Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
385E000
|
stack
|
page read and write
|
||
|
461E000
|
stack
|
page read and write
|
||
|
15A0000
|
heap
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
335E000
|
stack
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
100C000
|
unkown
|
page execute and read and write
|
||
|
53F0000
|
direct allocation
|
page execute and read and write
|
||
|
3BDF000
|
stack
|
page read and write
|
||
|
485F000
|
stack
|
page read and write
|
||
|
F37000
|
unkown
|
page execute and read and write
|
||
|
5221000
|
heap
|
page read and write
|
||
|
395F000
|
stack
|
page read and write
|
||
|
5370000
|
direct allocation
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
56E1000
|
trusted library allocation
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
449F000
|
stack
|
page read and write
|
||
|
439E000
|
stack
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
5220000
|
heap
|
page read and write
|
||
|
EF9000
|
unkown
|
page execute and write copy
|
||
|
F14000
|
unkown
|
page execute and read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
5221000
|
heap
|
page read and write
|
||
|
1490000
|
heap
|
page read and write
|
||
|
F8B000
|
unkown
|
page execute and write copy
|
||
|
7CDE000
|
stack
|
page read and write
|
||
|
5221000
|
heap
|
page read and write
|
||
|
EE2000
|
unkown
|
page execute and read and write
|
||
|
331F000
|
stack
|
page read and write
|
||
|
F8D000
|
unkown
|
page execute and write copy
|
||
|
4D5F000
|
stack
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
11A9000
|
stack
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
51F0000
|
direct allocation
|
page read and write
|
||
|
4E9F000
|
stack
|
page read and write
|
||
|
3A9F000
|
stack
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
F33000
|
unkown
|
page execute and write copy
|
||
|
49DE000
|
stack
|
page read and write
|
||
|
100E000
|
unkown
|
page execute and write copy
|
||
|
FFC000
|
unkown
|
page execute and write copy
|
||
|
F95000
|
unkown
|
page execute and write copy
|
||
|
D62000
|
unkown
|
page execute and read and write
|
||
|
321F000
|
stack
|
page read and write
|
||
|
F43000
|
unkown
|
page execute and write copy
|
||
|
F7E000
|
unkown
|
page execute and read and write
|
||
|
1420000
|
heap
|
page read and write
|
||
|
5221000
|
heap
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
F48000
|
unkown
|
page execute and read and write
|
||
|
7BDF000
|
stack
|
page read and write
|
||
|
30FB000
|
stack
|
page read and write
|
||
|
5370000
|
direct allocation
|
page read and write
|
||
|
15FE000
|
heap
|
page read and write
|
||
|
5570000
|
heap
|
page execute and read and write
|
||
|
53CD000
|
trusted library allocation
|
page execute and read and write
|
||
|
30BE000
|
stack
|
page read and write
|
||
|
66E1000
|
trusted library allocation
|
page read and write
|
||
|
5320000
|
heap
|
page read and write
|
||
|
FF6000
|
unkown
|
page execute and write copy
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
6705000
|
trusted library allocation
|
page read and write
|
||
|
4D9E000
|
stack
|
page read and write
|
||
|
F74000
|
unkown
|
page execute and read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
F68000
|
unkown
|
page execute and read and write
|
||
|
3E5F000
|
stack
|
page read and write
|
||
|
F70000
|
unkown
|
page execute and write copy
|
||
|
553E000
|
stack
|
page read and write
|
||
|
3F9F000
|
stack
|
page read and write
|
||
|
100E000
|
unkown
|
page execute and write copy
|
||
|
15AE000
|
heap
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
36DF000
|
stack
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
15F1000
|
heap
|
page read and write
|
||
|
5230000
|
heap
|
page read and write
|
||
|
1590000
|
heap
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
F20000
|
unkown
|
page execute and write copy
|
||
|
1494000
|
heap
|
page read and write
|
||
|
35DE000
|
stack
|
page read and write
|
||
|
56D0000
|
heap
|
page read and write
|
||
|
345F000
|
stack
|
page read and write
|
||
|
15E9000
|
heap
|
page read and write
|
||
|
F23000
|
unkown
|
page execute and write copy
|
||
|
371E000
|
stack
|
page read and write
|
||
|
100C000
|
unkown
|
page execute and write copy
|
||
|
F57000
|
unkown
|
page execute and write copy
|
||
|
1410000
|
heap
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
17DD000
|
stack
|
page read and write
|
||
|
10AC000
|
stack
|
page read and write
|
||
|
F0A000
|
unkown
|
page execute and read and write
|
||
|
5370000
|
direct allocation
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
78BD000
|
stack
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
475E000
|
stack
|
page read and write
|
||
|
F94000
|
unkown
|
page execute and read and write
|
||
|
4C5E000
|
stack
|
page read and write
|
||
|
5221000
|
heap
|
page read and write
|
||
|
44DE000
|
stack
|
page read and write
|
||
|
D62000
|
unkown
|
page execute and write copy
