Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
92F000
|
unkown
|
page execute and read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
B0A000
|
heap
|
page read and write
|
||
|
72DF000
|
stack
|
page read and write
|
||
|
2E8F000
|
stack
|
page read and write
|
||
|
997000
|
unkown
|
page execute and read and write
|
||
|
3B4E000
|
stack
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
3DCE000
|
stack
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
71AE000
|
stack
|
page read and write
|
||
|
4EC0000
|
heap
|
page execute and read and write
|
||
|
992000
|
unkown
|
page execute and write copy
|
||
|
4C87000
|
trusted library allocation
|
page execute and read and write
|
||
|
A4C000
|
unkown
|
page execute and write copy
|
||
|
43CF000
|
stack
|
page read and write
|
||
|
A36000
|
unkown
|
page execute and write copy
|
||
|
734000
|
heap
|
page read and write
|
||
|
3B0F000
|
stack
|
page read and write
|
||
|
B00000
|
heap
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
29CC000
|
stack
|
page read and write
|
||
|
4D30000
|
heap
|
page read and write
|
||
|
4B00000
|
direct allocation
|
page read and write
|
||
|
7A2000
|
unkown
|
page execute and read and write
|
||
|
3C8E000
|
stack
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
ADE000
|
stack
|
page read and write
|
||
|
404E000
|
stack
|
page read and write
|
||
|
5EF5000
|
trusted library allocation
|
page read and write
|
||
|
9BC000
|
unkown
|
page execute and write copy
|
||
|
2ECE000
|
stack
|
page read and write
|
||
|
90C000
|
unkown
|
page execute and read and write
|
||
|
B0E000
|
heap
|
page read and write
|
||
|
933000
|
unkown
|
page execute and write copy
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
4AA0000
|
heap
|
page read and write
|
||
|
450F000
|
stack
|
page read and write
|
||
|
4C3E000
|
stack
|
page read and write
|
||
|
97C000
|
unkown
|
page execute and write copy
|
||
|
71D0000
|
heap
|
page execute and read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
7AA000
|
unkown
|
page execute and write copy
|
||
|
9AC000
|
unkown
|
page execute and write copy
|
||
|
9CA000
|
unkown
|
page execute and write copy
|
||
|
734000
|
heap
|
page read and write
|
||
|
9D6000
|
unkown
|
page execute and read and write
|
||
|
4D2C000
|
stack
|
page read and write
|
||
|
2987000
|
heap
|
page read and write
|
||
|
2D4F000
|
stack
|
page read and write
|
||
|
2FCF000
|
stack
|
page read and write
|
||
|
4CA0000
|
trusted library allocation
|
page read and write
|
||
|
7A6000
|
unkown
|
page write copy
|
||
|
3A0E000
|
stack
|
page read and write
|
||
|
4C50000
|
direct allocation
|
page execute and read and write
|
||
|
7AA000
|
unkown
|
page execute and read and write
|
||
|
B47000
|
heap
|
page read and write
|
||
|
4AF0000
|
trusted library allocation
|
page read and write
|
||
|
B4F000
|
heap
|
page read and write
|
||
|
5ED4000
|
trusted library allocation
|
page read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
3F0E000
|
stack
|
page read and write
|
||
|
716E000
|
stack
|
page read and write
|
||
|
730000
|
heap
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
9AD000
|
unkown
|
page execute and read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
49A0000
|
heap
|
page read and write
|
||
|
77E000
|
stack
|
page read and write
|
||
|
982000
|
unkown
|
page execute and read and write
|
||
|
A31000
|
unkown
|
page execute and write copy
|
||
|
B3F000
|
heap
|
page read and write
|
||
|
A3C000
|
unkown
|
page execute and write copy
|
||
|
2D8E000
|
stack
|
page read and write
|
||
|
9A3000
|
unkown
|
page execute and read and write
|
||
|
7A2000
|
unkown
|
page execute and write copy
|
||
|
49A1000
|
heap
|
page read and write
|
||
|
378E000
|
stack
|
page read and write
|
||
|
10CF000
|
stack
|
page read and write
|
||
|
4C8B000
|
trusted library allocation
|
page execute and read and write
|
||
|
972000
|
unkown
|
page execute and read and write
|
||
|
7A6000
|
unkown
|
page write copy
|
||
|
92F000
|
unkown
|
page execute and write copy
|
||
|
734000
|
heap
|
page read and write
|
||
|
7B4000
|
unkown
|
page execute and write copy
|
||
|
A3C000
|
unkown
|
page execute and write copy
|
||
|
3ECF000
|
stack
|
page read and write
|
||
|
33CE000
|
stack
|
page read and write
|
||
|
2980000
|
heap
|
page read and write
|
||
|
414F000
|
stack
|
page read and write
|
||
|
968000
|
unkown
|
page execute and write copy
|
||
|
4C80000
|
direct allocation
|
page execute and read and write
|
||
|
2C4E000
|
stack
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
90E000
|
unkown
|
page execute and write copy
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
2ACF000
|
stack
|
page read and write
|
||
|
960000
|
unkown
|
page execute and read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
4B3B000
|
stack
|
page read and write
|
||
|
9F5000
|
unkown
|
page execute and read and write
|
||
|
4B00000
|
