Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
file.exe
|
PE32 executable (GUI) Intel 80386, for MS Windows
|
initial sample
|
 |
|
|
C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log
|
CSV text
|
dropped
|
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Users\user\Desktop\file.exe
|
"C:\Users\user\Desktop\file.exe"
|
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableIOAVProtection
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection
|
DisableRealtimeMonitoring
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications
|
DisableNotifications
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AUOptions
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
AutoInstallMinorUpdates
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
NoAutoRebootWithLoggedOnUsers
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
|
UseWUServer
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate
|
DoNotConnectToWindowsUpdateInternetLocations
|
|
|
|
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features
|
TamperProtection
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
429E000
|
stack
|
page read and write
|
||
|
910000
|
heap
|
page read and write
|
||
|
35DF000
|
stack
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
2C1E000
|
stack
|
page read and write
|
||
|
900000
|
heap
|
page read and write
|
||
|
4960000
|
heap
|
page read and write
|
||
|
385F000
|
stack
|
page read and write
|
||
|
EC0000
|
heap
|
page read and write
|
||
|
718E000
|
stack
|
page read and write
|
||
|
4C60000
|
trusted library allocation
|
page read and write
|
||
|
389E000
|
stack
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
714E000
|
stack
|
page read and write
|
||
|
EBC000
|
stack
|
page read and write
|
||
|
2ADE000
|
stack
|
page read and write
|
||
|
700E000
|
stack
|
page read and write
|
||
|
39DE000
|
stack
|
page read and write
|
||
|
371F000
|
stack
|
page read and write
|
||
|
6FD0000
|
trusted library allocation
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
10CF000
|
stack
|
page read and write
|
||
|
C3B000
|
unkown
|
page execute and write copy
|
||
|
95B000
|
heap
|
page read and write
|
||
|
4E00000
|
trusted library allocation
|
page execute and read and write
|
||
|
30DF000
|
stack
|
page read and write
|
||
|
CE8000
|
unkown
|
page execute and read and write
|
||
|
361E000
|
stack
|
page read and write
|
||
|
BD5000
|
unkown
|
page execute and read and write
|
||
|
C1B000
|
unkown
|
page execute and write copy
|
||
|
4981000
|
heap
|
page read and write
|
||
|
3EDE000
|
stack
|
page read and write
|
||
|
A40000
|
unkown
|
page readonly
|
||
|
2A9F000
|
stack
|
page read and write
|
||
|
53C000
|
stack
|
page read and write
|
||
|
4A80000
|
trusted library allocation
|
page read and write
|
||
|
3FDF000
|
stack
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
2D5E000
|
stack
|
page read and write
|
||
|
311E000
|
stack
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
9A3000
|
heap
|
page read and write
|
||
|
C02000
|
unkown
|
page execute and write copy
|
||
|
4CAE000
|
stack
|
page read and write
|
||
|
BBE000
|
unkown
|
page execute and read and write
|
||
|
CC7000
|
unkown
|
page execute and read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
C69000
|
unkown
|
page execute and write copy
|
||
|
CD8000
|
unkown
|
page execute and write copy
|
||
|
401E000
|
stack
|
page read and write
|
||
|
5E24000
|
trusted library allocation
|
page read and write
|
||
|
8F9000
|
stack
|
page read and write
|
||
|
970000
|
heap
|
page read and write
|
||
|
C0E000
|
unkown
|
page execute and read and write
|
||
|
A46000
|
unkown
|
page write copy
|
||
|
4981000
|
heap
|
page read and write
|
||
|
C60000
|
unkown
|
page execute and read and write
|
||
|
5A0000
|
heap
|
page read and write
|
||
|
2990000
|
heap
|
page read and write
|
||
|
C6B000
|
unkown
|
page execute and read and write
|
||
|
DFE000
|
stack
|
page read and write
|
||
|
C85000
|
unkown
|
page execute and read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
C83000
|
unkown
|
page execute and write copy
|
||
|
4990000
|
heap
|
page read and write
|
||
|
3C5E000
|
stack
|
page read and write
|
||
|
375E000
|
stack
|
page read and write
|
||
|
4C60000
|
direct allocation
|
page execute and read and write
|
||
|
4980000
|
heap
|
page read and write
|
||
|
4ABD000
|
trusted library allocation
|
page execute and read and write
|
||
|
A40000
|
unkown
|
page read and write
|
||
|
2E9E000
|
stack
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
3E9F000
|
stack
|
page read and write
|
||
|
C19000
|
unkown
|
page execute and write copy
|
||
|
4AC4000
|
trusted library allocation
|
page read and write
|
||
|
72BE000
|
stack
|
page read and write
|
||
|
E7E000
|
stack
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
4CF0000
|
heap
|
page read and write
|
||
|
4E21000
|
trusted library allocation
|
page read and write
|
||
|
CD2000
|
unkown
|
page execute and write copy
|
||
|
5B0000
|
heap
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
C52000
|
unkown
|
page execute and write copy
|
