API tools faq
paste
Guest User

Untitled

a guest
Mar 14th, 2018
311
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 11.40 KB | None | 0 0
raw download clone embed print report
  1. 1. Using volatility pscan also I used pstree as well as psxviewwe find our processes are:
  2.  
  3. Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit
  4. ---------- -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
  5. 0x823c8830 System 4 0 58 573 ------ 0
  6. 0x81f04228 smss.exe 548 4 3 21 ------ 0 2010-02-26 03:34:02 UTC+0000
  7. 0x822eeda0 csrss.exe 612 548 12 423 0 0 2010-02-26 03:34:04 UTC+0000
  8. 0x81e5b2e8 winlogon.exe 644 548 21 521 0 0 2010-02-26 03:34:04 UTC+0000
  9. 0x82256da0 services.exe 688 644 16 293 0 0 2010-02-26 03:34:05 UTC+0000
  10. 0x82129da0 lsass.exe 700 644 22 416 0 0 2010-02-26 03:34:06 UTC+0000
  11. 0x81d3f020 vmacthlp.exe 852 688 1 35 0 0 2010-02-26 03:34:06 UTC+0000
  12. 0x82266870 svchost.exe 880 688 28 340 0 0 2010-02-26 03:34:07 UTC+0000
  13. 0x822e1da0 svchost.exe 948 688 10 276 0 0 2010-02-26 03:34:07 UTC+0000
  14. 0x822ea020 svchost.exe 1040 688 83 1515 0 0 2010-02-26 03:34:07 UTC+0000
  15. 0x81dea020 svchost.exe 1100 688 6 96 0 0 2010-02-26 03:34:07 UTC+0000
  16. 0x81de55f0 svchost.exe 1244 688 19 239 0 0 2010-02-26 03:34:08 UTC+0000
  17. 0x81dde568 spoolsv.exe 1460 688 11 129 0 0 2010-02-26 03:34:10 UTC+0000
  18. 0x821018b0 vmtoolsd.exe 1628 688 5 220 0 0 2010-02-26 03:34:25 UTC+0000
  19. 0x81ddd8d0 VMUpgradeHelper 1836 688 4 108 0 0 2010-02-26 03:34:34 UTC+0000
  20. 0x820d6b88 alg.exe 2024 688 7 130 0 0 2010-02-26 03:34:35 UTC+0000
  21. 0x81cdd790 explorer.exe 1756 1660 14 345 0 0 2010-02-26 03:34:38 UTC+0000
  22. 0x81ca96f0 VMwareTray.exe 1108 1756 1 59 0 0 2010-02-26 03:34:39 UTC+0000
  23. 0x820cd5c8 VMwareUser.exe 1116 1756 4 179 0 0 2010-02-26 03:34:39 UTC+0000
  24. 0x81cee5f8 wscntfy.exe 1132 1040 1 38 0 0 2010-02-26 03:34:40 UTC+0000
  25. 0x82333620 msiexec.exe 244 688 5 181 0 0 2010-02-26 03:46:06 UTC+0000
  26. 0x81ce1af8 msiexec.exe 452 244 0 -------- 0 0 2010-02-26 03:46:07 UTC+0000 2010-02-26 03:46:28 UTC+0000
  27. 0x81c80c78 wuauclt.exe 440 1040 8 188 0 0 2010-02-27 19:48:49 UTC+0000
  28. 0x8221a020 wuauclt.exe 232 1040 4 136 0 0 2010-02-27 19:49:11 UTC+0000
  29. 0x82068020 firefox.exe 888 1756 9 172 0 0 2010-02-27 20:11:53 UTC+0000
  30. 0x820618c8 AcroRd32.exe 1752 888 8 184 0 0 2010-02-27 20:12:23 UTC+0000
  31. 0x82209640 svchost.exe 1384 688 9 101 0 0 2010-02-27 20:12:36 UTC+0000
  32.  
  33. 2. Using volatility connscan we get :
  34.  
