-ES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\ja-JP\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\de-DE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\en-US\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\ja-JP\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\drivers\UMDF\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Drops startup file 1 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File opened (read-only) \??\H: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\P: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\S: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\T: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\V: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\Z: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\J: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\M: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\U: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\Y: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\B: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\E: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\G: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\I: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\O: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\W: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\A: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\K: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\L: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\N: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\Q: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\R: Bewerbung-Lena-Kretschmer.exe File opened (read-only) \??\X: Bewerbung-Lena-Kretschmer.exe -
Drops file in System32 directory 64 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File created C:\Windows\System32\DriverStore\FileRepository\mdmcom1.inf_amd64_neutral_96c22c683482d8bd\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_neutral_86bb50f34c49ae71\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremium\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\OEM\StarterE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremium\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\NetworkList\Icons\StockIcons\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbushid.inf_amd64_neutral_6708ad28050a6765\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\eval\StarterN\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\migration\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnep00d.inf_amd64_neutral_dd61103f3a2743d4\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\en-US\Licenses\eval\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky006.inf_amd64_neutral_522043c34551b0c0\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\wiahp001.inf_amd64_neutral_aee49cdf3b352e58\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\Enterprise\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\Recovery\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky304.inf_amd64_ja-jp_1b1a158086a263a4\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\fr-FR\Licenses\eval\Enterprise\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0012\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\display.inf_amd64_neutral_ea1c8215e52777a6\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_neutral_857ff0fa9c73850a\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\EnterpriseE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp004.inf_amd64_neutral_53f688945cfc24cc\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_neutral_8f9a8242d3699a44\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\manifeststore\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\migwiz\it-IT\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\sysprep\it-IT\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\wbem\de-DE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDiagnostics\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmdyna.inf_amd64_neutral_7e4d690d07ee94c1\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\IME\imekr8\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0003\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr005.inf_amd64_neutral_9e4cc05e0d4bcb33\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\sti.inf_amd64_neutral_9d9a7113099a28a2\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomeBasic\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NDIS\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\sv-SE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\catroot\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prncs302.inf_amd64_ja-jp_96eca15be06b1482\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\es-ES\Licenses\eval\Professional\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\es-ES\Licenses\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0804\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\migwiz\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr00a.inf_amd64_neutral_e7f3f91e6832ef5c\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00a.inf_amd64_neutral_a89d2c01c0f43dfd\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0006\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\Printing_Admin_Scripts\es-ES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\Speech\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\it-IT\Licenses\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Sxs\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\sr-Latn-CS\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\SysWOW64\wbem\AutoRecover\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File opened for modification C:\Windows\SysWOW64\com\ja-JP\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription pid process target process PID 2236 set thread context of 2876 2236 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe -
