IOC Report
SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe

loading gif

Processes

Path
Cmdline
Malicious
C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe
"C:\Users\user\Desktop\SecuriteInfo.com.PUA.Tool.PassView.1835.14688.26789.exe"
 malicious

URLs

Name
IP
Malicious
http://www.nirsoft.net
unknown
http://www.nirsoft.net/
unknown

Memdumps

Base Address
Regiontype
Protect
Malicious
5EB000
heap
page read and write
 malicious
413000
unkown
page readonly
 malicious
413000
unkown
page readonly
 malicious
400000
unkown
page readonly
4F0000
heap
page read and write
401000
unkown
page execute read
580000
heap
page read and write
255E000
stack
page read and write
5A0000
heap
page read and write
5F0000
heap
page read and write
22E4000
heap
page read and write
520000
heap
page read and write
2220000
trusted library allocation
page read and write
19B000
stack
page read and write
617000
heap
page read and write
265F000
stack
page read and write
5F8000
heap
page read and write
417000
unkown
page read and write
57B000
heap
page read and write
47E000
stack
page read and write
610000
heap
page read and write
5CA000
heap
page read and write
22DE000
stack
page read and write
251F000
stack
page read and write
5C0000
heap
page read and write
3D9D000
heap
page read and write
609000
heap
page read and write
419000
unkown
page readonly
3D98000
heap
page read and write
3E90000
trusted library allocation
page read and write
22E0000
heap
page read and write
5CE000
heap
page read and write
57E000
heap
page read and write
417000
unkown
page write copy
400000
unkown
page readonly
401000
unkown
page execute read
420000
heap
page read and write
570000
heap
page read and write
88F000
stack
page read and write
419000
unkown
page readonly
430000
heap
page read and write
93000
stack
page read and write
4F5000
heap
page read and write
There are 33 hidden memdumps, click here to show them.