Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5AF5000
|
trusted library allocation
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
FAD000
|
unkown
|
page execute and write copy
|
||
|
F55000
|
unkown
|
page execute and read and write
|
||
|
270E000
|
stack
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
3FCF000
|
stack
|
page read and write
|
||
|
700F000
|
stack
|
page read and write
|
||
|
35CF000
|
stack
|
page read and write
|
||
|
49B0000
|
heap
|
page execute and read and write
|
||
|
F38000
|
unkown
|
page execute and write copy
|
||
|
73F000
|
stack
|
page read and write
|
||
|
384F000
|
stack
|
page read and write
|
||
|
48B0000
|
trusted library allocation
|
page read and write
|
||
|
EFD000
|
unkown
|
page execute and write copy
|
||
|
F0A000
|
unkown
|
page execute and read and write
|
||
|
1002000
|
unkown
|
page execute and write copy
|
||
|
3D4F000
|
stack
|
page read and write
|
||
|
F78000
|
unkown
|
page execute and write copy
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
EFF000
|
unkown
|
page execute and write copy
|
||
|
3ACF000
|
stack
|
page read and write
|
||
|
F8A000
|
unkown
|
page execute and write copy
|
||
|
46B0000
|
trusted library allocation
|
page read and write
|
||
|
FA5000
|
unkown
|
page execute and read and write
|
||
|
4ACE000
|
stack
|
page read and write
|
||
|
280F000
|
stack
|
page read and write
|
||
|
3B0E000
|
stack
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
4864000
|
trusted library allocation
|
page read and write
|
||
|
4890000
|
direct allocation
|
page execute and read and write
|
||
|
D6A000
|
unkown
|
page execute and write copy
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
D66000
|
unkown
|
page write copy
|
||
|
489B000
|
trusted library allocation
|
page execute and read and write
|
||
|
7A6000
|
heap
|
page read and write
|
||
|
30CF000
|
stack
|
page read and write
|
||
|
D60000
|
unkown
|
page read and write
|
||
|
2FCE000
|
stack
|
page read and write
|
||
|
75E000
|
heap
|
page read and write
|
||
|
EF3000
|
unkown
|
page execute and read and write
|
||
|
5D0000
|
heap
|
page read and write
|
||
|
3ECE000
|
stack
|
page read and write
|
||
|
4860000
|
trusted library allocation
|
page read and write
|
||
|
3C4E000
|
stack
|
page read and write
|
||
|
ED9000
|
unkown
|
page execute and read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
FBC000
|
unkown
|
page execute and write copy
|
||
|
246E000
|
stack
|
page read and write
|
||
|
6C80000
|
heap
|
page execute and read and write
|
||
|
6ECF000
|
stack
|
page read and write
|
||
|
310E000
|
stack
|
page read and write
|
||
|
100C000
|
unkown
|
page execute and write copy
|
||
|
483F000
|
stack
|
page read and write
|
||
|
45B1000
|
heap
|
page read and write
|
||
|
49A0000
|
trusted library allocation
|
page execute and read and write
|
||
|
48FE000
|
stack
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
F43000
|
unkown
|
page execute and read and write
|
||
|
298E000
|
stack
|
page read and write
|
||
|
D6A000
|
unkown
|
page execute and read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
4853000
|
trusted library allocation
|
page execute and read and write
|
||
|
2C0E000
|
stack
|
page read and write
|
||
|
360E000
|
stack
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
25B0000
|
direct allocation
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
4700000
|
direct allocation
|
page read and write
|
||
|
3E8F000
|
stack
|
page read and write
|
||
|
101C000
|
unkown
|
page execute and write copy
|
||
|
F5F000
|
unkown
|
page execute and read and write
|
||
|
46B0000
|
heap
|
page read and write
|
||
|
7E2000
|
heap
|
page read and write
|
||
|
D60000
|
unkown
|
page readonly
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
F5E000
|
unkown
|
page execute and write copy
|
||
|
374E000
|
stack
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
794000
|
heap
|
page read and write
|
||
|
45B1000
|
heap
|
page read and write
|
||
|
4854000
|
trusted library allocation
|
page read and write
|
||
|
348F000
|
stack
|
page read and write
|
||
|
370F000
|
stack
|
page read and write
|
||
|
487A000
|
trusted library allocation
|
page execute and read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
1003000
|
unkown
|
page execute and read and write
|
||
|
45C0000
|
heap
|
page read and write
|
||
|
796000
|
heap
|
page read and write
|
||
|
F77000
|
unkown
|
page execute and read and write
|
||
|
F53000
|
unkown
|
page execute and write copy
|
||
|
FAF000
|
unkown
|
page execute and read and write
|
||
|
7B3000
|
heap
|
page read and write
|
||
|
98F000
|
stack
|
page read and write
|
||
|
294F000
|
stack
|
page read and write
|
||
|
2E4F000
|
stack
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
4700000
|
direct allocation
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
6C20000
|
trusted library allocation
|
page read and write
|
||
|
256F000
|
stack
|
