medium10 pts · first answer countsincident-responsememory-forensicsvolatility

Notepad talking to the internet

Volatility windows.netscan shows notepad.exe with an ESTABLISHED TCP connection to an external IP on port 443. Why is this suspicious?

A.Notepad always connects to Microsoft to check spelling, so it is normalB.Port 443 is only used by malware, so any program on it is badC.Notepad has no reason to make network connections, suggesting injected codeD.netscan only lists connections that the firewall already blocked

Discussion 0

Join free to post in the discussion.

Notepad talking to the internet

Discussion 0

Related questions