Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
341E000
|
stack
|
page read and write
|
||
|
2C5F000
|
stack
|
page read and write
|
||
|
379F000
|
stack
|
page read and write
|
||
|
DB0000
|
heap
|
page read and write
|
||
|
3A5E000
|
stack
|
page read and write
|
||
|
405F000
|
stack
|
page read and write
|
||
|
260000
|
unkown
|
page readonly
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
262000
|
unkown
|
page execute and write copy
|
||
|
4A10000
|
trusted library allocation
|
page read and write
|
||
|
38DF000
|
stack
|
page read and write
|
||
|
4BBB000
|
trusted library allocation
|
page execute and read and write
|
||
|
41DE000
|
stack
|
page read and write
|
||
|
6F8E000
|
stack
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
3F5E000
|
stack
|
page read and write
|
||
|
515000
|
unkown
|
page execute and write copy
|
||
|
48D1000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
2957000
|
heap
|
page read and write
|
||
|
48D1000
|
heap
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
6BC000
|
unkown
|
page execute and read and write
|
||
|
6F90000
|
heap
|
page execute and read and write
|
||
|
4B7D000
|
trusted library allocation
|
page execute and read and write
|
||
|
514000
|
unkown
|
page execute and read and write
|
||
|
C8E000
|
stack
|
page read and write
|
||
|
D7C000
|
heap
|
page read and write
|
||
|
3A1F000
|
stack
|
page read and write
|
||
|
2EDF000
|
stack
|
page read and write
|
||
|
C00000
|
heap
|
page read and write
|
||
|
305E000
|
stack
|
page read and write
|
||
|
2F1E000
|
stack
|
page read and write
|
||
|
D2E000
|
heap
|
page read and write
|
||
|
D70000
|
heap
|
page read and write
|
||
|
2B5F000
|
stack
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
4A5B000
|
stack
|
page read and write
|
||
|
431E000
|
stack
|
page read and write
|
||
|
4CD0000
|
heap
|
page execute and read and write
|
||
|
419F000
|
stack
|
page read and write
|
||
|
BF0000
|
heap
|
page read and write
|
||
|
409E000
|
stack
|
page read and write
|
||
|
70DE000
|
stack
|
page read and write
|
||
|
CCE000
|
stack
|
page read and write
|
||
|
4A20000
|
direct allocation
|
page read and write
|
||
|
709F000
|
stack
|
page read and write
|
||
|
F1E000
|
stack
|
page read and write
|
||
|
4BAA000
|
trusted library allocation
|
page execute and read and write
|
||
|
2950000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
4E11000
|
trusted library allocation
|
page read and write
|
||
|
4D00000
|
heap
|
page read and write
|
||
|
D5E000
|
heap
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
455F000
|
stack
|
page read and write
|
||
|
441F000
|
stack
|
page read and write
|
||
|
721E000
|
stack
|
page read and write
|
||
|
4BA0000
|
trusted library allocation
|
page read and write
|
||
|
3B5F000
|
stack
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
315F000
|
stack
|
page read and write
|
||
|
2C9E000
|
stack
|
page read and write
|
||
|
4B73000
|
trusted library allocation
|
page execute and read and write
|
||
|
2DDE000
|
stack
|
page read and write
|
||
|
4B90000
|
trusted library allocation
|
page read and write
|
||
|
355E000
|
stack
|
page read and write
|
||
|
266000
|
unkown
|
page write copy
|
||
|
C04000
|
heap
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
3FC000
|
unkown
|
page execute and read and write
|
||
|
4B74000
|
trusted library allocation
|
page read and write
|
||
|
3C9F000
|
stack
|
page read and write
|
||
|
4CE0000
|
trusted library allocation
|
page read and write
|
||
|
6E4C000
|
stack
|
page read and write
|
||
|
365F000
|
stack
|
page read and write
|
||
|
D2A000
|
heap
|
page read and write
|
||
|
329F000
|
stack
|
page read and write
|
||
|
4BD0000
|
trusted library allocation
|
page read and write
|
||
|
5E14000
|
trusted library allocation
|
page read and write
|
||
|
49D0000
|
heap
|
page read and write
|
||
|
28BF000
|
stack
|
page read and write
|
||
|
D60000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
D20000
|
heap
|
page read and write
|
||
|
260000
|
unkown
|
page read and write
|
||
|
3F1F000
|
stack
|
page read and write
|
||
|
D0B000
|
stack
|
page read and write
|
||
|
4BB7000
|
trusted library allocation
|
page execute and read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
7C0000
|
heap
|
page read and write
|
||
|
C4D000
|
stack
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
4B94000
|
trusted library allocation
|
page read and write
|
||
|
2A5F000
|
stack
|
page read and write
|
||
|
4B80000
|
heap
|
page read and write
|
||
|
369E000
|
stack
|
page read and write
|
||
|
AF9000
|
stack
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
3CDE000
|
stack
|
page read and write
|
||
|
4BB0000
|
trusted library allocation
|
page read and write
|
||
|
5E35000
|
trusted library allocation
|
page read and write
|
||
|
101E000
|
stack
|
page read and write
|
||
|
3DDF000
|
stack
|
page read and write
|
||
|
319E000
|
stack
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
2D9F000
|
stack
|
page read and write
|
||
|
4E0F000
|
stack
|
page read and write
|
||
|
3B9E000
|
stack
|
page read and write
|
||
|
504000
|
unkown
|
page execute and read and write
|
||
|
266000
|
unkown
|
page write copy
|
||
|
32DE000
|
stack
|
page read and write
|
||
|
28FE000
|
stack
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
26A000
|
unkown
|
page execute and read and write
|
||
|
48E0000
|
heap
|
page read and write
|
||
|
42DF000
|
stack
|
page read and write
|
||
|
293E000
|
stack
|
page read and write
|
||
|
48A0000
|
direct allocation
|
page read and write
|
||
|
4B70000
|
direct allocation
|
page execute and read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
49D0000
|
trusted library allocation
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
731F000
|
stack
|
page read and write
|
||
|
48D1000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
514000
|
unkown
|
page execute and write copy
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
48D1000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
4A20000
|
direct allocation
|
page read and write
|
||
|
6F4D000
|
stack
|
page read and write
|
||
|
301F000
|
stack
|
page read and write
|
||
|
48C0000
|
direct allocation
|
page read and write
|
||
|
48D1000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
4CF0000
|
trusted library allocation
|
page read and write
|
||
|
75C000
|
stack
|
page read and write
|
||
|
4BB0000
|
direct allocation
|
page execute and read and write
|
||
|
48D0000
|
heap
|
page read and write
|
||
|
71DE000
|
stack
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
4CC0000
|
trusted library allocation
|
page execute and read and write
|
||
|
37DE000
|
stack
|
page read and write
|
||
|
4A20000
|
direct allocation
|
page read and write
|
||
|
445E000
|
stack
|
page read and write
|
||
|
C04000
|
heap
|
page read and write
|
||
|
4C1E000
|
stack
|
page read and write
|
||
|
4B5E000
|
stack
|
page read and write
|
||
|
D68000
|
heap
|
page read and write
|
||
|
7D0000
|
heap
|
page read and write
|
||
|
3E1E000
|
stack
|
page read and write
|
||
|
391E000
|
stack
|
page read and write
|
||
|
262000
|
unkown
|
page execute and read and write
|
||
|
33DF000
|
stack
|
page read and write
|
||
|
48D1000
|
heap
|
page read and write
|
||
|
5E11000
|
trusted library allocation
|
page read and write
|
||
|
351F000
|
stack
|
page read and write
|
There are 155 hidden memdumps, click here to show them.