Drops file in Program Files directory 64 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File created C:\Program Files\Common Files\Microsoft Shared\ink\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Microsoft Games\More Games\es-ES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Media Player\es-ES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Windows Journal\Templates\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Common Files\Microsoft Shared\OFFICE14\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jre7\lib\deploy\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\System\de-DE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Internet Explorer\es-ES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\plugins\stream_filter\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\1033\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Microsoft Games\Minesweeper\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jre7\bin\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\an\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\js\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\lua\intf\modules\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Mail\ja-JP\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Photo Viewer\en-US\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\microsoft shared\TextConv\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\js\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\ta\LC_MESSAGES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\System\en-US\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\fur\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\1033\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\lib\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jre7\lib\zi\Europe\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\3082\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Word.en-us\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Internet Explorer\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\en-US\css\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\DVD Maker\de-DE\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\VideoLAN\VLC\locale\cgg\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Drops file in Windows directory 64 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exedescription ioc process File created C:\Windows\winsxs\amd64_prnlx00e.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_bafd7c73980994bc\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-c..entsnapin.resources_31bf3856ad364e35_6.1.7600.16385_en-us_771a64735072457b\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..structure.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_cda61b2255168f12\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..smenttool.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f471431c94847a89\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..rgraphing.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_155cc3c1cbf93c62\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_nl-nl_02354b58460a7e0e\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-ics.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bd0edcbcba8e7b7c\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..sframework-inputdll_31bf3856ad364e35_6.1.7600.16385_none_b88be45adf067b29\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00020405_31bf3856ad364e35_6.1.7600.16385_none_958e650e9647ceba\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-bluetooth-mtpenum_31bf3856ad364e35_6.1.7600.16385_none_0257f0a5591b237c\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..ingconfig.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c1f805b05866fc9c\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-pnputil.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_db256cd2c2cbd9c7\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winver.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a5b512695f3a1cc5\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..on-wizard-framework_31bf3856ad364e35_6.1.7601.17514_none_b85a4f21afbb528a\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..atibility.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e6badd215da143d5\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..on-common.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_42b5e45217c61c4e\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..lsservice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_623fd92274bff992\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_ee2620cf57bc84de\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\msil_wsatconfig.resources_b03f5f7f11d50a3a_6.1.7601.17514_it-it_0730093e89a28b79\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\inf\ASP.NET_4.0.30319\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..gement-ui.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_b21b41e894f6bda2\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_netfx-system.management_b03f5f7f11d50a3a_6.1.7601.17514_none_f6397b438cd5e46b\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-f..libraries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_33bb1a534004f6c6\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-halftone-ui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9f6efab05dc26e71\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_netfx-aspnet_pg_persnlization_sql_b03f5f7f11d50a3a_6.1.7600.16385_none_8cf9aaeb8a316114\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..-ehkorime.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d2786df068703a68\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-20001_31bf3856ad364e35_6.1.7600.16385_none_ad8dff130045ea0a\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3125fd6a3924d681\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-peerdist.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6c850f9f4dfcf38d\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\msil_system.resources_b77a5c561934e089_6.1.7601.17514_de-de_3a7bde6078e3bca5\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-21866_31bf3856ad364e35_6.1.7600.16385_none_53e2c911465b0612\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-o..tend-apis.resources_31bf3856ad364e35_6.1.7601.17514_es-es_a1b6f169bb98baa4\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\0407\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-e..mmandline.