||
|
34DE000
|
stack
|
page read and write
|
||
|
4AE0000
|
direct allocation
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
4AA0000
|
trusted library allocation
|
page read and write
|
||
|
C1A000
|
unkown
|
page execute and read and write
|
||
|
6FBD000
|
stack
|
page read and write
|
||
|
2FDE000
|
stack
|
page read and write
|
||
|
399F000
|
stack
|
page read and write
|
||
|
71B0000
|
heap
|
page execute and read and write
|
||
|
C61000
|
unkown
|
page execute and write copy
|
||
|
BAB000
|
unkown
|
page execute and write copy
|
||
|
EC5000
|
heap
|
page read and write
|
||
|
4C4B000
|
trusted library allocation
|
page execute and read and write
|
||
|
A56000
|
unkown
|
page execute and write copy
|
||
|
CC6000
|
unkown
|
page execute and write copy
|
||
|
A46000
|
unkown
|
page write copy
|
||
|
A4A000
|
unkown
|
page execute and read and write
|
||
|
710E000
|
stack
|
page read and write
|
||
|
3D9E000
|
stack
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
91A000
|
heap
|
page read and write
|
||
|
4C40000
|
trusted library allocation
|
page read and write
|
||
|
C62000
|
unkown
|
page execute and read and write
|
||
|
4AB4000
|
trusted library allocation
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
C48000
|
unkown
|
page execute and write copy
|
||
|
2BDF000
|
stack
|
page read and write
|
||
|
2E5F000
|
stack
|
page read and write
|
||
|
43DE000
|
stack
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
4C47000
|
trusted library allocation
|
page execute and read and write
|
||
|
3ADF000
|
stack
|
page read and write
|
||
|
4B1C000
|
stack
|
page read and write
|
||
|
A42000
|
unkown
|
page execute and write copy
|
||
|
5E45000
|
trusted library allocation
|
page read and write
|
||
|
73BF000
|
stack
|
page read and write
|
||
|
44DF000
|
stack
|
page read and write
|
||
|
C4A000
|
unkown
|
page execute and read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
2997000
|
heap
|
page read and write
|
||
|
321F000
|
stack
|
page read and write
|
||
|
FCF000
|
stack
|
page read and write
|
||
|
4C1E000
|
stack
|
page read and write
|
||
|
451E000
|
stack
|
page read and write
|
||
|
439F000
|
stack
|
page read and write
|
||
|
C40000
|
unkown
|
page execute and read and write
|
||
|
C73000
|
unkown
|
page execute and write copy
|
||
|
A30000
|
direct allocation
|
page read and write
|
||
|
4AB3000
|
trusted library allocation
|
page execute and read and write
|
||
|
2D1F000
|
stack
|
page read and write
|
||
|
CE8000
|
unkown
|
page execute and write copy
|
||
|
349F000
|
stack
|
page read and write
|
||
|
C76000
|
unkown
|
page execute and read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
5E21000
|
trusted library allocation
|
page read and write
|
||
|
4C30000
|
direct allocation
|
page execute and read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
E3E000
|
stack
|
page read and write
|
||
|
CD8000
|
unkown
|
page execute and write copy
|
||
|
4AD0000
|
heap
|
page read and write
|
||
|
3D5E000
|
stack
|
page read and write
|
||
|
BD3000
|
unkown
|
page execute and write copy
|
||
|
A42000
|
unkown
|
page execute and read and write
|
||
|
415E000
|
stack
|
page read and write
|
||
|
954000
|
heap
|
page read and write
|
||
|
425F000
|
stack
|
page read and write
|
||
|
4C3A000
|
trusted library allocation
|
page execute and read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
411F000
|
stack
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
4AE0000
|
direct allocation
|
page read and write
|
||
|
461F000
|
stack
|
page read and write
|
||
|
4DFE000
|
stack
|
page read and write
|
||
|
325E000
|
stack
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
4C30000
|
trusted library allocation
|
page read and write
|
||
|
4CEC000
|
stack
|
page read and write
|
||
|
BA8000
|
unkown
|
page execute and read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
952000
|
heap
|
page read and write
|
||
|
C2E000
|
unkown
|
page execute and write copy
|
||
|
4AC0000
|
trusted library allocation
|
page read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
4AE0000
|
direct allocation
|
page read and write
|
||
|
C56000
|
unkown
|
page execute and read and write
|
||
|
BC9000
|
unkown
|
page execute and read and write
|
||
|
2980000
|
direct allocation
|
page read and write
|
||
|
C1E000
|
unkown
|
page execute and read and write
|
||
|
C34000
|
unkown
|
page execute and read and write
|
||
|
C5D000
|
unkown
|
page execute and write copy
|
||
|
3C1F000
|
stack
|
page read and write
|
||
|
4E10000
|
heap
|
page execute and read and write
|
||
|
339E000
|
stack
|
page read and write
|
||
|
6FC0000
|
trusted library allocation
|
page read and write
|
||
|
296F000
|
stack
|
page read and write
|
||
|
4981000
|
heap
|
page read and write
|
||
|
BC9000
|
unkown
|
page execute and write copy
|
||
|
2F9F000
|
stack
|
page read and write
|
||
|
335F000
|
stack
|
page read and write
|
||
|
91E000
|
heap
|
page read and write
|
||
|
A4A000
|
unkown
|
page execute and write copy
|
||
|
3B1E000
|
stack
|
page read and write
|
There are 181 hidden memdumps, click here to show them.