Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5400000
|
direct allocation
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
55C0000
|
trusted library allocation
|
page read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
58D1000
|
trusted library allocation
|
page read and write
|
||
|
55E0000
|
direct allocation
|
page execute and read and write
|
||
|
5560000
|
direct allocation
|
page read and write
|
||
|
55E0000
|
trusted library allocation
|
page read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
5543000
|
trusted library allocation
|
page execute and read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
7D6E000
|
stack
|
page read and write
|
||
|
405F000
|
stack
|
page read and write
|
||
|
55B0000
|
trusted library allocation
|
page read and write
|
||
|
5420000
|
heap
|
page read and write
|
||
|
FD6000
|
unkown
|
page write copy
|
||
|
1944000
|
heap
|
page read and write
|
||
|
127E000
|
unkown
|
page execute and write copy
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
18BE000
|
heap
|
page read and write
|
||
|
15DE000
|
stack
|
page read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
1912000
|
heap
|
page read and write
|
||
|
7E6E000
|
stack
|
page read and write
|
||
|
3B5F000
|
stack
|
page read and write
|
||
|
14B0000
|
heap
|
page read and write
|
||
|
5410000
|
heap
|
page read and write
|
||
|
55CB000
|
trusted library allocation
|
page execute and read and write
|
||
|
7AAE000
|
stack
|
page read and write
|
||
|
7BAF000
|
stack
|
page read and write
|
||
|
68D1000
|
trusted library allocation
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
187E000
|
stack
|
page read and write
|
||
|
F80000
|
heap
|
page read and write
|
||
|
5650000
|
heap
|
page read and write
|
||
|
46DE000
|
stack
|
page read and write
|
||
|
146E000
|
stack
|
page read and write
|
||
|
1422000
|
unkown
|
page execute and write copy
|
||
|
1424000
|
unkown
|
page execute and write copy
|
||
|
55B0000
|
direct allocation
|
page execute and read and write
|
||
|
F19000
|
stack
|
page read and write
|
||
|
18F0000
|
heap
|
page read and write
|
||
|
3490000
|
heap
|
page read and write
|
||
|
3B9E000
|
stack
|
page read and write
|
||
|
585E000
|
stack
|
page read and write
|
||
|
379F000
|
stack
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
589C000
|
stack
|
page read and write
|
||
|
18F9000
|
heap
|
page read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
554D000
|
trusted library allocation
|
page execute and read and write
|
||
|
58A0000
|
trusted library allocation
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
1902000
|
heap
|
page read and write
|
||
|
F90000
|
heap
|
page read and write
|
||
|
37DE000
|
stack
|
page read and write
|
||
|
3E1E000
|
stack
|
page read and write
|
||
|
127F000
|
unkown
|
page execute and write copy
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
FD6000
|
unkown
|
page write copy
|
||
|
5411000
|
heap
|
page read and write
|
||
|
FD2000
|
unkown
|
page execute and write copy
|
||
|
563E000
|
stack
|
page read and write
|
||
|
18F2000
|
heap
|
page read and write
|
||
|
5530000
|
trusted library allocation
|
page read and write
|
||
|
441F000
|
stack
|
page read and write
|
||
|
5544000
|
trusted library allocation
|
page read and write
|
||
|
419F000
|
stack
|
page read and write
|
||
|
391E000
|
stack
|
page read and write
|
||
|
7D2E000
|
stack
|
page read and write
|
||
|
1AAF000
|
stack
|
page read and write
|
||
|
455F000
|
stack
|
page read and write
|
||
|
445E000
|
stack
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
FD0000
|
unkown
|
page readonly
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
3A1F000
|
stack
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
5510000
|
trusted library allocation
|
page read and write
|
||
|
53E0000
|