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_33110e0403e89cf9\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..structure.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c0dcaa2ad5c24a80\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_wdmaudio.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_89b3674078c70745\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\1033\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\wow64_microsoft-windows-scripting-jscript_31bf3856ad364e35_11.2.9600.16428_none_6f8ba5f740934aae\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\inf\UGatherer\0410\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7601.17514_en-us_6b1dc6ae4ec493c3\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-smbserver-netapi_31bf3856ad364e35_6.1.7601.17514_none_9ecc78ac672b15fc\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..ywmdmcesp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f51e69e47ef7fcdc\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_ph6xib64c1.inf_31bf3856ad364e35_6.1.7600.16385_none_9709ad05265f64c5\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_prnkm004.inf_31bf3856ad364e35_6.1.7600.16385_none_50ff82015b97b704\Amd64\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\wow64_microsoft-windows-p..-gameratingssystems_31bf3856ad364e35_6.1.7600.16385_none_902ec1113c6f875c\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e7c4581d14a175d5\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_ds-ui-ext_31bf3856ad364e35_6.1.7601.17514_none_ce73310d1634318a\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-cpxl-dll.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_3be757cf692e1ead\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..age-codec.resources_31bf3856ad364e35_7.1.7601.16492_nl-nl_b7ca4d8b5a0ff58b\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_wcf-m_svc_mod_op_perf_c_reg_31bf3856ad364e35_6.1.7600.16385_none_23b47b1a46320a55\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_wpdmtphw.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b8ee4729f5f06e11\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..centercpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a57e5782f6542de7\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..publicapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_009b5909ea47480e\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_wiacn001.inf_31bf3856ad364e35_6.1.7600.16385_none_95eb24d2d4a0a55b\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-m..-mdac-oledb-stub-er_31bf3856ad364e35_6.1.7600.16385_none_f1c5d21ed15c2e4f\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_bthspp.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_80e08754bff7abee\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-help-peopcom.resources_31bf3856ad364e35_6.1.7600.16385_it-it_efe5011c037ec344\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\x86_microsoft-windows-photoviewer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4e05625854e407a8\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..ltdel-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ca4960cdaccb2f52\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..oup-provsvc-license_31bf3856ad364e35_6.1.7600.16385_none_2d3176f8cdb5be29\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\RUpOV_Entschluesselungs_Anleitung.html Bewerbung-Lena-Kretschmer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
cmd.exevssadmin.exeBewerbung-Lena-Kretschmer.exeBewerbung-Lena-Kretschmer.exeIEXPLORE.EXEdescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bewerbung-Lena-Kretschmer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bewerbung-Lena-Kretschmer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE -
Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2848 vssadmin.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{28565AE1-88EF-11EF-AA78-72B5DC1A84E6} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exepid process 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe 2876 Bewerbung-Lena-Kretschmer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2832 vssvc.exe Token: SeRestorePrivilege 2832 vssvc.exe Token: SeAuditPrivilege 2832 vssvc.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
iexplore.exepid process 796 iexplore.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
iexplore.exeIEXPLORE.EXEpid process 796 iexplore.exe 796 iexplore.exe 928 IEXPLORE.EXE 928 IEXPLORE.EXE 928 IEXPLORE.EXE 928 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
Bewerbung-Lena-Kretschmer.exeBewerbung-Lena-Kretschmer.exeiexplore.execmd.exedescription pid process target process PID 2236 wrote to memory of 2876 2236 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 2236 wrote to memory of 2876 2236 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 2236 wrote to memory of 2876 2236 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 2236 wrote to memory of 2876 2236 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 2236 wrote to memory of 2876 2236 Bewerbung-Lena-Kretschmer.exe Bewerbung-Lena-Kretschmer.exe PID 2876 wrote to memory of 796 2876 Bewerbung-Lena-Kretschmer.exe iexplore.exe PID 2876 wrote to memory of 796 2876 Bewerbung-Lena-Kretschmer.exe iexplore.exe PID 2876 wrote to memory of 796 2876 Bewerbung-Lena-Kretschmer.exe iexplore.exe PID 2876 wrote to memory of 796 2876 Bewerbung-Lena-Kretschmer.exe iexplore.exe PID 2876 wrote to memory of 580 2876 Bewerbung-Lena-Kretschmer.exe cmd.exe PID 2876 wrote to memory of 580 2876 Bewerbung-Lena-Kretschmer.exe cmd.exe PID 2876 wrote to memory of 580 2876 Bewerbung-Lena-Kretschmer.exe cmd.exe PID 2876 wrote to memory of 580 2876 Bewerbung-Lena-Kretschmer.exe cmd.exe PID 796 wrote to memory of 928 796 iexplore.exe IEXPLORE.EXE PID 796 wrote to memory of 928 796 iexplore.exe IEXPLORE.EXE PID 796 wrote to memory of 928 796 iexplore.exe IEXPLORE.EXE PID 796 wrote to memory of 928 796 iexplore.exe IEXPLORE.EXE PID 580 wrote to memory of 2848 580 cmd.exe vssadmin.exe PID 580 wrote to memory of 2848 580 cmd.exe vssadmin.exe PID 580 wrote to memory of 2848 580 cmd.exe vssadmin.exe PID 580 wrote to memory of 2848 580 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bewerbung-Lena-Kretschmer.exe"C:\Users\Admin\AppData\Local\Temp\Bewerbung-Lena-Kretschmer.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\Bewerbung-Lena-Kretschmer.exeC:\Users\Admin\AppData\Local\Temp\Bewerbung-Lena-Kretschmer.exe2⤵
