Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
Bewerbungsschreiben.exe
|
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Bewerbungsschreiben.exe.log
|
ASCII text, with CRLF line terminators
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
'C:\Users\user\Desktop\Bewerbungsschreiben.exe'
|
|
|
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
|
|
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
|
|
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
|
|
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
|
|
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
C:\Users\user\Desktop\Bewerbungsschreiben.exe
|
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
|
unknown
|
 |
|
|
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
|
unknown
|
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2EC1000
|
unkown
|
page read and write
|
|
|
|
12ED1000
|
unkown
|
page read and write
|
|
|
|
3C254FF000
|
unkown
|
page read and write
|
|
|
|
7FFA35920000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
2DF0000
|
unkown
|
page readonly
|
|
|
|
1BCA0000
|
unkown
|
page read and write
|
|
|
|
14D0000
|
unkown
|
page readonly
|
|
|
|
7FF542525000
|
unkown
|
page readonly
|
|
|
|
C10000
|
unkown image
|
page readonly
|
|
|
|
1B850000
|
unkown
|
page read and write
|
|
|
|
1470000
|
unkown
|
page read and write
|
|
|
|
1B850000
|
unkown
|
page read and write
|
|
|
|
C10000
|
unkown image
|
page readonly
|
|
|
|
11FE000
|
unkown
|
page read and write
|
|
|
|
1B890000
|
heap private
|
page read and write
|
|
|
|
1BE90000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1B880000
|
unkown
|
page read and write
|
|
|
|
7FF5420E6000
|
unkown
|
page readonly
|
|
|
|
7FF5420F5000
|
unkown
|
page readonly
|
|
|
|
12D7000
|
unkown
|
page read and write
|
|
|
|
7FF54251A000
|
unkown
|
page readonly
|
|
|
|
1BD70000
|
unkown
|
page read and write
|
|
|
|
C12000
|
unkown image
|
page readonly
|
|
|
|
1520000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1BD20000
|
unkown
|
page read and write
|
|
|
|
1BD50000
|
unkown
|
page read and write
|
|
|
|
7FFA3595C000
|
unkown
|
page execute and read and write
|
|
|
|
7FF542537000
|
unkown
|
page readonly
|
|
|
|
1540000
|
heap private
|
page read and write
|
|
|
|
7FFA35913000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
372000
|
unkown image
|
page readonly
|
|
|
|
1B9B0000
|
unkown
|
page read and write
|
|
|
|
D30000
|
unkown image
|
page readonly
|
|
|
|
7FFA35903000
|
unkown
|
page execute and read and write
|
|
|
|
1B820000
|
unkown
|
page read and write
|
|
|
|
3C24FDE000
|
unkown
|
page read and write
|
|
|
|
1BE40000
|
unkown
|
page read and write
|
|
|
|
7FF542596000
|
unkown
|
page readonly
|
|
|
|
7FF4D79D0000
|
unkown
|
page execute and read and write
|
|
|
|
1B9F0000
|
unkown
|
page read and write
|
|
|
|
7FF54241E000
|
unkown
|
page readonly
|
|
|
|
1B820000
|
unkown
|
page read and write
|
|
|
|
1530000
|
unkown
|
page read and write
|
|
|
|
DB6000
|
unkown image
|
page readonly
|
|
|
|
1B43C000
|
unkown
|
page read and write
|
|
|
|
1B9D0000
|
unkown
|
page read and write
|
|
|
|
1530000
|
unkown
|
page read and write
|
|
|
|
CB0000
|
unkown
|
page readonly
|
|
|
|
1BAA0000
|
unkown
|
page read and write
|
|
|
|
7FFA359B0000
|
unkown
|
page read and write
|
|
|
|
22B2BD40000
|
unkown
|
page readonly
|
|
|
|
420000
|
unkown image
|
page readonly
|
|
|
|
22B2BC70000
|
unkown
|
page readonly
|
|
|
|
1BE0E000
|
unkown
|
page read and write
|
|
|
|
1B880000
|
unkown
|
page read and write
|
|
|
|
7FF54256A000
|