  35. Offset(P) Local Address Remote Address Pid
  36. ---------- ------------------------- ------------------------- ---
  37. 0x01e6a9f0 192.168.0.176:1176 212.150.164.203:80 888
  38. 0x01ec57c0 192.168.0.176:1189 192.168.0.1:9393 1244
  39. 0x01ed4270 192.168.0.176:2869 192.168.0.1:30379 1244
  40. 0x01eef808 192.168.0.176:2869 192.168.0.1:30380 4
  41. 0x01ffa7f8 0.0.0.0:0 80.206.204.129:0 0
  42. 0x02041108 127.0.0.1:1168 127.0.0.1:1169 888
  43. 0x0225a448 192.168.0.176:1172 66.249.91.104:80 888
  44. 0x0226ac58 127.0.0.1:1169 127.0.0.1:1168 888
  45. 0x0227ac58 192.168.0.176:1171 66.249.90.104:80 888
  46. 0x02308890 192.168.0.176:1178 212.150.164.203:80 1752
  47. 0x02323008 192.168.0.176:1184 193.104.22.71:80 880
  48. 0x02410440 192.168.0.176:1185 193.104.22.71:80 880
  49.  
  50. Being it is WinXP we also use connection:
  51.  
  52. Name Pid PPid Thds Hnds Time
  53. -------------------------------------------------- ------ ------ ------ ------ ----
  54. 0x81cdd790:explorer.exe 1756 1660 14 345 2010-02-26 03:34:38 UTC+0000
  55. . 0x820cd5c8:VMwareUser.exe 1116 1756 4 179 2010-02-26 03:34:39 UTC+0000
  56. . 0x81ca96f0:VMwareTray.exe 1108 1756 1 59 2010-02-26 03:34:39 UTC+0000
  57. . 0x82068020:firefox.exe 888 1756 9 172 2010-02-27 20:11:53 UTC+0000
  58. .. 0x820618c8:AcroRd32.exe 1752 888 8 184 2010-02-27 20:12:23 UTC+0000
  59. 0x823c8830:System 4 0 58 573 1970-01-01 00:00:00 UTC+0000
  60. . 0x81f04228:smss.exe 548 4 3 21 2010-02-26 03:34:02 UTC+0000
  61. .. 0x81e5b2e8:winlogon.exe 644 548 21 521 2010-02-26 03:34:04 UTC+0000
  62. ... 0x82256da0:services.exe 688 644 16 293 2010-02-26 03:34:05 UTC+0000
  63. .... 0x822ea020:svchost.exe 1040 688 83 1515 2010-02-26 03:34:07 UTC+0000
  64. ..... 0x81c80c78:wuauclt.exe 440 1040 8 188 2010-02-27 19:48:49 UTC+0000
  65. ..... 0x81cee5f8:wscntfy.exe 1132 1040 1 38 2010-02-26 03:34:40 UTC+0000
  66. ..... 0x8221a020:wuauclt.exe 232 1040 4 136 2010-02-27 19:49:11 UTC+0000
  67. .... 0x81de55f0:svchost.exe 1244 688 19 239 2010-02-26 03:34:08 UTC+0000
  68. .... 0x81ddd8d0:VMUpgradeHelper 1836 688 4 108 2010-02-26 03:34:34 UTC+0000
  69. .... 0x81dde568:spoolsv.exe 1460 688 11 129 2010-02-26 03:34:10 UTC+0000
  70. .... 0x822e1da0:svchost.exe 948 688 10 276 2010-02-26 03:34:07 UTC+0000
  71. .... 0x81dea020:svchost.exe 1100 688 6 96 2010-02-26 03:34:07 UTC+0000
  72. .... 0x821018b0:vmtoolsd.exe 1628 688 5 220 2010-02-26 03:34:25 UTC+0000
  73. .... 0x82209640:svchost.exe 1384 688 9 101 2010-02-27 20:12:36 UTC+0000
  74. .... 0x820d6b88:alg.exe 2024 688 7 130 2010-02-26 03:34:35 UTC+0000
  75. .... 0x82266870:svchost.exe 880 688 28 340 2010-02-26 03:34:07 UTC+0000
  76. .... 0x82333620:msiexec.exe 244 688 5 181 2010-02-26 03:46:06 UTC+0000
  77. ..... 0x81ce1af8:msiexec.exe 452 244 0 ------ 2010-02-26 03:46:07 UTC+0000
  78. .... 0x81d3f020:vmacthlp.exe 852 688 1 35 2010-02-26 03:34:06 UTC+0000
  79. ... 0x82129da0:lsass.exe 700 644 22 416 2010-02-26 03:34:06 UTC+0000
  80. .. 0x822eeda0:csrss.exe 612 548 12 423 2010-02-26 03:34:04 UTC+0000
  81.  
