Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
8A7000
|
unkown
|
page execute and write copy
|
||
|
953000
|
unkown
|
page execute and read and write
|
||
|
47BE000
|
stack
|
page read and write
|
||
|
9C8000
|
unkown
|
page execute and read and write
|
||
|
11DE000
|
stack
|
page read and write
|
||
|
42BE000
|
stack
|
page read and write
|
||
|
4DA0000
|
direct allocation
|
page read and write
|
||
|
91A000
|
unkown
|
page execute and write copy
|
||
|
38BE000
|
stack
|
page read and write
|
||
|
373F000
|
stack
|
page read and write
|
||
|
937000
|
unkown
|
page execute and write copy
|
||
|
712000
|
unkown
|
page execute and write copy
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
1229000
|
heap
|
page read and write
|
||
|
11E0000
|
heap
|
page read and write
|
||
|
733E000
|
stack
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
4C40000
|
heap
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
35FF000
|
stack
|
page read and write
|
||
|
8E8000
|
unkown
|
page execute and write copy
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
61C4000
|
trusted library allocation
|
page read and write
|
||
|
4D7D000
|
trusted library allocation
|
page execute and read and write
|
||
|
FC0000
|
heap
|
page read and write
|
||
|
E10000
|
heap
|
page read and write
|
||
|
4EF0000
|
trusted library allocation
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
2FFE000
|
stack
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
9C8000
|
unkown
|
page execute and write copy
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
76AE000
|
stack
|
page read and write
|
||
|
F9E000
|
stack
|
page read and write
|
||
|
927000
|
unkown
|
page execute and write copy
|
||
|
3AFF000
|
stack
|
page read and write
|
||
|
4D90000
|
heap
|
page read and write
|
||
|
8BA000
|
unkown
|
page execute and write copy
|
||
|
7360000
|
heap
|
page execute and read and write
|
||
|
929000
|
unkown
|
page execute and read and write
|
||
|
453E000
|
stack
|
page read and write
|
||
|
9B7000
|
unkown
|
page execute and write copy
|
||
|
4F20000
|
trusted library allocation
|
page read and write
|
||
|
51BE000
|
stack
|
page read and write
|
||
|
123E000
|
heap
|
page read and write
|
||
|
710000
|
unkown
|
page readonly
|
||
|
91F000
|
unkown
|
page execute and read and write
|
||
|
2E7F000
|
stack
|
page read and write
|
||
|
71A000
|
unkown
|
page execute and write copy
|
||
|
935000
|
unkown
|
page execute and write copy
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
504C000
|
stack
|
page read and write
|
||
|
121F000
|
heap
|
page read and write
|
||
|
4DA0000
|
direct allocation
|
page read and write
|
||
|
746E000
|
stack
|
page read and write
|
||
|
4D73000
|
trusted library allocation
|
page execute and read and write
|
||
|
920000
|
unkown
|
page execute and write copy
|
||
|
2FBF000
|
stack
|
page read and write
|
||
|
9CA000
|
unkown
|
page execute and write copy
|
||
|
39BF000
|
stack
|
page read and write
|
||
|
4F6E000
|
stack
|
page read and write
|
||
|
33BE000
|
stack
|
page read and write
|
||
|
946000
|
unkown
|
page execute and write copy
|
||
|
417E000
|
stack
|
page read and write
|
||
|
4F0B000
|
trusted library allocation
|
page execute and read and write
|
||
|
4D60000
|
trusted library allocation
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
BA9000
|
stack
|
page read and write
|
||
|
9CA000
|
unkown
|
page execute and write copy
|
||
|
48BF000
|
stack
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
880000
|
unkown
|
page execute and read and write
|
||
|
4DDB000
|
stack
|
page read and write
|
||
|
936000
|
unkown
|
page execute and read and write
|
||
|
43FE000
|
stack
|
page read and write
|
||
|
941000
|
unkown
|
page execute and write copy
|
||
|
756F000
|
stack
|
page read and write
|
||
|
313E000
|
stack
|
page read and write
|
||
|
3D7F000
|
stack
|
page read and write
|
||
|
726000
|
unkown
|
page execute and write copy
|
||
|
9B7000
|
unkown
|
page execute and write copy
|
||
|
4EFA000
|
trusted library allocation
|
page execute and read and write
|
||
|
AAC000
|
stack
|
page read and write
|
||
|
3C3F000
|
stack
|
page read and write
|
||
|
2C7F000
|
stack
|
page read and write
|
||
|
716000
|
unkown
|
page write copy
|
||
|
8B0000
|
unkown
|
page execute and read and write
|
||
|
2D7F000
|
stack
|
page read and write
|
||
|
9AE000
|
unkown
|
page execute and write copy
|
||
|
3C7E000
|
stack
|
page read and write
|
||
|
30FF000
|
stack
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
4D80000
|
trusted library allocation
|
page read and write
|
||
|
FF0000
|
heap
|
page read and write
|
||
|
3EBF000
|
stack
|
page read and write