unkown
|
page readonly
|
|
|
|
1430000
|
heap private
|
page read and write
|
|
|
|
3C25375000
|
unkown
|
page read and write
|
|
|
|
1B860000
|
unkown
|
page read and write
|
|
|
|
3C24F5B000
|
unkown
|
page read and write
|
|
|
|
7FF542297000
|
unkown
|
page readonly
|
|
|
|
1B870000
|
heap private
|
page read and write
|
|
|
|
1BDF0000
|
unkown
|
page read and write
|
|
|
|
22B2BE3C000
|
unkown
|
page read and write
|
|
|
|
12EC8000
|
unkown
|
page read and write
|
|
|
|
22B2BE4D000
|
unkown
|
page read and write
|
|
|
|
1B879000
|
heap private
|
page read and write
|
|
|
|
1B9E0000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1B9C0000
|
unkown
|
page read and write
|
|
|
|
1B830000
|
unkown
|
page read and write
|
|
|
|
1BF0F000
|
unkown
|
page read and write
|
|
|
|
22B2C602000
|
unkown
|
page read and write
|
|
|
|
1BD40000
|
unkown
|
page read and write
|
|
|
|
7FFA35A20000
|
unkown
|
page read and write
|
|
|
|
10E0000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
422000
|
unkown image
|
page readonly
|
|
|
|
FD6000
|
unkown image
|
page readonly
|
|
|
|
7FFA35A30000
|
unkown
|
page execute and read and write
|
|
|
|
123F000
|
heap default
|
page read and write
|
|
|
|
22B2BE4E000
|
unkown
|
page read and write
|
|
|
|
22B2BF02000
|
unkown
|
page read and write
|
|
|
|
7FF542604000
|
unkown
|
page readonly
|
|
|
|
420000
|
unkown image
|
page readonly
|
|
|
|
22B2BC00000
|
heap private
|
page read and write
|
|
|
|
D32000
|
unkown image
|
page readonly
|
|
|
|
7FF541C30000
|
unkown
|
page readonly
|
|
|
|
1BE50000
|
unkown
|
page read and write
|
|
|
|
7FFA3592D000
|
unkown
|
page execute and read and write
|
|
|
|
1BDC0000
|
unkown
|
page read and write
|
|
|
|
370000
|
unkown image
|
page readonly
|
|
|
|
1BE20000
|
unkown
|
page read and write
|
|
|
|
3C255F7000
|
unkown
|
page read and write
|
|
|
|
1B873000
|
heap private
|
page read and write
|
|
|
|
1200000
|
heap default
|
page read and write
|
|
|
|
7FF542611000
|
unkown
|
page readonly
|
|
|
|
1B9E0000
|
unkown
|
page read and write
|
|
|
|
312000
|
unkown image
|
page readonly
|
|
|
|
1268000
|
heap default
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
F50000
|
unkown image
|
page readonly
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
22B2BE6F000
|
unkown
|
page read and write
|
|
|
|
2DEF000
|
unkown
|
page read and write
|
|
|
|
7FF542574000
|
unkown
|
page readonly
|
|
|
|
C96000
|
unkown image
|
page readonly
|
|
|
|
1490000
|
unkown
|
page read and write
|
|
|
|
310000
|
unkown image
|
page readonly
|
|
|
|
370000
|
unkown image
|
page readonly
|
|
|
|
1BAA1000
|
unkown
|
page read and write
|
|
|
|
1BDB0000
|
unkown
|
page read and write
|
|
|
|
14E0000
|
unkown
|
page read and write
|
|
|
|
7FFA35AB0000
|
unkown
|
page read and write
|
|
|
|
7FF54252B000
|
unkown
|
page readonly
|
|
|
|
D30000
|
unkown image
|
page readonly
|
|
|
|
22B2BE8A000
|
unkown
|
page read and write
|
|
|
|
396000
|
unkown image
|
page readonly
|
|
|
|
1B850000
|
unkown
|
page read and write
|
|
|
|
1B893000
|
heap private
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
7FF542612000
|
unkown
|
page readonly
|
|
|
|
7FF54260A000
|
unkown
|
page readonly
|
|
|
|
1B850000
|
unkown
|
page read and write
|
|
|
|
7FFA3590D000
|
unkown
|
page execute and read and write
|
|
|
|
D30000
|
unkown image
|
page readonly
|
|
|
|
12DC000
|
unkown
|
page read and write
|
|
|
|
1BD8D000
|
unkown
|
page read and write
|
|
|
|
420000
|
unkown image
|
page readonly
|
|
|
|
1010000
|
unkown
|
page readonly
|
|
|
|
22B2BE29000
|