heap
|
page read and write
|
||
|
4F9E000
|
stack
|
page read and write
|
||
|
4D1E000
|
stack
|
page read and write
|
||
|
FDA000
|
unkown
|
page execute and read and write
|
||
|
1BAE000
|
stack
|
page read and write
|
||
|
18B0000
|
heap
|
page read and write
|
||
|
68D4000
|
trusted library allocation
|
page read and write
|
||
|
3497000
|
heap
|
page read and write
|
||
|
348E000
|
stack
|
page read and write
|
||
|
3F1F000
|
stack
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
3A5E000
|
stack
|
page read and write
|
||
|
7C2E000
|
stack
|
page read and write
|
||
|
369F000
|
stack
|
page read and write
|
||
|
459E000
|
stack
|
page read and write
|
||
|
5640000
|
trusted library allocation
|
page execute and read and write
|
||
|
4A9E000
|
stack
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
5560000
|
direct allocation
|
page read and write
|
||
|
495E000
|
stack
|
page read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
58C0000
|
heap
|
page execute and read and write
|
||
|
14B5000
|
heap
|
page read and write
|
||
|
38DF000
|
stack
|
page read and write
|
||
|
431E000
|
stack
|
page read and write
|
||
|
3F5E000
|
stack
|
page read and write
|
||
|
47DF000
|
stack
|
page read and write
|
||
|
4B9F000
|
stack
|
page read and write
|
||
|
68F5000
|
trusted library allocation
|
page read and write
|
||
|
4E5E000
|
stack
|
page read and write
|
||
|
55C7000
|
trusted library allocation
|
page execute and read and write
|
||
|
1422000
|
unkown
|
page execute and read and write
|
||
|
1167000
|
unkown
|
page execute and read and write
|
||
|
509F000
|
stack
|
page read and write
|
||
|
3DDF000
|
stack
|
page read and write
|
||
|
18BA000
|
heap
|
page read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
FD0000
|
unkown
|
page read and write
|
||
|
559B000
|
stack
|
page read and write
|
||
|
4CDF000
|
stack
|
page read and write
|
||
|
5560000
|
direct allocation
|
page read and write
|
||
|
42DF000
|
stack
|
page read and write
|
||
|
1890000
|
direct allocation
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
4F5F000
|
stack
|
page read and write
|
||
|
7BE0000
|
heap
|
page execute and read and write
|
||
|
5400000
|
direct allocation
|
page read and write
|
||
|
4A5F000
|
stack
|
page read and write
|
||
|
4BDE000
|
stack
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
127E000
|
unkown
|
page execute and read and write
|
||
|
41DE000
|
stack
|
page read and write
|
||
|
409E000
|
stack
|
page read and write
|
||
|
344F000
|
stack
|
page read and write
|
||
|
14AD000
|
stack
|
page read and write
|
||
|
5554000
|
trusted library allocation
|
page read and write
|
||
|
359F000
|
stack
|
page read and write
|
||
|
575E000
|
stack
|
page read and write
|
||
|
7A6D000
|
stack
|
page read and write
|
||
|
5550000
|
trusted library allocation
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
E1C000
|
stack
|
page read and write
|
||
|
FD2000
|
unkown
|
page execute and read and write
|
||
|
491F000
|
stack
|
page read and write
|
||
|
3C9F000
|
stack
|
page read and write
|
||
|
3CDE000
|
stack
|
page read and write
|
||
|
481E000
|
stack
|
page read and write
|
||
|
55F0000
|
heap
|
page read and write
|
||
|
4E1F000
|
stack
|
page read and write
|
||
|
469F000
|
stack
|
page read and write
|
||
|
15E0000
|
heap
|
page read and write
|
||
|
126E000
|
unkown
|
page execute and read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
183B000
|
stack
|
page read and write
|
||
|
55BA000
|
trusted library allocation
|
page execute and read and write
|
||
|
58B0000
|
trusted library allocation
|
page read and write
|
||
|
5411000
|
heap
|
page read and write
|
||
|
1424000
|
unkown
|
page execute and write copy
|
||
|
5400000
|
direct allocation
|
page read and write
|
There are 151 hidden memdumps, click here to show them.