Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
5130000
|
direct allocation
|
page read and write
|
||
|
E9F000
|
unkown
|
page execute and write copy
|
||
|
77FD000
|
stack
|
page read and write
|
||
|
16DE000
|
stack
|
page read and write
|
||
|
6725000
|
trusted library allocation
|
page read and write
|
||
|
C82000
|
unkown
|
page execute and read and write
|
||
|
E40000
|
unkown
|
page execute and write copy
|
||
|
1304000
|
heap
|
page read and write
|
||
|
4B7E000
|
stack
|
page read and write
|
||
|
413F000
|
stack
|
page read and write
|
||
|
C80000
|
unkown
|
page read and write
|
||
|
541A000
|
trusted library allocation
|
page execute and read and write
|
||
|
52B3000
|
trusted library allocation
|
page execute and read and write
|
||
|
EBF000
|
unkown
|
page execute and write copy
|
||
|
3AFF000
|
stack
|
page read and write
|
||
|
DED000
|
unkown
|
page execute and write copy
|
||
|
56FE000
|
stack
|
page read and write
|
||
|
417E000
|
stack
|
page read and write
|
||
|
52BD000
|
trusted library allocation
|
page execute and read and write
|
||
|
5110000
|
direct allocation
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
C8A000
|
unkown
|
page execute and write copy
|
||
|
E86000
|
unkown
|
page execute and write copy
|
||
|
79A0000
|
heap
|
page execute and read and write
|
||
|
3130000
|
heap
|
page read and write
|
||
|
52FB000
|
stack
|
page read and write
|
||
|
1410000
|
heap
|
page read and write
|
||
|
E24000
|
unkown
|
page execute and write copy
|
||
|
3FFF000
|
stack
|
page read and write
|
||
|
33BE000
|
stack
|
page read and write
|
||
|
F0C000
|
unkown
|
page execute and write copy
|
||
|
7BAE000
|
stack
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
43FD000
|
stack
|
page read and write
|
||
|
467E000
|
stack
|
page read and write
|
||
|
E2B000
|
unkown
|
page execute and read and write
|
||
|
34BF000
|
stack
|
page read and write
|
||
|
E26000
|
unkown
|
page execute and read and write
|
||
|
C96000
|
unkown
|
page execute and write copy
|
||
|
3D7F000
|
stack
|
page read and write
|
||
|
E9E000
|
unkown
|
page execute and read and write
|
||
|
54F0000
|
trusted library allocation
|
page read and write
|
||
|
E9D000
|
unkown
|
page execute and write copy
|
||
|
477F000
|
stack
|
page read and write
|
||
|
463F000
|
stack
|
page read and write
|
||
|
EC0000
|
unkown
|
page execute and read and write
|
||
|
EB4000
|
unkown
|
page execute and read and write
|
||
|
E11000
|
unkown
|
page execute and read and write
|
||
|
47BE000
|
stack
|
page read and write
|
||
|
42BE000
|
stack
|
page read and write
|
||
|
4C7F000
|
stack
|
page read and write
|
||
|
363E000
|
stack
|
page read and write
|
||
|
53FE000
|
stack
|
page read and write
|
||
|
5240000
|
trusted library allocation
|
page read and write
|
||
|
323F000
|
stack
|
page read and write
|
||
|
F21000
|
unkown
|
page execute and write copy
|
||
|
C8A000
|
unkown
|
page execute and read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
F32000
|
unkown
|
page execute and write copy
|
||
|
1304000
|
heap
|
page read and write
|
||
|
E85000
|
unkown
|
page execute and read and write
|
||
|
453E000
|
stack
|
page read and write
|
||
|
5420000
|
direct allocation
|
page execute and read and write
|
||
|
DEA000
|
unkown
|
page execute and read and write
|
||
|
387F000
|
stack
|
page read and write
|
||
|
5404000
|
trusted library allocation
|
page read and write
|
||
|
C94000
|
unkown
|
page execute and write copy
|
||
|
1304000
|
heap
|
page read and write
|
||
|
EB2000
|
unkown
|
page execute and write copy
|
||
|
1304000
|
heap
|
page read and write
|
||
|
327E000
|
stack
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
E92000
|
unkown
|
page execute and write copy
|
||
|
13DA000
|
heap
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
E7E000
|
unkown
|
page execute and write copy
|
||
|
3110000
|
heap
|
page read and write
|
||
|
5141000
|
heap
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
FCC000
|
stack
|
page read and write
|
||
|
1300000
|
heap
|
page read and write
|
||
|
F32000
|
unkown
|
page execute and read and write
|
||
|
ECF000
|
unkown
|
page execute and read and write
|
||
|
4A3E000
|
stack
|
page read and write
|
||
|
337F000
|
stack
|
page read and write
|
||
|
52A0000
|
trusted library allocation
|
page read and write
|
||
|
E55000
|
unkown
|
page execute and read and write
|
||
|
548E000
|
stack
|
page read and write
|
||
|
377E000
|
stack
|
page read and write
|
||
|
38BE000
|
stack
|
page read and write
|
||
|
1350000
|
heap
|
page read and write
|
||
|
54E0000
|
trusted library allocation
|
page read and write
|
||
|
5151000
|
heap
|
page read and write
|
||
|
5701000
|
trusted library allocation
|
page read and write
|
||
|
ED9000
|
unkown
|
page execute and write copy
|
||
|
5260000
|
direct allocation
|
page execute and read and write
|
||
|
E15000
|
unkown
|
page execute and write copy
|
||
|
39BF000
|
stack
|
page read and write
|
||
|
E11000
|
unkown
|
page execute and write copy
|
||
|
5270000
|
heap
|
page read and write
|
||
|
797E000
|
stack
|
page read and write
|
||
|
E95000
|
unkown
|
page execute and read and write
