Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2EBF000
|
stack
|
page read and write
|
||
|
4B41000
|
heap
|
page read and write
|
||
|
71DD000
|
stack
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
834000
|
unkown
|
page execute and write copy
|
||
|
2A77000
|
heap
|
page read and write
|
||
|
672000
|
unkown
|
page execute and write copy
|
||
|
417F000
|
stack
|
page read and write
|
||
|
886000
|
unkown
|
page execute and read and write
|
||
|
91C000
|
unkown
|
page execute and write copy
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
676000
|
unkown
|
page write copy
|
||
|
4F80000
|
heap
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
4DDF000
|
stack
|
page read and write
|
||
|
43FF000
|
stack
|
page read and write
|
||
|
672000
|
unkown
|
page execute and read and write
|
||
|
2A4E000
|
stack
|
page read and write
|
||
|
67A000
|
unkown
|
page execute and write copy
|
||
|
3F3E000
|
stack
|
page read and write
|
||
|
2A0C000
|
stack
|
page read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
860000
|
unkown
|
page execute and write copy
|
||
|
E44000
|
heap
|
page read and write
|
||
|
47BF000
|
stack
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
4CDC000
|
stack
|
page read and write
|
||
|
303E000
|
stack
|
page read and write
|
||
|
861000
|
unkown
|
page execute and read and write
|
||
|
3DFE000
|
stack
|
page read and write
|
||
|
804000
|
unkown
|
page execute and read and write
|
||
|
670000
|
unkown
|
page readonly
|
||
|
4E2B000
|
trusted library allocation
|
page execute and read and write
|
||
|
377F000
|
stack
|
page read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
736E000
|
stack
|
page read and write
|
||
|
88F000
|
unkown
|
page execute and read and write
|
||
|
8BF000
|
unkown
|
page execute and read and write
|
||
|
863000
|
unkown
|
page execute and write copy
|
||
|
E44000
|
heap
|
page read and write
|
||
|
4F70000
|
trusted library allocation
|
page execute and read and write
|
||
|
822000
|
unkown
|
page execute and write copy
|
||
|
407E000
|
stack
|
page read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
7220000
|
heap
|
page execute and read and write
|
||
|
2FFF000
|
stack
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
367E000
|
stack
|
page read and write
|
||
|
FA0000
|
heap
|
page read and write
|
||
|
2C7F000
|
stack
|
page read and write
|
||
|
9CC000
|
stack
|
page read and write
|
||
|
443E000
|
stack
|
page read and write
|
||
|
74AE000
|
stack
|
page read and write
|
||
|
F8F000
|
stack
|
page read and write
|
||
|
890000
|
unkown
|
page execute and write copy
|
||
|
3EFE000
|
stack
|
page read and write
|
||
|
882000
|
unkown
|
page execute and write copy
|
||
|
4B40000
|
heap
|
page read and write
|
||
|
50D0000
|
heap
|
page execute and read and write
|
||
|
FF1000
|
heap
|
page read and write
|
||
|
50E1000
|
trusted library allocation
|
page read and write
|
||
|
922000
|
unkown
|
page execute and write copy
|
||
|
4F6C000
|
stack
|
page read and write
|
||
|
34FF000
|
stack
|
page read and write
|
||
|
FE1000
|
heap
|
page read and write
|
||
|
4E27000
|
trusted library allocation
|
page execute and read and write
|
||
|
363F000
|
stack
|
page read and write
|
||
|
721E000
|
stack
|
page read and write
|
||
|
887000
|
unkown
|
page execute and write copy
|
||
|
83D000
|
unkown
|
page execute and write copy
|
||
|
8AC000
|
unkown
|
page execute and write copy
|
||
|
8BB000
|
unkown
|
page execute and write copy
|
||
|
42FE000
|
stack
|
page read and write
|
||
|
932000
|
unkown
|
page execute and read and write
|
||
|
4E20000
|
trusted library allocation
|
page read and write
|
||
|
508E000
|
stack
|
page read and write
|
||
|
4B50000
|
heap
|
page read and write
|
||
|
457E000
|
stack
|
page read and write
|
||
|
39FF000
|
stack
|
page read and write
|
||
|
317E000
|
stack
|
page read and write
|
||
|
4E20000
|
direct allocation
|
page execute and read and write
|
||
|
467F000
|
stack
|
page read and write
|
||
|
FE9000
|
heap
|
page read and write
|
||
|
46BE000
|
stack
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
33FE000
|
stack
|
page read and write
|
||
|
4E00000
|
trusted library allocation
|
page read and write
|
||
|
1032000
|
heap
|
page read and write
|
||
|
2D7F000
|
stack
|
page read and write
|
||
|
E40000
|
heap
|
page read and write
|
||
|
80C000
|
unkown
|
page execute and read and write
|
||
|
3B3F000
|
stack
|
page read and write
|
||
|
3A3E000
|
stack
|
page read and write
|
||
|
4DF4000
|
trusted library allocation
|
page read and write
|
||
|
50A0000
|
trusted library allocation
|
page read and write
|
||
|
11DF000
|
stack
|
page read and write
|
||
|
2B7F000
|
stack
|
page read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
33BF000
|
stack
|
page read and write
|
||
|
4C50000
|
heap
|
page read and write
|
||
|
41BE000
|
stack
|
page read and write
|
||
|
4CA0000
|
direct allocation
|
page read and write
