Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
C:\Windows\System32\loaddll64.exe
|
loaddll64.exe "C:\Users\user\Desktop\1.dll"
|
||
|
C:\Windows\System32\conhost.exe
|
C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
|
||
|
C:\Windows\System32\cmd.exe
|
cmd.exe /C rundll32.exe "C:\Users\user\Desktop\1.dll",#1
|
||
|
C:\Windows\System32\rundll32.exe
|
rundll32.exe "C:\Users\user\Desktop\1.dll",#1
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://crl.entrust.net/g2ca.crl0
|
unknown
|
||
|
http://crl.entrust.net/csbr1.crl0
|
unknown
|
||
|
http://ocsp.entrust.net03
|
unknown
|
||
|
http://ocsp.entrust.net02
|
unknown
|
||
|
http://ocsp.entrust.net01
|
unknown
|
||
|
http://www.entrust.net/rpa03
|
unknown
|
||
|
http://ocsp.entrust.net00
|
unknown
|
||
|
http://aia.entrust.net/ts1-chain256.cer01
|
unknown
|
||
|
http://aia.entrust.net/evcs2-chain.p7c01
|
unknown
|
||
|
http://crl.entrust.net/ts1ca.crl0
|
unknown
|
||
|
http://crl.entrust.net/evcs2.crl0
|
unknown
|
||
|
http://www.entrust.net/rpa0
|
unknown
|
||
|
http://crl.entrust.net/2048ca.crl0
|
unknown
|
||
|
https://www.entrust.net/rpa0
|
unknown
|
There are 4 hidden URLs, click here to show them.
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
1F250FA6000
|
heap
|
page read and write
|
||
|
1F250FA3000
|
heap
|
page read and write
|
||
|
1F250FC3000
|
heap
|
page read and write
|
||
|
1F250F1B000
|
heap
|
page read and write
|
||
|
D50AEFF000
|
stack
|
page read and write
|
||
|
1F250FA6000
|
heap
|
page read and write
|
||
|
1F254000000
|
heap
|
page read and write
|
||
|
1F250F9C000
|
heap
|
page read and write
|
||
|
1F250FAB000
|
heap
|
page read and write
|
||
|
D50ACFC000
|
stack
|
page read and write
|
||
|
1F250FA0000
|
heap
|
page read and write
|
||
|
1F250FA6000
|
heap
|
page read and write
|
||
|
4AE0AFE000
|
stack
|
page read and write
|
||
|
1F253F90000
|
heap
|
page read and write
|
||
|
25FB33E0000
|
heap
|
page read and write
|
||
|
1F250FAA000
|
heap
|
page read and write
|
||
|
1F250FA7000
|
heap
|
page read and write
|
||
|
25FB34F0000
|
heap
|
page read and write
|
||
|
1F250EE0000
|
heap
|
page read and write
|
||
|
1F250FB5000
|
heap
|
page read and write
|
||
|
25FB33ED000
|
heap
|
page read and write
|
||
|
25FB3610000
|
heap
|
page read and write
|
||
|
1F250FB0000
|
heap
|
page read and write
|
||
|
1F254540000
|
trusted library allocation
|
page read and write
|
||
|
1F250F80000
|
heap
|
page read and write
|
||
|
1F250F10000
|
heap
|
page read and write
|
||
|
1F252820000
|
heap
|
page read and write
|
||
|
25FB35D0000
|
heap
|
page read and write
|
||
|
25FB3710000
|
heap
|
page read and write
|
||
|
4AE0A7E000
|
stack
|
page read and write
|
||
|
1F250F9C000
|
heap
|
page read and write
|
||
|
1F250FAA000
|
heap
|
page read and write
|
||
|
4AE0B7F000
|
stack
|
page read and write
|
||
|
4AE07FA000
|
stack
|
page read and write
|
||
|
D50ADFE000
|
stack
|
page read and write
|
||
|
1F250F15000
|
heap
|
page read and write
|
||
|
1F250F88000
|
heap
|
page read and write
|
||
|
1F250FA6000
|
heap
|
page read and write
|
||
|
1F254003000
|
heap
|
page read and write
|
||
|
1F250EC0000
|
heap
|
page read and write
|
||
|
1F250DE0000
|
heap
|
page read and write
|
There are 31 hidden memdumps, click here to show them.