Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4A2B000
|
trusted library allocation
|
page execute and read and write
|
||
|
ABE000
|
stack
|
page read and write
|
||
|
A50000
|
heap
|
page read and write
|
||
|
5CF5000
|
trusted library allocation
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
6DAC000
|
stack
|
page read and write
|
||
|
5C8000
|
unkown
|
page execute and write copy
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
542000
|
unkown
|
page execute and read and write
|
||
|
4A1A000
|
trusted library allocation
|
page execute and read and write
|
||
|
2810000
|
heap
|
page read and write
|
||
|
401E000
|
stack
|
page read and write
|
||
|
49F4000
|
trusted library allocation
|
page read and write
|
||
|
4B6E000
|
stack
|
page read and write
|
||
|
6EC0000
|
trusted library allocation
|
page read and write
|
||
|
646000
|
unkown
|
page execute and write copy
|
||
|
4A50000
|
trusted library allocation
|
page execute and read and write
|
||
|
4BAE000
|
stack
|
page read and write
|
||
|
578000
|
unkown
|
page execute and write copy
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
57E000
|
unkown
|
page execute and read and write
|
||
|
5D9000
|
unkown
|
page execute and write copy
|
||
|
635000
|
unkown
|
page execute and write copy
|
||
|
4851000
|
heap
|
page read and write
|
||
|
72BE000
|
stack
|
page read and write
|
||
|
311E000
|
stack
|
page read and write
|
||
|
5C5000
|
unkown
|
page execute and write copy
|
||
|
390000
|
unkown
|
page read and write
|
||
|
582000
|
unkown
|
page execute and read and write
|
||
|
644000
|
unkown
|
page execute and write copy
|
||
|
5B2000
|
unkown
|
page execute and read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
4990000
|
trusted library allocation
|
page read and write
|
||
|
5B6000
|
unkown
|
page execute and write copy
|
||
|
429E000
|
stack
|
page read and write
|
||
|
2E5F000
|
stack
|
page read and write
|
||
|
51A000
|
unkown
|
page execute and read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
F0E000
|
stack
|
page read and write
|
||
|
2FDE000
|
stack
|
page read and write
|
||
|
4860000
|
heap
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
AE0000
|
heap
|
page read and write
|
||
|
5CD1000
|
trusted library allocation
|
page read and write
|
||
|
392000
|
unkown
|
page execute and write copy
|
||
|
4A40000
|
trusted library allocation
|
page read and write
|
||
|
2A9F000
|
stack
|
page read and write
|
||
|
4870000
|
heap
|
page read and write
|
||
|
27EF000
|
stack
|
page read and write
|
||
|
AF0000
|
heap
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
3EDE000
|
stack
|
page read and write
|
||
|
2ADE000
|
stack
|
page read and write
|
||
|
6DC000
|
stack
|
page read and write
|
||
|
3E9F000
|
stack
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
530000
|
unkown
|
page execute and read and write
|
||
|
30DF000
|
stack
|
page read and write
|
||
|
5DA000
|
unkown
|
page execute and read and write
|
||
|
4950000
|
trusted library allocation
|
page read and write
|
||
|
57B000
|
unkown
|
page execute and write copy
|
||
|
4A20000
|
trusted library allocation
|
page read and write
|
||
|
506000
|
unkown
|
page execute and read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
4A10000
|
trusted library allocation
|
page read and write
|
||
|
B7D000
|
heap
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
4851000
|
heap
|
page read and write
|
||
|
2D1F000
|
stack
|
page read and write
|
||
|
3ADF000
|
stack
|
page read and write
|
||
|
4851000
|
heap
|
page read and write
|
||
|
56C000
|
unkown
|
page execute and read and write
|
||
|
425F000
|
stack
|
page read and write
|
||
|
49A0000
|
direct allocation
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
2D5E000
|
stack
|
page read and write
|
||
|
325E000
|
stack
|
page read and write
|
||
|
644000
|
unkown
|
page execute and read and write
|
||
|
5AF000
|
unkown
|
page execute and write copy
|
||
|
390000
|
unkown
|
page readonly
|
||
|
543000
|
unkown
|
page execute and write copy
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
339E000
|
stack
|
page read and write
|
||
|
2F9F000
|
stack
|
page read and write
|
||
|
321F000
|
stack
|
page read and write
|
||
|
3D5E000
|
stack
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
5BD000
|
unkown
|
page execute and read and write
|
||
|
625000
|
unkown
|
page execute and write copy
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
524000
|
unkown
|
page execute and write copy
|
||
|
5C7000
|
unkown
|
page execute and read and write
|
||
|
703E000
|
stack
|
page read and write
|
||
|
34DE000
|
stack
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
389E000
|
stack
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
49F0000
|
direct allocation
|
page execute and read and write
|
||
|
5CD4000
|
trusted library allocation
|
page read and write
|
||
|
4851000
|
heap
|
page read and write
|
||
|
62F000
|
unkown
|
page execute and write copy
|
||
|
3C1E000
|
stack
|
page read and write
|
||
|
4A04000
|
trusted library allocation
|
page read and write
|
||
|
39A000
|
unkown
|