unkown
|
page read and write
|
|
|
|
310000
|
unkown image
|
page readonly
|
|
|
|
3C2527D000
|
unkown
|
page read and write
|
|
|
|
14C0000
|
heap private
|
page execute and read and write
|
|
|
|
1BEC0000
|
unkown
|
page read and write
|
|
|
|
22B2BD50000
|
unkown
|
page readonly
|
|
|
|
1B9B0000
|
unkown
|
page read and write
|
|
|
|
120D000
|
heap default
|
page read and write
|
|
|
|
1B850000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
123C000
|
heap default
|
page read and write
|
|
|
|
1B9B0000
|
unkown
|
page read and write
|
|
|
|
1B9A0000
|
unkown
|
page read and write
|
|
|
|
7FF542484000
|
unkown
|
page readonly
|
|
|
|
7FFA35904000
|
unkown
|
page read and write
|
|
|
|
7FF54250C000
|
unkown
|
page readonly
|
|
|
|
7FF54251E000
|
unkown
|
page readonly
|
|
|
|
7FF54257F000
|
unkown
|
page readonly
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1BA00000
|
heap private
|
page read and write
|
|
|
|
7FFA359B6000
|
unkown
|
page read and write
|
|
|
|
4A6000
|
unkown image
|
page readonly
|
|
|
|
7FF54250A000
|
unkown
|
page readonly
|
|
|
|
372000
|
unkown image
|
page readonly
|
|
|
|
1B9A0000
|
unkown
|
page read and write
|
|
|
|
DD5000
|
unkown
|
page read and write
|
|
|
|
1B860000
|
unkown
|
page read and write
|
|
|
|
1BD80000
|
unkown
|
page read and write
|
|
|
|
1BE10000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1BEA0000
|
unkown
|
page read and write
|
|
|
|
3C2547B000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
22B2BF13000
|
unkown
|
page read and write
|
|
|
|
7FF542564000
|
unkown
|
page readonly
|
|
|
|
7FF54254F000
|
unkown
|
page readonly
|
|
|
|
7FFA35A25000
|
unkown
|
page read and write
|
|
|
|
22B2C000000
|
unkown
|
page readonly
|
|
|
|
1B880000
|
unkown
|
page read and write
|
|
|
|
1BDE0000
|
unkown
|
page read and write
|
|
|
|
1BA10000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1B780000
|
unkown
|
page readonly
|
|
|
|
370000
|
unkown image
|
page readonly
|
|
|
|
7FFA35A2B000
|
unkown
|
page read and write
|
|
|
|
F52000
|
unkown image
|
page readonly
|
|
|
|
22B2BF08000
|
unkown
|
page read and write
|
|
|
|
1BDD0000
|
unkown
|
page read and write
|
|
|
|
1400000
|
unkown
|
page read and write
|
|
|
|
312000
|
unkown image
|
page readonly
|
|
|
|
1BD30000
|
unkown
|
page read and write
|
|
|
|
7FF54258E000
|
unkown
|
page readonly
|
|
|
|
22B2C460000
|
unkown
|
page readonly
|
|
|
|
396000
|
unkown image
|
page readonly
|
|
|
|
7FF542401000
|
unkown
|
page readonly
|
|
|
|
1BE60000
|
unkown
|
page read and write
|
|
|
|
22B2BE13000
|
unkown
|
page read and write
|
|
|
|
7FFA35910000
|
unkown
|
page read and write
|
|
|
|
C96000
|
unkown image
|
page readonly
|
|
|
|
7FFA3591D000
|
unkown
|
page execute and read and write
|
|
|
|
1435000
|
heap private
|
page read and write
|
|
|
|
7FFA359BC000
|
unkown
|
page execute and read and write
|
|
|
|
7FFA359E6000
|
unkown
|
page execute and read and write
|
|
|
|
14A4000
|
unkown
|
page read and write
|
|
|
|
1BD90000
|
unkown
|
page read and write
|
|
|
|
1B824000
|
unkown
|
page read and write
|
|
|
|
1B821000
|
unkown
|
page read and write
|
|
|
|
1550000
|
unkown
|
page readonly
|
|
|
|
22B2BE00000
|
unkown
|
page read and write
|
|
|
|
310000
|
unkown image
|
page readonly
|
|
|
|
1BA90000
|
heap private
|
page execute and read and write
|
|
|
|
1C00E000
|
unkown
|
page read and write
|
|
|
|
7FFA359C0000
|
unkown
|
page execute and read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1B860000
|
unkown
|
page read and write
|
|
|
|
22B2BF00000
|
unkown
|
page read and write
