Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\SysWOW64\mspaint.exe
|
mspaint.exe "C:\Users\user\Desktop\1_[NOM DE BASE]-[PAGE ACTUELLE]REF-9263GN_DOC01-1 CA.jpg"
|
Registry
|
Path
|
Value
|
Malicious
|
|
|---|---|---|---|
|
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
|
{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
2592AA27000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
22A6D602000
|
trusted library allocation
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
24AAA43E000
|
heap
|
page read and write
|
||
|
22EF7002000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
92CD000
|
trusted library allocation
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
9CE0000
|
trusted library allocation
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
19925240000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
66EE000
|
trusted library allocation
|
page read and write
|
||
|
4F02000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
22AC2F9000
|
stack
|
page read and write
|
||
|
7DBA000
|
trusted library allocation
|
page read and write
|
||
|
5030000
|
trusted library allocation
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
3408000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
F239CFC000
|
stack
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
1F754900000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
22A6CE10000
|
heap
|
page read and write
|
||
|
1F754058000
|
heap
|
page read and write
|
||
|
12FC6E5A000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
2196F82F000
|
heap
|
page read and write
|
||
|
2592AB00000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
1F754068000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
25C0900F000
|
unkown
|
page read and write
|
||
|
285C224A000
|
heap
|
page read and write
|
||
|
2592A7A0000
|
heap
|
page read and write
|
||
|
7920CFB000
|
stack
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
22EF6FE0000
|
heap
|
page read and write
|
||
|
EA2E87E000
|
stack
|
page read and write
|
||
|
7C66000
|
trusted library allocation
|
page read and write
|
||
|
ECB37FF000
|
stack
|
page read and write
|
||
|
2196F800000
|
heap
|
page read and write
|
||
|
1E3995C000
|
stack
|
page read and write
|
||
|
1E3A57E000
|
stack
|
page read and write
|
||
|
1E3A37F000
|
stack
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
2196F81F000
|
heap
|
page read and write
|
||
|
8E8C000
|
trusted library allocation
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
8ED5000
|
trusted library allocation
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
22AC67F000
|
stack
|
page read and write
|
||
|
24AAA413000
|
heap
|
page read and write
|
||
|
285C226E000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
56549FE000
|
stack
|
page read and write
|
||
|
2592AA5A000
|
heap
|
page read and write
|
||
|
7FB0000
|
trusted library allocation
|
page read and write
|
||
|
285C2030000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
E28BB7B000
|
stack
|
page read and write
|
||
|
1F754922000
|
heap
|
page read and write
|
||
|
7920DFB000
|
stack
|
page read and write
|
||
|
9150000
|
trusted library allocation
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
22A6D02E000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
80BA000
|
trusted library allocation
|
page read and write
|
||
|
7C8F000
|
trusted library allocation
|
page read and write
|
||
|
565449B000
|
stack
|
page read and write
|
||
|
8CCA000
|
trusted library allocation
|
page read and write
|
||
|
CC0591B000
|
stack
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
25C09013000
|
unkown
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
8162000
|
trusted library allocation
|
page read and write
|
||
|
1F754113000
|
heap
|
page read and write
|
||
|
285C2040000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
1F754089000
|
heap
|
page read and write
|
||
|
8EF8000
|
trusted library allocation
|
page read and write
|
||
|
285C2245000
|
heap
|
page read and write
|
||
|
1F754043000
|
heap
|
page read and write
|
||
|
2592AA4A000
|
heap
|
page read and write
|
||
|
644D000
|
trusted library allocation
|
page read and write
|
||
|
F23A1FD000
|
stack
|
page read and write
|
||
|
ECB327B000
|
stack
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
2196FE02000
|
trusted library allocation
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
7CAE000
|
trusted library allocation
|
page read and write
|
||
|
CC0607F000
|
stack
|
page read and write
|
||
|
4DE0000
|
heap
|
page read and write
|
||
|
921E000
|
trusted library allocation
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
523E000
|
stack
|
page read and write
|
||
|
3264000
|
heap
|
page read and write
|
||
|
12FC6C60000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
4DD1000
|
heap
|
page read and write
|
||
|
7C5C000
|
trusted library allocation
|
page read and write
|
||
|
8C6D000
|
trusted library allocation
|
page read and write
|