page execute and read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
646000
|
unkown
|
page execute and write copy
|
||
|
49A0000
|
direct allocation
|
page read and write
|
||
|
B40000
|
heap
|
page read and write
|
||
|
411F000
|
stack
|
page read and write
|
||
|
299E000
|
stack
|
page read and write
|
||
|
4A27000
|
trusted library allocation
|
page execute and read and write
|
||
|
4851000
|
heap
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
396000
|
unkown
|
page write copy
|
||
|
707E000
|
stack
|
page read and write
|
||
|
2BDF000
|
stack
|
page read and write
|
||
|
635000
|
unkown
|
page execute and write copy
|
||
|
295F000
|
stack
|
page read and write
|
||
|
56B000
|
unkown
|
page execute and write copy
|
||
|
361E000
|
stack
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
593000
|
unkown
|
page execute and write copy
|
||
|
49A0000
|
direct allocation
|
page read and write
|
||
|
3A6000
|
unkown
|
page execute and write copy
|
||
|
4A20000
|
direct allocation
|
page execute and read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
5A8000
|
unkown
|
page execute and read and write
|
||
|
3FDF000
|
stack
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
524000
|
unkown
|
page execute and read and write
|
||
|
2817000
|
heap
|
page read and write
|
||
|
4CD1000
|
trusted library allocation
|
page read and write
|
||
|
39DE000
|
stack
|
page read and write
|
||
|
58C000
|
unkown
|
page execute and write copy
|
||
|
717E000
|
stack
|
page read and write
|
||
|
371F000
|
stack
|
page read and write
|
||
|
5A5000
|
unkown
|
page execute and write copy
|
||
|
4865000
|
heap
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
439F000
|
stack
|
page read and write
|
||
|
4A60000
|
heap
|
page read and write
|
||
|
335F000
|
stack
|
page read and write
|
||
|
43DE000
|
stack
|
page read and write
|
||
|
2E9E000
|
stack
|
page read and write
|
||
|
B9C000
|
heap
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
26EE000
|
stack
|
page read and write
|
||
|
385F000
|
stack
|
page read and write
|
||
|
597000
|
unkown
|
page execute and read and write
|
||
|
4820000
|
direct allocation
|
page read and write
|
||
|
6F30000
|
heap
|
page execute and read and write
|
||
|
44DF000
|
stack
|
page read and write
|
||
|
399F000
|
stack
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
56A000
|
unkown
|
page execute and read and write
|
||
|
626000
|
unkown
|
page execute and read and write
|
||
|
5CF000
|
unkown
|
page execute and read and write
|
||
|
3C5E000
|
stack
|
page read and write
|
||
|
392000
|
unkown
|
page execute and read and write
|
||
|
396000
|
unkown
|
page write copy
|
||
|
B4E000
|
heap
|
page read and write
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
592000
|
unkown
|
page execute and read and write
|
||
|
49F3000
|
trusted library allocation
|
page execute and read and write
|
||
|
B4A000
|
heap
|
page read and write
|
||
|
7D9000
|
stack
|
page read and write
|
||
|
6EAD000
|
stack
|
page read and write
|
||
|
3D9E000
|
stack
|
page read and write
|
||
|
415E000
|
stack
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
544000
|
unkown
|
page execute and read and write
|
||
|
4A00000
|
trusted library allocation
|
page read and write
|
||
|
508000
|
unkown
|
page execute and write copy
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
49FD000
|
trusted library allocation
|
page execute and read and write
|
||
|
285B000
|
stack
|
page read and write
|
||
|
6EFE000
|
stack
|
page read and write
|
||
|
54F000
|
unkown
|
page execute and write copy
|
||
|
52F000
|
unkown
|
page execute and write copy
|
||
|
2C1E000
|
stack
|
page read and write
|
||
|
4851000
|
heap
|
page read and write
|
||
|
39A000
|
unkown
|
page execute and write copy
|
||
|
375E000
|
stack
|
page read and write
|
||
|
5B5000
|
unkown
|
page execute and read and write
|
||
|
4CBE000
|
stack
|
page read and write
|
||
|
550000
|
unkown
|
page execute and read and write
|
||
|
B87000
|
heap
|
page read and write
|
||
|
556000
|
unkown
|
page execute and write copy
|
||
|
E0E000
|
stack
|
page read and write
|
||
|
6EB0000
|
trusted library allocation
|
page read and write
|
||
|
541000
|
unkown
|
page execute and write copy
|
||
|
AF4000
|
heap
|
page read and write
|
||
|
4851000
|
heap
|
page read and write
|
||
|
A40000
|
heap
|
page read and write
|
||
|
4BB0000
|
heap
|
page execute and read and write
|
||
|
3B1E000
|
stack
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
B7F000
|
heap
|
page read and write
|
||
|
B3E000
|
stack
|
page read and write
|
||
|
4950000
|
heap
|
page read and write
|
||
|
35DF000
|
stack
|
page read and write
|
||
|
5B3000
|
unkown
|
page execute and write copy
|
||
|
349F000
|
stack
|
page read and write
|
||
|
580000
|
unkown
|
page execute and write copy
|
||
|
71BE000
|
stack
|
page read and write
|
||
|
4850000
|
heap
|
page read and write
|
||
|
4840000
|
direct allocation
|
page read and write
|
||
|
57A000
|
unkown
|
page execute and read and write
|
||
|
49DC000
|
stack
|
page read and write
|
||
|
4CC0000
|
heap
|
page read and write
|
There are 202 hidden memdumps, click here to show them.