|
||
|
403E000
|
stack
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
1420000
|
heap
|
page read and write
|
||
|
1418000
|
heap
|
page read and write
|
||
|
E62000
|
unkown
|
page execute and write copy
|
||
|
44FF000
|
stack
|
page read and write
|
||
|
F21000
|
unkown
|
page execute and write copy
|
||
|
78FE000
|
stack
|
page read and write
|
||
|
EA3000
|
unkown
|
page execute and read and write
|
||
|
140E000
|
heap
|
page read and write
|
||
|
52B4000
|
trusted library allocation
|
page read and write
|
||
|
39FE000
|
stack
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
5410000
|
trusted library allocation
|
page read and write
|
||
|
35FF000
|
stack
|
page read and write
|
||
|
5141000
|
heap
|
page read and write
|
||
|
E80000
|
unkown
|
page execute and read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
E6C000
|
unkown
|
page execute and read and write
|
||
|
30CF000
|
stack
|
page read and write
|
||
|
3137000
|
heap
|
page read and write
|
||
|
6704000
|
trusted library allocation
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
4DBF000
|
stack
|
page read and write
|
||
|
3C7E000
|
stack
|
page read and write
|
||
|
5280000
|
heap
|
page read and write
|
||
|
E1B000
|
unkown
|
page execute and read and write
|
||
|
EDF000
|
unkown
|
page execute and read and write
|
||
|
5250000
|
direct allocation
|
page read and write
|
||
|
E69000
|
unkown
|
page execute and read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
3DBE000
|
stack
|
page read and write
|
||
|
373F000
|
stack
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
C82000
|
unkown
|
page execute and write copy
|
||
|
E28000
|
unkown
|
page execute and write copy
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
6701000
|
trusted library allocation
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
5141000
|
heap
|
page read and write
|
||
|
13BE000
|
stack
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
7AAE000
|
stack
|
page read and write
|
||
|
F16000
|
unkown
|
page execute and write copy
|
||
|
1304000
|
heap
|
page read and write
|
||
|
1340000
|
heap
|
page read and write
|
||
|
34FE000
|
stack
|
page read and write
|
||
|
5420000
|
trusted library allocation
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
17DE000
|
stack
|
page read and write
|
||
|
542B000
|
trusted library allocation
|
page execute and read and write
|
||
|
48FE000
|
stack
|
page read and write
|
||
|
3EBF000
|
stack
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
3B3E000
|
stack
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
5440000
|
trusted library allocation
|
page read and write
|
||
|
E03000
|
unkown
|
page execute and read and write
|
||
|
2FCE000
|
stack
|
page read and write
|
||
|
E19000
|
unkown
|
page execute and write copy
|
||
|
E6A000
|
unkown
|
page execute and write copy
|
||
|
4CBE000
|
stack
|
page read and write
|
||
|
5250000
|
direct allocation
|
page read and write
|
||
|
169E000
|
stack
|
page read and write
|
||
|
141D000
|
heap
|
page read and write
|
||
|
5141000
|
heap
|
page read and write
|
||
|
43BF000
|
stack
|
page read and write
|
||
|
55F0000
|
heap
|
page execute and read and write
|
||
|
310C000
|
stack
|
page read and write
|
||
|
E18000
|
unkown
|
page execute and read and write
|
||
|
793E000
|
stack
|
page read and write
|
||
|
5140000
|
heap
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
E8B000
|
unkown
|
page execute and read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
13DE000
|
heap
|
page read and write
|
||
|
5427000
|
trusted library allocation
|
page execute and read and write
|
||
|
13D0000
|
heap
|
page read and write
|
||
|
5400000
|
trusted library allocation
|
page read and write
|
||
|
C86000
|
unkown
|
page write copy
|
||
|
5500000
|
heap
|
page read and write
|
||
|
55EE000
|
stack
|
page read and write
|
||
|
3EFE000
|
stack
|
page read and write
|
||
|
C95000
|
unkown
|
page execute and read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
E22000
|
unkown
|
page execute and write copy
|
||
|
C80000
|
unkown
|
page readonly
|
||
|
4B3F000
|
stack
|
page read and write
|
||
|
5130000
|
direct allocation
|
page read and write
|
||
|
48BF000
|
stack
|
page read and write
|
||
|
F0D000
|
unkown
|
page execute and read and write
|
||
|
F0F000
|
unkown
|
page execute and read and write
|
||
|
3C3F000
|
stack
|
page read and write
|
||
|
142C000
|
heap
|
page read and write
|
||
|
12F9000
|
stack
|
page read and write
|
||
|
5250000
|
direct allocation
|
page read and write
|
||
|
5141000
|
heap
|
page read and write
|
||
|
E81000
|
unkown
|
page execute and write copy
|
||
|
5141000
|
heap
|
page read and write
|
||
|
C86000
|
unkown
|
page write copy
|
||
|
427F000
|
stack
|
page read and write
|
||
|
1304000
|
heap
|
page read and write
|
||
|
ECD000
|
unkown
|
page execute and write copy
|
||
|
49FF000
|
stack
|
page read and write
|
||
|
54D0000
|
trusted library allocation
|
page execute and read and write
|
||
|
54CC000
|
stack
|
page read and write
|
||
|
E23000
|
unkown
|
page execute and read and write
|
There are 202 hidden memdumps, click here to show them.