Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
CD0000
|
heap
|
page read and write
|
||
|
A96000
|
unkown
|
page execute and write copy
|
||
|
42DE000
|
stack
|
page read and write
|
||
|
301E000
|
stack
|
page read and write
|
||
|
5EE5000
|
trusted library allocation
|
page read and write
|
||
|
2FDF000
|
stack
|
page read and write
|
||
|
311F000
|
stack
|
page read and write
|
||
|
AAE000
|
unkown
|
page execute and read and write
|
||
|
329E000
|
stack
|
page read and write
|
||
|
A86000
|
unkown
|
page execute and read and write
|
||
|
29DC000
|
stack
|
page read and write
|
||
|
AC3000
|
unkown
|
page execute and write copy
|
||
|
3DDE000
|
stack
|
page read and write
|
||
|
4CD0000
|
trusted library allocation
|
page read and write
|
||
|
4A10000
|
heap
|
page read and write
|
||
|
4CD0000
|
direct allocation
|
page execute and read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
4E60000
|
trusted library allocation
|
page read and write
|
||
|
43DF000
|
stack
|
page read and write
|
||
|
B32000
|
unkown
|
page execute and read and write
|
||
|
441E000
|
stack
|
page read and write
|
||
|
5BC000
|
stack
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
465F000
|
stack
|
page read and write
|
||
|
49F1000
|
heap
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
389F000
|
stack
|
page read and write
|
||
|
B19000
|
unkown
|
page execute and write copy
|
||
|
34DF000
|
stack
|
page read and write
|
||
|
5EC1000
|
trusted library allocation
|
page read and write
|
||
|
90A000
|
unkown
|
page execute and read and write
|
||
|
4B90000
|
direct allocation
|
page execute and read and write
|
||
|
900000
|
unkown
|
page readonly
|
||
|
B1B000
|
unkown
|
page execute and write copy
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
70F0000
|
heap
|
page execute and read and write
|
||
|
4E70000
|
heap
|
page execute and read and write
|
||
|
3EDF000
|
stack
|
page read and write
|
||
|
4B30000
|
trusted library allocation
|
page read and write
|
||
|
DA1000
|
heap
|
page read and write
|
||
|
D51000
|
heap
|
page read and write
|
||
|
D10000
|
heap
|
page read and write
|
||
|
2897000
|
heap
|
page read and write
|
||
|
451F000
|
stack
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
4EC1000
|
trusted library allocation
|
page read and write
|
||
|
AE3000
|
unkown
|
page execute and write copy
|
||
|
916000
|
unkown
|
page execute and write copy
|
||
|
315E000
|
stack
|
page read and write
|
||
|
B49000
|
unkown
|
page execute and write copy
|
||
|
325F000
|
stack
|
page read and write
|
||
|
299F000
|
stack
|
page read and write
|
||
|
AE5000
|
unkown
|
page execute and write copy
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
AD9000
|
unkown
|
page execute and read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
3D9F000
|
stack
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
A99000
|
unkown
|
page execute and write copy
|
||
|
365E000
|
stack
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
375F000
|
stack
|
page read and write
|
||
|
747E000
|
stack
|
page read and write
|
||
|
272E000
|
stack
|
page read and write
|
||
|
D1A000
|
heap
|
page read and write
|
||
|
4CD7000
|
trusted library allocation
|
page execute and read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
49F1000
|
heap
|
page read and write
|
||
|
4BC0000
|
heap
|
page read and write
|
||
|
A97000
|
unkown
|
page execute and read and write
|
||
|
4CDB000
|
trusted library allocation
|
page execute and read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
401F000
|
stack
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
33DE000
|
stack
|
page read and write
|
||
|
90A000
|
unkown
|
page execute and write copy
|
||
|
4E50000
|
trusted library allocation
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
2880000
|
heap
|
page read and write
|
||
|
B30000
|
unkown
|
page execute and write copy
|
||
|
BAC000
|
unkown
|
page execute and read and write
|
||
|
3B1F000
|
stack
|
page read and write
|
||
|
D1E000
|
heap
|
page read and write
|
||
|
AC0000
|
unkown
|
page execute and write copy
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
419E000
|
stack
|
page read and write
|
||
|
709D000
|
stack
|
page read and write
|
||
|
B3C000
|
unkown
|
page execute and read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
4AF0000
|
heap
|
page read and write
|
||
|
ACC000
|
unkown
|
page execute and write copy
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
D6D000
|
heap
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
3C9E000
|
stack
|
page read and write
|
||
|
906000
|
unkown
|
page write copy
|
||
|
4CCE000
|
stack
|
page read and write
|
||
|
8F9000
|
stack
|
page read and write
|
||
|
4CF0000
|
trusted library allocation
|
page read and write
|
||
|
A76000
|
unkown
|
page execute and write copy
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
900000
|
unkown
|
page read and write
|
||
|
49F0000
|
heap
|
page read and write
|
||