- Drops file in Drivers directory
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\RUpOV_Entschluesselungs_Anleitung.html3⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:796 CREDAT:275457 /prefetch:24⤵
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:928 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k vssadmin.exe delete shadows /all /quiet & bcdedit.exe /set {default} recoveryenabled no & bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe delete shadows /all /quiet4⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:2848
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2832
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Direct Volume Access
1Indicator Removal
2File Deletion
2Modify Registry
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD5e460245660c1fe9bddd5b7a36587d22b
SHA188c04893a90048e398a654539521ca68339ed82a
SHA25674677c7aa47090e2c511cf52f24942b52f7ac84aa16ccdd2ef4a43fae03550a7
SHA5122ac4dd045fc20c0e94e262cad4a14a4c53cf2853ec1d89a491e3b713d8f3004486e23bb0d0c8a66da4b7f4a2c01ccb60c95f0cae1ad83fbc1388a2fd68b3bb22
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD527da7fc00a08d1fdb89fae7fbfd9decf
SHA172bc44183d8815ef0a71656ce8a1663ac64c6ae7
SHA2568c3f4a10a40f89ecba67807e3c5bbca8348d1ed42d3baf9d558054db5e3a069e
SHA512119a958a3b840bea5677d61ffa73fa6b818d86e0933a5c9dc437c036428a808acf817c3d647e08cdee1a6703eaff645962e5fff808413bd93c33d6693a3f4754
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bfe272b325c3fe9eabb7e4fddfab2681
SHA17083163145b077fd3aa8d0d6d1dcc2af4f485401
SHA256965b241694c1698b577ce696f35a2251e509daef0b5e388a56747767b5686b7b
SHA5121254c22af0898c54dd0b7eaaef6c71c5da21895b3d4cb9e3bad34cbb44635a59d3f6ce96989340eb67c8dad3c30d32eaea65a49b5fe1d8dfb6b25db479192425
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD546a28df7eaee2b1147afc04258724a8f
SHA1743e85b48e6110d86f19a3c673917674ad23382f
SHA256c050783095e6e41ea7d5036bb94b6debb886b784d2658b125212590982698347
SHA512be1d5b9c350a6baa3e788345912a351490195f48d3b71bfe4a903178eb248f93274d97f4f6c1815ce0983303a3de11a582ad4d83dc6acd57976ef76cff6651c5
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5029a633416f882ccd9916d215e3c41c3
SHA1b50b2d6774e12eb284230892e693dc3024e2fe14
SHA256735b9fa0796aa664849c101d19886dc68076991dfa3142d314f91661354951c3
SHA5120ebc7c4ae9236de0b4397e1730cbb828a5d8e16e56155d46f078d5e7637cce25e3674be4bf0aa53444da50082c85b9935e29e085eb64f54cf4c843530a61c878
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD54da8d074acc2884451935577c01caba2
SHA1ba0f4fcda03e9677fc55879d161500e972e69d6e
SHA25657829d158a4ed8a4f0541750b1467af6d89c51cfe7d968a33317838e418fea32
SHA512c175279be302e34237b8039c22bbbc836e89e7cc4226995ad6542d4635f5a1867f95d9ea020c7dc799957cc961780c3dc65e2a43932a520c74bd78680640117e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD59203f4d82edd03bcf2d583697d763525
SHA14bcb2320ca54feb590de6147e6d972a4b3b4ee37
SHA2562ab55ce0f00fd1d05c342c230d8a9f4e86a1bf69b2f15b7004ffe04db7235080
SHA51233fffbd99f4d0e2670ba81f4de89c563f24aac84c4553ac2d8935a67b8318bee413e0779111bfa8fd055270a52e3d707afaf7882bf88b0f692aa0f6eb2f38f33
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5bac333955953b60173f8a4d15e125140
SHA1b5f422a9e840466fb6f2d65f6c0cef097ae812a7
SHA256377e1f2c0dce6955471d074c8ceddc579697777ff4970fcc1fc178f7be4e7d16
SHA51218b984935af2b59c2e579559f0074a60c11e42abfa3d6ea15432c6d24d6f1a7e93859104741e136a98e93acc71e5142043cc3665f29ed51a7fdf698af7bebfd8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5fd6f575f5f82a2326833662d9616ebe4
SHA1942b8969ce8d265c9e5e9c449acfe0665650f5b1
SHA25690642cabc117641497b81eab7a0d93e0c0f6484b87ad4487bf5b93a7dba02a80
SHA512493bd815a6673ab916bedc9b523c0a199c4967ed90244b4c9d33cc5fa02c4e139d4b4025cb987861fea363d75ceaaa06489b759d27a4b97ecda1af6f92d54c71
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5e2ade3a411d3e47150a54b55197395af
SHA13b0221bbb986a74f03ce1e493b37ac12d552ba28
SHA25620b16dbbd7d84e8b9ceb23dee8a0b09a571061058f771653367a9918cff63e86
SHA5124ee5b311b183901aea5e1aaa10763e3895c9d6b6db4b50a8811f8fc0fd5ddc75a333c4bbd6d554f496c170812d4c5d98eee44423610453eb6a56df352a762424
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5512c7331d26c902ffb6a77b4f6824a6c
SHA1290bb7e17d599fad2e488e705bb4258b915f3a64
SHA2568fcb1ab351f598c67fa18d67030df71c0cd087e0d2128f7b81fb763d68f149b8
SHA512c947e6156e272e2e11b998080387a845bdd023636d78ea26586e973c60bd850a5921634466f5c4b17b2bfca9dc9de2740d5407a5edf9c3646d6c170d95fd129e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD5c04e290a5acfbfd850a61da124e87086
SHA1e4226f022d910ef60a38bbfc69e8ec720e214a0f
SHA256490d6ac347e9d25fb4c9d7115fa586d0b3b5c7ce462cdd1f303bf89ceaa1a164
SHA51213c7b49784a41150f41c14ec7280cf8a124481abbe1c75e9d54c425d1e3513de2205f30e664f3f0adaaa2d3a1432e78febfc30249c85610b47258b6525b51d3c
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\CTLs\RUpOV_Entschluesselungs_Anleitung.html
Filesize18KB
MD5edfc224acd4257b87d137c309e1dd1b0
SHA12fa8f14ad3f6ef2657d9237134fc908e7dfac029
SHA2560975e705bf2cd448a83fd06dfe2e81bb0accc3f8a7a8888e78c0d8e7e64a4d26
SHA51228da34bd6438673d74d983221256950b96d645139d0803edd437def0402f786cd42aec52a99182d1ff5602759a54f86a5d3f3daea6a631788963745e4d670001
-
Filesize
18KB
MD563bf958cc80993435ab9d2fda0172f5a
SHA1f53a79cf8f8fc9244d82666fb7e00eaf6ac8a571
SHA2568cbc859f2849f8196a7d24d73e8f3cad805800df3c932182fce38c1c10da914e
SHA5123f098808014d5d2b70a4eae3399f9f8ae99f7194683db476ba8936ac3bb68fbdae32d2700448c9c2cd9bae4b9d44694b5ef9efa58bb546d68023d865278116cd