Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
4D0E000
|
stack
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
123C000
|
stack
|
page read and write
|
||
|
B90000
|
unkown
|
page read and write
|
||
|
378F000
|
stack
|
page read and write
|
||
|
56DE000
|
stack
|
page read and write
|
||
|
51AA000
|
heap
|
page read and write
|
||
|
56E1000
|
trusted library allocation
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
468F000
|
stack
|
page read and write
|
||
|
B92000
|
unkown
|
page execute and write copy
|
||
|
42CF000
|
stack
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
41CE000
|
stack
|
page read and write
|
||
|
15AD000
|
heap
|
page read and write
|
||
|
4B8F000
|
stack
|
page read and write
|
||
|
480E000
|
stack
|
page read and write
|
||
|
404F000
|
stack
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
174F000
|
stack
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
4E0F000
|
stack
|
page read and write
|
||
|
3F4E000
|
stack
|
page read and write
|
||
|
340E000
|
stack
|
page read and write
|
||
|
4A8E000
|
stack
|
page read and write
|
||
|
15A0000
|
heap
|
page read and write
|
||
|
3DCF000
|
stack
|
page read and write
|
||
|
52F0000
|
direct allocation
|
page execute and read and write
|
||
|
52F0000
|
trusted library allocation
|
page read and write
|
||
|
13DE000
|
stack
|
page read and write
|
||
|
7ADE000
|
stack
|
page read and write
|
||
|
155A000
|
heap
|
page read and write
|
||
|
364F000
|
stack
|
page read and write
|
||
|
5160000
|
heap
|
page read and write
|
||
|
5470000
|
trusted library allocation
|
page read and write
|
||
|
77E0000
|
trusted library allocation
|
page read and write
|
||
|
54D0000
|
heap
|
page read and write
|
||
|
66E1000
|
trusted library allocation
|
page read and write
|
||
|
789E000
|
stack
|
page read and write
|
||
|
E2A000
|
unkown
|
page execute and read and write
|
||
|
52B0000
|
trusted library allocation
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
46CE000
|
stack
|
page read and write
|
||
|
3A4E000
|
stack
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
454F000
|
stack
|
page read and write
|
||
|
785E000
|
stack
|
page read and write
|
||
|
FDF000
|
unkown
|
page execute and write copy
|
||
|
FDC000
|
unkown
|
page execute and read and write
|
||
|
52CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
5457000
|
trusted library allocation
|
page execute and read and write
|
||
|
3E0E000
|
stack
|
page read and write
|
||
|
6705000
|
trusted library allocation
|
page read and write
|
||
|
5290000
|
trusted library allocation
|
page read and write
|
||
|
E3A000
|
unkown
|
page execute and read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
3B4F000
|
stack
|
page read and write
|
||
|
1520000
|
heap
|
page read and write
|
||
|
3F0F000
|
stack
|
page read and write
|
||
|
328F000
|
stack
|
page read and write
|
||
|
544E000
|
stack
|
page read and write
|
||
|
440F000
|
stack
|
page read and write
|
||
|
141E000
|
stack
|
page read and write
|
||
|
52FA000
|
trusted library allocation
|
page execute and read and write
|
||
|
444E000
|
stack
|
page read and write
|
||
|
1430000
|
heap
|
page read and write
|
||
|
1550000
|
heap
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
55C0000
|
trusted library allocation
|
page read and write
|
||
|
4A4F000
|
stack
|
page read and write
|
||
|
54BE000
|
stack
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
78D0000
|
heap
|
page execute and read and write
|
||
|
52E0000
|
direct allocation
|
page read and write
|
||
|
314F000
|
stack
|
page read and write
|
||
|
52E0000
|
direct allocation
|
page read and write
|
||
|
418F000
|
stack
|
page read and write
|
||
|
52E0000
|
direct allocation
|
page read and write
|
||
|
302E000
|
stack
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
FDF000
|
unkown
|
page execute and write copy
|
||
|
5450000
|
trusted library allocation
|
page read and write
|
||
|
54C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
494E000
|
stack
|
page read and write
|
||
|
D17000
|
unkown
|
page execute and read and write
|
||
|
158F000
|
heap
|
page read and write
|
||
|
B96000
|
unkown
|
page write copy
|
||
|
E3B000
|
unkown
|
page execute and write copy
|
||
|
5191000
|
heap
|
page read and write
|
||
|
37CE000
|
stack
|
page read and write
|
||
|
3C8F000
|
stack
|
page read and write
|
||
|
32CE000
|
stack
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
3CCE000
|
stack
|
page read and write
|
||
|
52D0000
|
trusted library allocation
|
page read and write
|
||
|
3A0F000
|
stack
|
page read and write
|
||
|
490F000
|
stack
|
page read and write
|
||
|
318B000
|
stack
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
3B8E000
|
stack
|
page read and write
|
||
|
B96000
|
unkown
|
page write copy
|
||
|
66E4000
|
trusted library allocation
|
page read and write
|
||
|
1435000
|
heap
|
page read and write
|
||
|
534B000
|
stack
|
page read and write
|
||
|
184E000
|
stack
|
page read and write
|
||
|
5470000
|
direct allocation
|
page execute and read and write
|
||
|
52C4000
|
trusted library allocation
|
page read and write
|
||
|
52C3000
|
trusted library allocation
|
page execute and read and write
|
||
|
55BC000
|
stack
|
page read and write
|
||
|
155E000
|
heap
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
33CF000
|
stack
|
page read and write
|
||
|
4BCE000
|
stack
|
page read and write
|
||
|
1339000
|
stack
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
B92000
|
unkown
|
page execute and read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
77DD000
|
stack
|
page read and write
|
||
|
B90000
|
unkown
|
page readonly
|
||
|
3030000
|
direct allocation
|
page read and write
|
||
|
368E000
|
stack
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
3040000
|
heap
|
page read and write
|
||
|
47CF000
|
stack
|
page read and write
|
||
|
55D0000
|
heap
|
page execute and read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
B9A000
|
unkown
|
page execute and read and write
|
||
|
354E000
|
stack
|
page read and write
|
||
|
38CF000
|
stack
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
52D4000
|
trusted library allocation
|
page read and write
|
||
|
5180000
|
direct allocation
|
page read and write
|
||
|
3047000
|
heap
|
page read and write
|
||
|
458E000
|
stack
|
page read and write
|
||
|
781E000
|
stack
|
page read and write
|
||
|
430E000
|
stack
|
page read and write
|
||
|
390E000
|
stack
|
page read and write
|
||
|
5191000
|
heap
|
page read and write
|
||
|
E3A000
|
unkown
|
page execute and write copy
|
||
|
1360000
|
heap
|
page read and write
|
||
|
1370000
|
heap
|
page read and write
|
||
|
7BDE000
|
stack
|
page read and write
|
||
|
1599000
|
heap
|
page read and write
|
||
|
79DE000
|
stack
|
page read and write
|
||
|
4CCF000
|
stack
|
page read and write
|
||
|
5190000
|
heap
|
page read and write
|
||
|
1591000
|
heap
|
page read and write
|
||
|
545B000
|
trusted library allocation
|
page execute and read and write
|
||
|
350F000
|
stack
|
page read and write
|
||
|
408E000
|
stack
|
page read and write
|
||
|
5300000
|
heap
|
page read and write
|
There are 149 hidden memdumps, click here to show them.