page read and write
|
||
|
F69000
|
unkown
|
page execute and write copy
|
||
|
F9B000
|
unkown
|
page execute and write copy
|
||
|
473B000
|
stack
|
page read and write
|
||
|
1004000
|
unkown
|
page execute and write copy
|
||
|
4880000
|
heap
|
page read and write
|
||
|
334F000
|
stack
|
page read and write
|
||
|
101A000
|
unkown
|
page execute and write copy
|
||
|
6B0C000
|
stack
|
page read and write
|
||
|
25C0000
|
heap
|
page read and write
|
||
|
4AD1000
|
trusted library allocation
|
page read and write
|
||
|
25C7000
|
heap
|
page read and write
|
||
|
2D0F000
|
stack
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
D30000
|
heap
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
F1B000
|
unkown
|
page execute and read and write
|
||
|
F1A000
|
unkown
|
page execute and write copy
|
||
|
4850000
|
direct allocation
|
page execute and read and write
|
||
|
88E000
|
stack
|
page read and write
|
||
|
6C10000
|
trusted library allocation
|
page read and write
|
||
|
D75000
|
unkown
|
page execute and read and write
|
||
|
D62000
|
unkown
|
page execute and write copy
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
45B1000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page execute and write copy
|
||
|
75A000
|
heap
|
page read and write
|
||
|
D74000
|
unkown
|
page execute and write copy
|
||
|
49C0000
|
heap
|
page read and write
|
||
|
6C5E000
|
stack
|
page read and write
|
||
|
4890000
|
trusted library allocation
|
page read and write
|
||
|
7A3000
|
heap
|
page read and write
|
||
|
17C000
|
stack
|
page read and write
|
||
|
5AD1000
|
trusted library allocation
|
page read and write
|
||
|
EFD000
|
unkown
|
page execute and read and write
|
||
|
46F0000
|
trusted library allocation
|
page read and write
|
||
|
6C0D000
|
stack
|
page read and write
|
||
|
3C0F000
|
stack
|
page read and write
|
||
|
4870000
|
trusted library allocation
|
page read and write
|
||
|
F51000
|
unkown
|
page execute and write copy
|
||
|
F90000
|
unkown
|
page execute and read and write
|
||
|
D62000
|
unkown
|
page execute and read and write
|
||
|
26CF000
|
stack
|
page read and write
|
||
|
1E0000
|
heap
|
page read and write
|
||
|
45B1000
|
heap
|
page read and write
|
||
|
2E8E000
|
stack
|
page read and write
|
||
|
FBE000
|
unkown
|
page execute and read and write
|
||
|
485D000
|
trusted library allocation
|
page execute and read and write
|
||
|
2BCF000
|
stack
|
page read and write
|
||
|
338E000
|
stack
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
6F0E000
|
stack
|
page read and write
|
||
|
F74000
|
unkown
|
page execute and write copy
|
||
|
FA0000
|
unkown
|
page execute and write copy
|
||
|
410F000
|
stack
|
page read and write
|
||
|
324E000
|
stack
|
page read and write
|
||
|
320F000
|
stack
|
page read and write
|
||
|
63E000
|
stack
|
page read and write
|
||
|
4F9000
|
stack
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
45B0000
|
heap
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
2A8F000
|
stack
|
page read and write
|
||
|
284E000
|
stack
|
page read and write
|
||
|
45B1000
|
heap
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
388D000
|
stack
|
page read and write
|
||
|
424F000
|
stack
|
page read and write
|
||
|
4700000
|
direct allocation
|
page read and write
|
||
|
F6C000
|
unkown
|
page execute and read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
398F000
|
stack
|
page read and write
|
||
|
6D8E000
|
stack
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
101A000
|
unkown
|
page execute and read and write
|
||
|
F7D000
|
unkown
|
page execute and read and write
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
2ACE000
|
stack
|
page read and write
|
||
|
1F0000
|
heap
|
page read and write
|
||
|
4897000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D4E000
|
stack
|
page read and write
|
||
|
F09000
|
unkown
|
page execute and write copy
|
||
|
400E000
|
stack
|
page read and write
|
||
|
25AC000
|
stack
|
page read and write
|
||
|
F9E000
|
unkown
|
page execute and read and write
|
||
|
101C000
|
unkown
|
page execute and write copy
|
||
|
79E000
|
heap
|
page read and write
|
||
|
2F8F000
|
stack
|
page read and write
|
||
|
5AD4000
|
trusted library allocation
|
page read and write
|
||
|
3D8E000
|
stack
|
page read and write
|
||
|
F00000
|
unkown
|
page execute and read and write
|
||
|
D76000
|
unkown
|
page execute and write copy
|
||
|
39CE000
|
stack
|
page read and write
|
||
|
5D4000
|
heap
|
page read and write
|
||
|
D66000
|
unkown
|
page write copy
|
||
|
34CE000
|
stack
|
page read and write
|
||
|
F52000
|
unkown
|
page execute and read and write
|
||
|
EDC000
|
unkown
|
page execute and write copy
|
||
|
45A0000
|
direct allocation
|
page read and write
|
||
|
414E000
|
stack
|
page read and write
|
||
|
750000
|
heap
|
page read and write
|
||
|
6DCE000
|
stack
|
page read and write
|
There are 197 hidden memdumps, click here to show them.