|
4BA4000
|
trusted library allocation
|
page read and write
|
||
|
A92000
|
unkown
|
page execute and write copy
|
||
|
455E000
|
stack
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
AF6000
|
unkown
|
page execute and write copy
|
||
|
4A00000
|
heap
|
page read and write
|
||
|
70DE000
|
stack
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
B21000
|
unkown
|
page execute and read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
3B5E000
|
stack
|
page read and write
|
||
|
2C5E000
|
stack
|
page read and write
|
||
|
AD7000
|
unkown
|
page execute and read and write
|
||
|
5EC4000
|
trusted library allocation
|
page read and write
|
||
|
D58000
|
heap
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
B1A000
|
unkown
|
page execute and read and write
|
||
|
39DF000
|
stack
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
F4E000
|
stack
|
page read and write
|
||
|
AE8000
|
unkown
|
page execute and read and write
|
||
|
4B93000
|
trusted library allocation
|
page execute and read and write
|
||
|
2E9F000
|
stack
|
page read and write
|
||
|
2ADF000
|
stack
|
page read and write
|
||
|
AC1000
|
unkown
|
page execute and read and write
|
||
|
429F000
|
stack
|
page read and write
|
||
|
4BBA000
|
trusted library allocation
|
page execute and read and write
|
||
|
CC0000
|
heap
|
page read and write
|
||
|
737E000
|
stack
|
page read and write
|
||
|
2EDE000
|
stack
|
page read and write
|
||
|
BAE000
|
unkown
|
page execute and write copy
|
||
|
A9B000
|
unkown
|
page execute and read and write
|
||
|
B13000
|
unkown
|
page execute and read and write
|
||
|
4BB0000
|
trusted library allocation
|
page read and write
|
||
|
361F000
|
stack
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
2D5F000
|
stack
|
page read and write
|
||
|
A92000
|
unkown
|
page execute and read and write
|
||
|
2C1F000
|
stack
|
page read and write
|
||
|
BAE000
|
unkown
|
page execute and write copy
|
||
|
B02000
|
unkown
|
page execute and read and write
|
||
|
2890000
|
heap
|
page read and write
|
||
|
49C0000
|
direct allocation
|
page read and write
|
||
|
902000
|
unkown
|
page execute and read and write
|
||
|
AC4000
|
unkown
|
page execute and read and write
|
||
|
B4A000
|
unkown
|
page execute and read and write
|
||
|
351E000
|
stack
|
page read and write
|
||
|
282F000
|
stack
|
page read and write
|
||
|
AD8000
|
unkown
|
page execute and write copy
|
||
|
379E000
|
stack
|
page read and write
|
||
|
4BA0000
|
trusted library allocation
|
page read and write
|
||
|
A74000
|
unkown
|
page execute and read and write
|
||
|
B10000
|
unkown
|
page execute and write copy
|
||
|
3C5F000
|
stack
|
page read and write
|
||
|
BAC000
|
unkown
|
page execute and write copy
|
||
|
3A1E000
|
stack
|
page read and write
|
||
|
B9D000
|
unkown
|
page execute and write copy
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
405E000
|
stack
|
page read and write
|
||
|
415F000
|
stack
|
page read and write
|
||
|
49F1000
|
heap
|
page read and write
|
||
|
4AF0000
|
trusted library allocation
|
page read and write
|
||
|
2B1E000
|
stack
|
page read and write
|
||
|
AF9000
|
unkown
|
page execute and read and write
|
||
|
B9D000
|
unkown
|
page execute and write copy
|
||
|
4B7C000
|
stack
|
page read and write
|
||
|
2D9E000
|
stack
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
4B9D000
|
trusted library allocation
|
page execute and read and write
|
||
|
4B94000
|
trusted library allocation
|
page read and write
|
||
|
6F9C000
|
stack
|
page read and write
|
||
|
4A04000
|
heap
|
page read and write
|
||
|
38DE000
|
stack
|
page read and write
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
906000
|
unkown
|
page write copy
|
||
|
71FE000
|
stack
|
page read and write
|
||
|
AA7000
|
unkown
|
page execute and write copy
|
||
|
723E000
|
stack
|
page read and write
|
||
|
AFA000
|
unkown
|
page execute and write copy
|
||
|
4E3F000
|
stack
|
page read and write
|
||
|
BE0000
|
heap
|
page read and write
|
||
|
B94000
|
unkown
|
page execute and write copy
|
||
|
CD4000
|
heap
|
page read and write
|
||
|
339F000
|
stack
|
page read and write
|
||
|
3F1E000
|
stack
|
page read and write
|
||
|
733E000
|
stack
|
page read and write
|
||
|
AE4000
|
unkown
|
page execute and read and write
|
||
|
B3A000
|
unkown
|
page execute and write copy
|
||
|
49F1000
|
heap
|
page read and write
|
||
|
E4E000
|
stack
|
page read and write
|
||
|
4EB0000
|
heap
|
page read and write
|
||
|
902000
|
unkown
|
page execute and write copy
|
||
|
4E40000
|
trusted library allocation
|
page execute and read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
287E000
|
stack
|
page read and write
|
||
|
4D3E000
|
stack
|
page read and write
|
||
|
49F1000
|
heap
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
||
|
4B40000
|
direct allocation
|
page read and write
|
||
|
49E0000
|
direct allocation
|
page read and write
|
There are 196 hidden memdumps, click here to show them.