|
||
|
435F000
|
stack
|
page read and write
|
||
|
ECA000
|
unkown
|
page execute and write copy
|
||
|
1494000
|
heap
|
page read and write
|
||
|
3110000
|
heap
|
page read and write
|
||
|
78FE000
|
stack
|
page read and write
|
||
|
55BE000
|
stack
|
page read and write
|
||
|
EFB000
|
unkown
|
page execute and read and write
|
||
|
471F000
|
stack
|
page read and write
|
||
|
56BE000
|
stack
|
page read and write
|
||
|
18DE000
|
stack
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
53F7000
|
trusted library allocation
|
page execute and read and write
|
||
|
53C0000
|
direct allocation
|
page execute and read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
15E1000
|
heap
|
page read and write
|
||
|
425E000
|
stack
|
page read and write
|
||
|
D6A000
|
unkown
|
page execute and write copy
|
||
|
F35000
|
unkown
|
page execute and write copy
|
||
|
5430000
|
heap
|
page read and write
|
||
|
421F000
|
stack
|
page read and write
|
||
|
3E9E000
|
stack
|
page read and write
|
||
|
53C4000
|
trusted library allocation
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
3ADE000
|
stack
|
page read and write
|
||
|
797E000
|
stack
|
page read and write
|
||
|
3FDE000
|
stack
|
page read and write
|
||
|
162D000
|
heap
|
page read and write
|
||
|
D76000
|
unkown
|
page execute and write copy
|
||
|
D60000
|
unkown
|
page readonly
|
||
|
F32000
|
unkown
|
page execute and read and write
|
||
|
53F0000
|
trusted library allocation
|
page read and write
|
||
|
53E0000
|
trusted library allocation
|
page read and write
|
||
|
489E000
|
stack
|
page read and write
|
||
|
15AA000
|
heap
|
page read and write
|
||
|
40DF000
|
stack
|
page read and write
|
||
|
5221000
|
heap
|
page read and write
|
||
|
F84000
|
unkown
|
page execute and read and write
|
||
|
D66000
|
unkown
|
page write copy
|
||
|
EED000
|
unkown
|
page execute and write copy
|
||
|
3117000
|
heap
|
page read and write
|
||
|
4C1F000
|
stack
|
page read and write
|
||
|
53D4000
|
trusted library allocation
|
page read and write
|
||
|
3D5E000
|
stack
|
page read and write
|
||
|
F13000
|
unkown
|
page execute and write copy
|
||
|
5540000
|
trusted library allocation
|
page read and write
|
||
|
F9D000
|
unkown
|
page execute and read and write
|
||
|
53D0000
|
trusted library allocation
|
page read and write
|
||
|
5550000
|
trusted library allocation
|
page read and write
|
||
|
3D1F000
|
stack
|
page read and write
|
||
|
F34000
|
unkown
|
page execute and read and write
|
||
|
15DF000
|
heap
|
page read and write
|
||
|
FFC000
|
unkown
|
page execute and write copy
|
||
|
1494000
|
heap
|
page read and write
|
||
|
F7F000
|
unkown
|
page execute and write copy
|
||
|
5410000
|
trusted library allocation
|
page read and write
|
||
|
F04000
|
unkown
|
page execute and write copy
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
148E000
|
stack
|
page read and write
|
||
|
77BC000
|
stack
|
page read and write
|
||
|
399E000
|
stack
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
5320000
|
trusted library allocation
|
page read and write
|
||
|
381F000
|
stack
|
page read and write
|
||
|
3C1E000
|
stack
|
page read and write
|
||
|
F22000
|
unkown
|
page execute and read and write
|
||
|
EC8000
|
unkown
|
page execute and read and write
|
||
|
4ADF000
|
stack
|
page read and write
|
||
|
53C3000
|
trusted library allocation
|
page execute and read and write
|
||
|
5360000
|
trusted library allocation
|
page read and write
|
||
|
53FB000
|
trusted library allocation
|
page execute and read and write
|
||
|
793E000
|
stack
|
page read and write
|
||
|
53EA000
|
trusted library allocation
|
page execute and read and write
|
||
|
5210000
|
direct allocation
|
page read and write
|
||
|
7ADE000
|
stack
|
page read and write
|
||
|
179E000
|
stack
|
page read and write
|
||
|
66E4000
|
trusted library allocation
|
page read and write
|
||
|
349E000
|
stack
|
page read and write
|
||
|
D60000
|
unkown
|
page read and write
|
||
|
FF0000
|
unkown
|
page execute and read and write
|
||
|
79D0000
|
heap
|
page execute and read and write
|
||
|
45DF000
|
stack
|
page read and write
|
||
|
53AB000
|
stack
|
page read and write
|
||
|
D6A000
|
unkown
|
page execute and read and write
|
||
|
F5B000
|
unkown
|
page execute and read and write
|
||
|
F8C000
|
unkown
|
page execute and read and write
|
||
|
F7D000
|
unkown
|
page execute and write copy
|
||
|
D66000
|
unkown
|
page write copy
|
||
|
5420000
|
trusted library allocation
|
page execute and read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
F63000
|
unkown
|
page execute and write copy
|
||
|
359F000
|
stack
|
page read and write
|
||
|
1494000
|
heap
|
page read and write
|
||
|
411E000
|
stack
|
page read and write
|
||
|
499F000
|
stack
|
page read and write
|
||
|
4B1E000
|
stack
|
page read and write
|
||
|
EED000
|
unkown
|
page execute and read and write
|
There are 196 hidden memdumps, click here to show them.