  82. Offset(V) PID Port Proto Protocol Address Create Time
  83. ---------- -------- ------ ------ --------------- --------------- -----------
  84. 0x81c94e98 4 0 47 GRE 0.0.0.0 2010-02-26 03:35:00 UTC+0000
  85. 0x81cf2998 1040 68 17 UDP 192.168.0.176 2010-02-27 20:12:35 UTC+0000
  86. 0x81c833a0 880 1185 6 TCP 0.0.0.0 2010-02-27 20:12:36 UTC+0000
  87. 0x81c9a3e8 4 1030 6 TCP 0.0.0.0 2010-02-26 03:35:00 UTC+0000
  88. 0x81d14298 700 500 17 UDP 0.0.0.0 2010-02-26 03:34:26 UTC+0000
  89. 0x82094450 4 138 17 UDP 192.168.0.176 2010-02-27 19:48:57 UTC+0000
  90. 0x82210c40 1244 1189 6 TCP 0.0.0.0 2010-02-27 20:12:37 UTC+0000
  91. 0x820ac218 1040 1181 17 UDP 192.168.0.176 2010-02-27 20:12:35 UTC+0000
  92. 0x81ce2488 1100 1047 17 UDP 0.0.0.0 2010-02-26 03:43:12 UTC+0000
  93. 0x81d0fe98 880 30301 6 TCP 0.0.0.0 2010-02-27 20:12:36 UTC+0000
  94. 0x81eb6c58 4 445 6 TCP 0.0.0.0 2010-02-26 03:34:02 UTC+0000
  95. 0x81d09d80 1040 123 17 UDP 192.168.0.176 2010-02-27 19:48:57 UTC+0000
  96. 0x823e6008 948 135 6 TCP 0.0.0.0 2010-02-26 03:34:07 UTC+0000
  97. 0x81c96b98 1752 1178 6 TCP 0.0.0.0 2010-02-27 20:12:32 UTC+0000
  98. 0x81c6cd80 888 1168 6 TCP 127.0.0.1 2010-02-27 20:11:53 UTC+0000
  99. 0x81d1a8b8 1752 1177 17 UDP 127.0.0.1 2010-02-27 20:12:32 UTC+0000
  100. 0x820c37d0 1244 2869 6 TCP 0.0.0.0 2010-02-27 20:12:37 UTC+0000
  101. 0x81deee18 1040 123 17 UDP 127.0.0.1 2010-02-27 19:48:57 UTC+0000
  102. 0x82080880 888 1171 6 TCP 0.0.0.0 2010-02-27 20:11:53 UTC+0000
  103. 0x820f4528 700 0 255 Reserved 0.0.0.0 2010-02-26 03:34:26 UTC+0000
  104. 0x81d1a1a0 1100 1025 17 UDP 0.0.0.0 2010-02-26 03:34:34 UTC+0000
  105. 0x82063008 1244 1900 17 UDP 192.168.0.176 2010-02-27 19:48:57 UTC+0000
  106. 0x81cc72b0 1040 1182 17 UDP 127.0.0.1 2010-02-27 20:12:35 UTC+0000
  107. 0x81c75390 4 139 6 TCP 192.168.0.176 2010-02-27 19:48:57 UTC+0000
  108. 0x81cbd320 1040 1186 17 UDP 127.0.0.1 2010-02-27 20:12:36 UTC+0000
  109. 0x820d3d70 2024 1026 6 TCP 127.0.0.1 2010-02-26 03:34:35 UTC+0000
  110. 0x8205be98 888 1172 6 TCP 0.0.0.0 2010-02-27 20:11:53 UTC+0000
  111. 0x82061740 888 1176 6 TCP 0.0.0.0 2010-02-27 20:12:28 UTC+0000
  112. 0x81c98ce0 1244 1900 17 UDP 127.0.0.1 2010-02-27 19:48:57 UTC+0000
  113. 0x81cde008 880 1184 6 TCP 0.0.0.0 2010-02-27 20:12:36 UTC+0000
  114. 0x820f4aa8 700 4500 17 UDP 0.0.0.0 2010-02-26 03:34:26 UTC+0000
  115. 0x82118008 4 137 17 UDP 192.168.0.176 2010-02-27 19:48:57 UTC+0000
  116. 0x81dd2a80 4 445 17 UDP 0.0.0.0 2010-02-26 03:34:02 UTC+0000
  117. 0x81dec370 888 1169 6 TCP 0.0.0.0 2010-02-27 20:11:53 UTC+0000
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!