|
||
|
FDF000
|
heap
|
page read and write
|
||
|
854000
|
unkown
|
page execute and read and write
|
||
|
FFE000
|
heap
|
page read and write
|
||
|
67A000
|
unkown
|
page execute and read and write
|
||
|
89C000
|
unkown
|
page execute and read and write
|
||
|
FAA000
|
heap
|
page read and write
|
||
|
327F000
|
stack
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
29CE000
|
stack
|
page read and write
|
||
|
2DBE000
|
stack
|
page read and write
|
||
|
87A000
|
unkown
|
page execute and read and write
|
||
|
4C90000
|
trusted library allocation
|
page read and write
|
||
|
4E1A000
|
trusted library allocation
|
page execute and read and write
|
||
|
8E2000
|
unkown
|
page execute and read and write
|
||
|
4B10000
|
direct allocation
|
page read and write
|
||
|
FC3000
|
heap
|
page read and write
|
||
|
3B7E000
|
stack
|
page read and write
|
||
|
89A000
|
unkown
|
page execute and write copy
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
10DE000
|
stack
|
page read and write
|
||
|
8AB000
|
unkown
|
page execute and read and write
|
||
|
3C7F000
|
stack
|
page read and write
|
||
|
4B41000
|
heap
|
page read and write
|
||
|
83E000
|
unkown
|
page execute and read and write
|
||
|
38BF000
|
stack
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
801000
|
unkown
|
page execute and read and write
|
||
|
4C40000
|
trusted library allocation
|
page read and write
|
||
|
8AA000
|
unkown
|
page execute and write copy
|
||
|
2A70000
|
heap
|
page read and write
|
||
|
836000
|
unkown
|
page execute and read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
353E000
|
stack
|
page read and write
|
||
|
8E1000
|
unkown
|
page execute and write copy
|
||
|
4CA0000
|
direct allocation
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
875000
|
unkown
|
page execute and write copy
|
||
|
922000
|
unkown
|
page execute and write copy
|
||
|
934000
|
unkown
|
page execute and write copy
|
||
|
2EFE000
|
stack
|
page read and write
|
||
|
4DF3000
|
trusted library allocation
|
page execute and read and write
|
||
|
3CBE000
|
stack
|
page read and write
|
||
|
75AE000
|
stack
|
page read and write
|
||
|
E10000
|
heap
|
page read and write
|
||
|
686000
|
unkown
|
page execute and write copy
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
934000
|
unkown
|
page execute and write copy
|
||
|
E44000
|
heap
|
page read and write
|
||
|
CF9000
|
stack
|
page read and write
|
||
|
453F000
|
stack
|
page read and write
|
||
|
60E1000
|
trusted library allocation
|
page read and write
|
||
|
4DF0000
|
direct allocation
|
page execute and read and write
|
||
|
676000
|
unkown
|
page write copy
|
||
|
3DBF000
|
stack
|
page read and write
|
||
|
1030000
|
heap
|
page read and write
|
||
|
32BE000
|
stack
|
page read and write
|
||
|
7E8000
|
unkown
|
page execute and read and write
|
||
|
403F000
|
stack
|
page read and write
|
||
|
893000
|
unkown
|
page execute and read and write
|
||
|
4CA0000
|
direct allocation
|
page read and write
|
||
|
4B41000
|
heap
|
page read and write
|
||
|
4DFD000
|
trusted library allocation
|
page execute and read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
4B41000
|
heap
|
page read and write
|
||
|
866000
|
unkown
|
page execute and read and write
|
||
|
37BE000
|
stack
|
page read and write
|
||
|
932000
|
unkown
|
page execute and write copy
|
||
|
FAE000
|
heap
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
7EA000
|
unkown
|
page execute and write copy
|
||
|
4E04000
|
trusted library allocation
|
page read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
4E8E000
|
stack
|
page read and write
|
||
|
4E10000
|
trusted library allocation
|
page read and write
|
||
|
60E4000
|
trusted library allocation
|
page read and write
|
||
|
E8E000
|
stack
|
page read and write
|
||
|
4C40000
|
heap
|
page read and write
|
||
|
802000
|
unkown
|
page execute and write copy
|
||
|
732E000
|
stack
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
2A50000
|
heap
|
page read and write
|
||
|
746E000
|
stack
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
5090000
|
trusted library allocation
|
page read and write
|
||
|
6105000
|
trusted library allocation
|
page read and write
|
||
|
4B41000
|
heap
|
page read and write
|
||
|
80C000
|
unkown
|
page execute and write copy
|
||
|
841000
|
unkown
|
page execute and write copy
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
829000
|
unkown
|
page execute and read and write
|
||
|
670000
|
unkown
|
page read and write
|
||
|
4B30000
|
direct allocation
|
page read and write
|
||
|
E44000
|
heap
|
page read and write
|
||
|
8B5000
|
unkown
|
page execute and read and write
|
||
|
42BF000
|
stack
|
page read and write
|
||
|
38FE000
|
stack
|
page read and write
|
||
|
4E40000
|
trusted library allocation
|
page read and write
|
||
|
313F000
|
stack
|
page read and write
|
There are 196 hidden memdumps, click here to show them.