|
|
|
|
12ECD000
|
unkown
|
page read and write
|
|
|
|
1BEC5000
|
unkown
|
page read and write
|
|
|
|
1440000
|
unkown
|
page read and write
|
|
|
|
1B830000
|
unkown
|
page read and write
|
|
|
|
F52000
|
unkown image
|
page readonly
|
|
|
|
3F6000
|
unkown image
|
page readonly
|
|
|
|
C10000
|
unkown image
|
page readonly
|
|
|
|
1BEB0000
|
unkown
|
page read and write
|
|
|
|
7FF54254C000
|
unkown
|
page readonly
|
|
|
|
1AEF0000
|
unkown
|
page read and write
|
|
|
|
7FF5420E0000
|
unkown
|
page readonly
|
|
|
|
3C256FE000
|
unkown
|
page read and write
|
|
|
|
12EC1000
|
unkown
|
page read and write
|
|
|
|
1BBA0000
|
unkown
|
page read and write
|
|
|
|
7FF5423C3000
|
unkown
|
page readonly
|
|
|
|
1B880000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
3F6000
|
unkown image
|
page readonly
|
|
|
|
DB6000
|
unkown image
|
page readonly
|
|
|
|
22B2BE27000
|
unkown
|
page read and write
|
|
|
|
1219000
|
heap default
|
page read and write
|
|
|
|
1B9A0000
|
unkown
|
page read and write
|
|
|
|
7FF542473000
|
unkown
|
page readonly
|
|
|
|
1B820000
|
unkown
|
page read and write
|
|
|
|
7FF542588000
|
unkown
|
page readonly
|
|
|
|
22B2BE4A000
|
unkown
|
page read and write
|
|
|
|
14F0000
|
unkown
|
page read and write
|
|
|
|
1510000
|
unkown
|
page readonly
|
|
|
|
1BE00000
|
unkown
|
page read and write
|
|
|
|
1545000
|
heap private
|
page read and write
|
|
|
|
1B850000
|
unkown
|
page read and write
|
|
|
|
22B2C800000
|
unkown
|
page readonly
|
|
|
|
22B2BE4B000
|
unkown
|
page read and write
|
|
|
|
7FF54241B000
|
unkown
|
page readonly
|
|
|
|
C12000
|
unkown image
|
page readonly
|
|
|
|
7FFA35AC0000
|
unkown
|
page read and write
|
|
|
|
D32000
|
unkown image
|
page readonly
|
|
|
|
1BE30000
|
unkown
|
page read and write
|
|
|
|
1520000
|
unkown
|
page read and write
|
|
|
|
1BDA0000
|
unkown
|
page read and write
|
|
|
|
2EB0000
|
heap private
|
page read and write
|
|
|
|
422000
|
unkown image
|
page readonly
|
|
|
|
7FF54246D000
|
unkown
|
page readonly
|
|
|
|
14A0000
|
unkown
|
page read and write
|
|
|
|
1BA80000
|
unkown
|
page read and write
|
|
|
|
7FF54259D000
|
unkown
|
page readonly
|
|
|
|
13FF000
|
unkown
|
page read and write
|
|
|
|
3C257FF000
|
unkown
|
page read and write
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
1BD60000
|
unkown
|
page read and write
|
|
|
|
7FF542557000
|
unkown
|
page readonly
|
|
|
|
1B840000
|
unkown
|
page read and write
|
|
|
|
F50000
|
unkown image
|
page readonly
|
|
|
|
7FF54248C000
|
unkown
|
page readonly
|
|
|
|
22B2BC60000
|
heap default
|
page read and write
|
|
|
|
22B2BE02000
|
unkown
|
page read and write
|
|
|
|
1BC62000
|
unkown
|
page read and write
|
|
|
|
7FF542520000
|
unkown
|
page readonly
|
|
|
|
4A6000
|
unkown image
|
page readonly
|
|
|
|
1BD10000
|
unkown
|
page read and write
|
|
|
|
FD6000
|
unkown image
|
page readonly
|
|
|
|
1B9C0000
|
unkown
|
page read and write
|
|
|
|
7FF542371000
|
unkown
|
page readonly
|
|
|
|
1B860000
|
unkown
|
page read and write
|
|
|
|
1BE70000
|
unkown
|
page read and write
|
|
|
|
1B780000
|
unkown
|
page read and write
|
|
|
|
F50000
|
unkown image
|
page readonly
|
|
|
|
1B440000
|
unkown
|
page readonly
|
|
|
|
1BE80000
|
unkown
|
page read and write
|
|
|
|
7FF542599000
|
unkown
|
page readonly
|
|
|
|
7FF541D81000
|
unkown
|
page readonly
|
|
|
|
1B99D000
|
unkown
|
page read and write
|
|
|
|
1B9D0000
|
unkown
|
page read and write
|
|
|
|
22B2BD60000
|
unkown
|
page read and write
|
|
There are 275 hidden memdumps, click here to show them.