Files
File Path
|
Type
|
Category
|
Malicious
|
|
---|---|---|---|---|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
||
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
Processes
Path
|
Cmdline
|
Malicious
|
|
---|---|---|---|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
Registry
Path
|
Value
|
Malicious
|
|
---|---|---|---|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
||
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
---|---|---|---|---|
5290000
|
direct allocation
|
page read and write
|
||
C20000
|
unkown
|
page read and write
|
||
53F0000
|
direct allocation
|
page read and write
|
||
79BE000
|
stack
|
page read and write
|
||
16C1000
|
heap
|
page read and write
|
||
78FD000
|
stack
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
EC1000
|
unkown
|
page execute and read and write
|
||
793E000
|
stack
|
page read and write
|
||
418E000
|
stack
|
page read and write
|
||
3A0E000
|
stack
|
page read and write
|
||
DB7000
|
unkown
|
page execute and read and write
|
||
544A000
|
trusted library allocation
|
page execute and read and write
|
||
ED1000
|
unkown
|
page execute and write copy
|
||
4A4E000
|
stack
|
page read and write
|
||
7A10000
|
heap
|
page execute and read and write
|
||
54BE000
|
stack
|
page read and write
|
||
6764000
|
trusted library allocation
|
page read and write
|
||
7B1E000
|
stack
|
page read and write
|
||
374F000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
573C000
|
stack
|
page read and write
|
||
53E0000
|
trusted library allocation
|
page read and write
|
||
197F000
|
stack
|
page read and write
|
||
C2A000
|
unkown
|
page execute and read and write
|
||
52A1000
|
heap
|
page read and write
|
||
53DD000
|
trusted library allocation
|
page execute and read and write
|
||
450F000
|
stack
|
page read and write
|
||
428F000
|
stack
|
page read and write
|
||
14F9000
|
stack
|
page read and write
|
||
478F000
|
stack
|
page read and write
|
||
364E000
|
stack
|
page read and write
|
||
4DCF000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
3F0E000
|
stack
|
page read and write
|
||
4E0E000
|
stack
|
page read and write
|
||
3B4E000
|
stack
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
1670000
|
heap
|
page read and write
|
||
1076000
|
unkown
|
page execute and write copy
|
||
5450000
|
trusted library allocation
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
1170000
|
heap
|
page read and write
|
||
797E000
|
stack
|
page read and write
|
||
5250000
|
direct allocation
|
page read and write
|
||
4F0F000
|
stack
|
page read and write
|
||
47CE000
|
stack
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
32C7000
|
heap
|
page read and write
|
||
54E0000
|
heap
|
page read and write
|
||
3ECF000
|
stack
|
page read and write
|
||
1680000
|
heap
|
page read and write
|
||
1620000
|
heap
|
page read and write
|
||
56F0000
|
heap
|
page execute and read and write
|
||
5270000
|
heap
|
page read and write
|
||
43CF000
|
stack
|
page read and write
|
||
5457000
|
trusted library allocation
|
page execute and read and write
|
||
5740000
|
trusted library allocation
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
542B000
|
stack
|
page read and write
|
||
56EE000
|
stack
|
page read and write
|
||
53E4000
|
trusted library allocation
|
page read and write
|
||
1078000
|
unkown
|
page execute and write copy
|
||
52A1000
|
heap
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
321F000
|
stack
|
page read and write
|
||
5750000
|
heap
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
404E000
|
stack
|
page read and write
|
||
400F000
|
stack
|
page read and write
|
||
5440000
|
direct allocation
|
page execute and read and write
|
||
52A1000
|
heap
|
page read and write
|
||
6785000
|
trusted library allocation
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
7C1F000
|
stack
|
page read and write
|
||
1076000
|
unkown
|
page execute and read and write
|
||
3B0F000
|
stack
|
page read and write
|
||
52C0000
|
heap
|
page read and write
|
||
39CF000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
54C0000
|
trusted library allocation
|
page execute and read and write
|
||
53F0000
|
direct allocation
|
page read and write
|
||
ED0000
|
unkown
|
page execute and write copy
|
||
4A0F000
|
stack
|
page read and write
|
||
52A6000
|
heap
|
page read and write
|
||
468E000
|
stack
|
page read and write
|
||
53A0000
|
trusted library allocation
|
page read and write
|
||
32C0000
|
heap
|
page read and write
|
||
5470000
|
direct allocation
|
page execute and read and write
|
||
C26000
|
unkown
|
page write copy
|
||
5761000
|
trusted library allocation
|
page read and write
|
||
440E000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
166E000
|
stack
|
page read and write
|
||
168E000
|
heap
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
16DD000
|
heap
|
page read and write
|
||
4B8E000
|
stack
|
page read and write
|
||
187E000
|
stack
|
page read and write
|
||
52A3000
|
heap
|
page read and write
|
||
4C8F000
|
stack
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
1180000
|
heap
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
1625000
|
heap
|
page read and write
|
||
1078000
|
unkown
|
page execute and write copy
|
||
52A1000
|
heap
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
52B0000
|
heap
|
page read and write
|
||
ED0000
|
unkown
|
page execute and read and write
|
||
414F000
|
stack
|
page read and write
|
||
3DCE000
|
stack
|
page read and write
|
||
52A0000
|
heap
|
page read and write
|
||
360F000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
55EE000
|
stack
|
page read and write
|
||
454E000
|
stack
|
page read and write
|
||
34CF000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
C20000
|
unkown
|
page readonly
|
||
16C9000
|
heap
|
page read and write
|
||
5470000
|
trusted library allocation
|
page read and write
|
||
53D3000
|
trusted library allocation
|
page execute and read and write
|
||
54D0000
|
trusted library allocation
|
page read and write
|
||
C26000
|
unkown
|
page write copy
|
||
170F000
|
heap
|
page read and write
|
||
6761000
|
trusted library allocation
|
page read and write
|
||
388F000
|
stack
|
page read and write
|
||
38CE000
|
stack
|
page read and write
|
||
110C000
|
stack
|
page read and write
|
||
4B4F000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
3C8E000
|
stack
|
page read and write
|
||
545B000
|
trusted library allocation
|
page execute and read and write
|
||
168A000
|
heap
|
page read and write
|
||
33CF000
|
stack
|
page read and write
|
||
7D1E000
|
stack
|
page read and write
|
||
3C4F000
|
stack
|
page read and write
|
||
4CCE000
|
stack
|
page read and write
|
||
53D4000
|
trusted library allocation
|
page read and write
|
||
464F000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
C22000
|
unkown
|
page execute and read and write
|
||
53C0000
|
trusted library allocation
|
page read and write
|
||
5290000
|
direct allocation
|
page read and write
|
||
11EE000
|
stack
|
page read and write
|
||
490E000
|
stack
|
page read and write
|
||
C22000
|
unkown
|
page execute and write copy
|
||
48CF000
|
stack
|
page read and write
|
||
52A1000
|
heap
|
page read and write
|
||
3D8F000
|
stack
|
page read and write
|
||
160E000
|
stack
|
page read and write
|
||
350E000
|
stack
|
page read and write
|
||
5440000
|
trusted library allocation
|
page read and write
|
||
378E000
|
stack
|
page read and write
|
||
325C000
|
stack
|
page read and write
|
||
42CE000
|
stack
|
page read and write
|
||
53F0000
|
direct allocation
|
page read and write
|
||
329E000
|
stack
|
page read and write
|
There are 153 hidden memdumps, click here to show them.