Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5290000
|
direct allocation
|
page read and write
|
||
|
C20000
|
unkown
|
page read and write
|
||
|
53F0000
|
direct allocation
|
page read and write
|
||
|
79BE000
|
stack
|
page read and write
|
||
|
16C1000
|
heap
|
page read and write
|
||
|
78FD000
|
stack
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
EC1000
|
unkown
|
page execute and read and write
|
||
|
793E000
|
stack
|
page read and write
|
||
|
418E000
|
stack
|
page read and write
|
||
|
3A0E000
|
stack
|
page read and write
|
||
|
DB7000
|
unkown
|
page execute and read and write
|
||
|
544A000
|
trusted library allocation
|
page execute and read and write
|
||
|
ED1000
|
unkown
|
page execute and write copy
|
||
|
4A4E000
|
stack
|
page read and write
|
||
|
7A10000
|
heap
|
page execute and read and write
|
||
|
54BE000
|
stack
|
page read and write
|
||
|
6764000
|
trusted library allocation
|
page read and write
|
||
|
7B1E000
|
stack
|
page read and write
|
||
|
374F000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
573C000
|
stack
|
page read and write
|
||
|
53E0000
|
trusted library allocation
|
page read and write
|
||
|
197F000
|
stack
|
page read and write
|
||
|
C2A000
|
unkown
|
page execute and read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
53DD000
|
trusted library allocation
|
page execute and read and write
|
||
|
450F000
|
stack
|
page read and write
|
||
|
428F000
|
stack
|
page read and write
|
||
|
14F9000
|
stack
|
page read and write
|
||
|
478F000
|
stack
|
page read and write
|
||
|
364E000
|
stack
|
page read and write
|
||
|
4DCF000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
3F0E000
|
stack
|
page read and write
|
||
|
4E0E000
|
stack
|
page read and write
|
||
|
3B4E000
|
stack
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
1670000
|
heap
|
page read and write
|
||
|
1076000
|
unkown
|
page execute and write copy
|
||
|
5450000
|
trusted library allocation
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
1170000
|
heap
|
page read and write
|
||
|
797E000
|
stack
|
page read and write
|
||
|
5250000
|
direct allocation
|
page read and write
|
||
|
4F0F000
|
stack
|
page read and write
|
||
|
47CE000
|
stack
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
32C7000
|
heap
|
page read and write
|
||
|
54E0000
|
heap
|
page read and write
|
||
|
3ECF000
|
stack
|
page read and write
|
||
|
1680000
|
heap
|
page read and write
|
||
|
1620000
|
heap
|
page read and write
|
||
|
56F0000
|
heap
|
page execute and read and write
|
||
|
5270000
|
heap
|
page read and write
|
||
|
43CF000
|
stack
|
page read and write
|
||
|
5457000
|
trusted library allocation
|
page execute and read and write
|
||
|
5740000
|
trusted library allocation
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
542B000
|
stack
|
page read and write
|
||
|
56EE000
|
stack
|
page read and write
|
||
|
53E4000
|
trusted library allocation
|
page read and write
|
||
|
1078000
|
unkown
|
page execute and write copy
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
321F000
|
stack
|
page read and write
|
||
|
5750000
|
heap
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
404E000
|
stack
|
page read and write
|
||
|
400F000
|
stack
|
page read and write
|
||
|
5440000
|
direct allocation
|
page execute and read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
6785000
|
trusted library allocation
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
7C1F000
|
stack
|
page read and write
|
||
|
1076000
|
unkown
|
page execute and read and write
|
||
|
3B0F000
|
stack
|
page read and write
|
||
|
52C0000
|
heap
|
page read and write
|
||
|
39CF000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
54C0000
|
trusted library allocation
|
page execute and read and write
|
||
|
53F0000
|
direct allocation
|
page read and write
|
||
|
ED0000
|
unkown
|
page execute and write copy
|
||
|
4A0F000
|
stack
|
page read and write
|
||
|
52A6000
|
heap
|
page read and write
|
||
|
468E000
|
stack
|
page read and write
|
||
|
53A0000
|
trusted library allocation
|
page read and write
|
||
|
32C0000
|
heap
|
page read and write
|
||
|
5470000
|
direct allocation
|
page execute and read and write
|
||
|
C26000
|
unkown
|
page write copy
|
||
|
5761000
|
trusted library allocation
|
page read and write
|
||
|
440E000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
166E000
|
stack
|
page read and write
|
||
|
168E000
|
heap
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
16DD000
|
heap
|
page read and write
|
||
|
4B8E000
|
stack
|
page read and write
|
||
|
187E000
|
stack
|
page read and write
|
||
|
52A3000
|
heap
|
page read and write
|
||
|
4C8F000
|
stack
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
1180000
|
heap
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
1625000
|
heap
|
page read and write
|
||
|
1078000
|
unkown
|
page execute and write copy
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
52B0000
|
heap
|
page read and write
|
||
|
ED0000
|
unkown
|
page execute and read and write
|
||
|
414F000
|
stack
|
page read and write
|
||
|
3DCE000
|
stack
|
page read and write
|
||
|
52A0000
|
heap
|
page read and write
|
||
|
360F000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
55EE000
|
stack
|
page read and write
|
||
|
454E000
|
stack
|
page read and write
|
||
|
34CF000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
C20000
|
unkown
|
page readonly
|
||
|
16C9000
|
heap
|
page read and write
|
||
|
5470000
|
trusted library allocation
|
page read and write
|
||
|
53D3000
|
trusted library allocation
|
page execute and read and write
|
||
|
54D0000
|
trusted library allocation
|
page read and write
|
||
|
C26000
|
unkown
|
page write copy
|
||
|
170F000
|
heap
|
page read and write
|
||
|
6761000
|
trusted library allocation
|
page read and write
|
||
|
388F000
|
stack
|
page read and write
|
||
|
38CE000
|
stack
|
page read and write
|
||
|
110C000
|
stack
|
page read and write
|
||
|
4B4F000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
3C8E000
|
stack
|
page read and write
|
||
|
545B000
|
trusted library allocation
|
page execute and read and write
|
||
|
168A000
|
heap
|
page read and write
|
||
|
33CF000
|
stack
|
page read and write
|
||
|
7D1E000
|
stack
|
page read and write
|
||
|
3C4F000
|
stack
|
page read and write
|
||
|
4CCE000
|
stack
|
page read and write
|
||
|
53D4000
|
trusted library allocation
|
page read and write
|
||
|
464F000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
C22000
|
unkown
|
page execute and read and write
|
||
|
53C0000
|
trusted library allocation
|
page read and write
|
||
|
5290000
|
direct allocation
|
page read and write
|
||
|
11EE000
|
stack
|
page read and write
|
||
|
490E000
|
stack
|
page read and write
|
||
|
C22000
|
unkown
|
page execute and write copy
|
||
|
48CF000
|
stack
|
page read and write
|
||
|
52A1000
|
heap
|
page read and write
|
||
|
3D8F000
|
stack
|
page read and write
|
||
|
160E000
|
stack
|
page read and write
|
||
|
350E000
|
stack
|
page read and write
|
||
|
5440000
|
trusted library allocation
|
page read and write
|
||
|
378E000
|
stack
|
page read and write
|
||
|
325C000
|
stack
|
page read and write
|
||
|
42CE000
|
stack
|
page read and write
|
||
|
53F0000
|
direct allocation
|
page read and write
|
||
|
329E000
|
stack
|
page read and write
|
There are 153 hidden memdumps, click here to show them.