|
||
|
117B000
|
stack
|
page read and write
|
||
|
1190000
|
heap
|
page read and write
|
||
|
427F000
|
stack
|
page read and write
|
||
|
8E7000
|
unkown
|
page execute and read and write
|
||
|
4F00000
|
trusted library allocation
|
page read and write
|
||
|
8BF000
|
unkown
|
page execute and read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
11EE000
|
heap
|
page read and write
|
||
|
1180000
|
direct allocation
|
page read and write
|
||
|
8F4000
|
unkown
|
page execute and write copy
|
||
|
34BF000
|
stack
|
page read and write
|
||
|
712000
|
unkown
|
page execute and read and write
|
||
|
72FE000
|
stack
|
page read and write
|
||
|
113E000
|
stack
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
337F000
|
stack
|
page read and write
|
||
|
3B3E000
|
stack
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
4C51000
|
heap
|
page read and write
|
||
|
8DE000
|
unkown
|
page execute and write copy
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
942000
|
unkown
|
page execute and read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
1197000
|
heap
|
page read and write
|
||
|
61E5000
|
trusted library allocation
|
page read and write
|
||
|
50B0000
|
heap
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
1221000
|
heap
|
page read and write
|
||
|
403E000
|
stack
|
page read and write
|
||
|
10FF000
|
stack
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
8D5000
|
unkown
|
page execute and write copy
|
||
|
72BD000
|
stack
|
page read and write
|
||
|
8D6000
|
unkown
|
page execute and read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
945000
|
unkown
|
page execute and read and write
|
||
|
8E9000
|
unkown
|
page execute and read and write
|
||
|
5070000
|
trusted library allocation
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
377E000
|
stack
|
page read and write
|
||
|
4D74000
|
trusted library allocation
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
323F000
|
stack
|
page read and write
|
||
|
3DBE000
|
stack
|
page read and write
|
||
|
13DF000
|
stack
|
page read and write
|
||
|
939000
|
unkown
|
page execute and read and write
|
||
|
89A000
|
unkown
|
page execute and read and write
|
||
|
943000
|
unkown
|
page execute and write copy
|
||
|
883000
|
unkown
|
page execute and write copy
|
||
|
2EBE000
|
stack
|
page read and write
|
||
|
11EA000
|
heap
|
page read and write
|
||
|
4EDE000
|
stack
|
page read and write
|
||
|
4F20000
|
direct allocation
|
page execute and read and write
|
||
|
716000
|
unkown
|
page write copy
|
||
|
39FE000
|
stack
|
page read and write
|
||
|
952000
|
unkown
|
page execute and write copy
|
||
|
43BF000
|
stack
|
page read and write
|
||
|
327E000
|
stack
|
page read and write
|
||
|
8F7000
|
unkown
|
page execute and read and write
|
||
|
463F000
|
stack
|
page read and write
|
||
|
61C1000
|
trusted library allocation
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
FF5000
|
heap
|
page read and write
|
||
|
4C10000
|
heap
|
page read and write
|
||
|
71A000
|
unkown
|
page execute and read and write
|
||
|
477F000
|
stack
|
page read and write
|
||
|
F5E000
|
stack
|
page read and write
|
||
|
363E000
|
stack
|
page read and write
|
||
|
75AE000
|
stack
|
page read and write
|
||
|
3FFE000
|
stack
|
page read and write
|
||
|
44FF000
|
stack
|
page read and write
|
||
|
51C1000
|
trusted library allocation
|
page read and write
|
||
|
94A000
|
unkown
|
page execute and read and write
|
||
|
5050000
|
trusted library allocation
|
page execute and read and write
|
||
|
926000
|
unkown
|
page execute and read and write
|
||
|
8A7000
|
unkown
|
page execute and read and write
|
||
|
5080000
|
trusted library allocation
|
page read and write
|
||
|
387F000
|
stack
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page read and write
|
||
|
34FE000
|
stack
|
page read and write
|
||
|
413F000
|
stack
|
page read and write
|
||
|
3EFE000
|
stack
|
page read and write
|
||
|
4DA0000
|
direct allocation
|
page read and write
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
467E000
|
stack
|
page read and write
|
||
|
8A9000
|
unkown
|
page execute and write copy
|
||
|
4C41000
|
heap
|
page read and write
|
||
|
710000
|
unkown
|
page read and write
|
||
|
4F07000
|
trusted library allocation
|
page execute and read and write
|
||
|
5060000
|
heap
|
page execute and read and write
|
||
|
4D84000
|
trusted library allocation
|
page read and write
|
||
|
4D40000
|
trusted library allocation
|
page read and write
|
||
|
EF0000
|
heap
|
page read and write
|
||
|
4EF0000
|
direct allocation
|
page execute and read and write
|
There are 184 hidden memdumps, click here to show them.