direct allocation
|
page read and write
|
||
|
3C4F000
|
stack
|
page read and write
|
||
|
B89000
|
heap
|
page read and write
|
||
|
360F000
|
stack
|
page read and write
|
||
|
669000
|
stack
|
page read and write
|
||
|
400F000
|
stack
|
page read and write
|
||
|
4E40000
|
trusted library allocation
|
page execute and read and write
|
||
|
2B0E000
|
stack
|
page read and write
|
||
|
A4C000
|
unkown
|
page execute and read and write
|
||
|
38CE000
|
stack
|
page read and write
|
||
|
338F000
|
stack
|
page read and write
|
||
|
939000
|
unkown
|
page execute and read and write
|
||
|
328E000
|
stack
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
980000
|
unkown
|
page execute and write copy
|
||
|
3D8F000
|
stack
|
page read and write
|
||
|
388F000
|
stack
|
page read and write
|
||
|
4AA0000
|
trusted library allocation
|
page read and write
|
||
|
A9E000
|
stack
|
page read and write
|
||
|
4C7A000
|
trusted library allocation
|
page execute and read and write
|
||
|
4C54000
|
trusted library allocation
|
page read and write
|
||
|
314E000
|
stack
|
page read and write
|
||
|
374F000
|
stack
|
page read and write
|
||
|
4C53000
|
trusted library allocation
|
page execute and read and write
|
||
|
4C64000
|
trusted library allocation
|
page read and write
|
||
|
95E000
|
unkown
|
page execute and write copy
|
||
|
4E60000
|
trusted library allocation
|
page read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
4B00000
|
direct allocation
|
page read and write
|
||
|
6E0000
|
heap
|
page read and write
|
||
|
741E000
|
stack
|
page read and write
|
||
|
4C80000
|
trusted library allocation
|
page read and write
|
||
|
4C60000
|
trusted library allocation
|
page read and write
|
||
|
49A1000
|
heap
|
page read and write
|
||
|
A35000
|
unkown
|
page execute and read and write
|
||
|
7A0000
|
unkown
|
page readonly
|
||
|
4E50000
|
trusted library allocation
|
page read and write
|
||
|
938000
|
unkown
|
page execute and write copy
|
||
|
4CEE000
|
stack
|
page read and write
|
||
|
9C3000
|
unkown
|
page execute and read and write
|
||
|
A4E000
|
unkown
|
page execute and write copy
|
||
|
9A0000
|
unkown
|
page execute and write copy
|
||
|
734000
|
heap
|
page read and write
|
||
|
AF0000
|
direct allocation
|
page read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
937000
|
unkown
|
page execute and read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
A4E000
|
unkown
|
page execute and write copy
|
||
|
350E000
|
stack
|
page read and write
|
||
|
42CE000
|
stack
|
page read and write
|
||
|
4C5D000
|
trusted library allocation
|
page execute and read and write
|
||
|
6D0000
|
heap
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
34CF000
|
stack
|
page read and write
|
||
|
FCE000
|
stack
|
page read and write
|
||
|
364E000
|
stack
|
page read and write
|
||
|
39CF000
|
stack
|
page read and write
|
||
|
56C000
|
stack
|
page read and write
|
||
|
9BB000
|
unkown
|
page execute and read and write
|
||
|
428F000
|
stack
|
page read and write
|
||
|
296F000
|
stack
|
page read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
9F2000
|
unkown
|
page execute and write copy
|
||
|
9CC000
|
unkown
|
page execute and read and write
|
||
|
4E3E000
|
stack
|
page read and write
|
||
|
4AE0000
|
heap
|
page read and write
|
||
|
706D000
|
stack
|
page read and write
|
||
|
49A1000
|
heap
|
page read and write
|
||
|
5ED1000
|
trusted library allocation
|
page read and write
|
||
|
780000
|
heap
|
page read and write
|
||
|
4C70000
|
trusted library allocation
|
page read and write
|
||
|
97F000
|
unkown
|
page execute and read and write
|
||
|
7B6000
|
unkown
|
page execute and write copy
|
||
|
310F000
|
stack
|
page read and write
|
||
|
4990000
|
direct allocation
|
page read and write
|
||
|
921000
|
unkown
|
page execute and read and write
|
||
|
2C0F000
|
stack
|
page read and write
|
||
|
9D3000
|
unkown
|
page execute and write copy
|
||
|
B5C000
|
heap
|
page read and write
|
||
|
49A1000
|
heap
|
page read and write
|
||
|
B3D000
|
heap
|
page read and write
|
||
|
731E000
|
stack
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
49A1000
|
heap
|
page read and write
|
||
|
49A1000
|
heap
|
page read and write
|
||
|
4ED1000
|
trusted library allocation
|
page read and write
|
||
|
300E000
|
stack
|
page read and write
|
||
|
440E000
|
stack
|
page read and write
|
||
|
7B5000
|
unkown
|
page execute and read and write
|
||
|
464F000
|
stack
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
418E000
|
stack
|
page read and write
|
||
|
9B9000
|
unkown
|
page execute and write copy
|
||
|
7A0000
|
unkown
|
page read and write
|
||
|
324F000
|
stack
|
page read and write
|
||
|
734000
|
heap
|
page read and write
|
||
|
4E9E000
|
stack
|
page read and write
|
||
|
454E000
|
stack
|
page read and write
|
||
|
49B0000
|
heap
|
page read and write
|
There are 195 hidden memdumps, click here to show them.