iPython Notebook Volatility Memory Forensics SilentBanker

3/6/13 IPython Notebook

Using Volatility to explore for signs of the SilentBanker Trojan

I [] !yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mmpls
n 1: pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve sit

Vltl SsesVltlt Faeok23apa
oaie ytm oaiiy rmwr ._lh
Ofe() Nm
fstV ae PD PI
I PD Td
hs Hd
ns Ss Ww4Sat
es o6 tr Ei
xt
----- ---------- --- --- --- ---- --- --- --------------- ---
----- ---------- --- --- --- ---- --- --- --------------- ---
------------
------------
08016 Sse
x1b60 ytm 4 0 59 13---
8 --- 0
0f2b2 ss.x
xfa00 msee 54
4 4 3 2 ---
1 --- 021-81 0:62 UC00
000-1 60:1 T+00
0f1ca crsee
xfed0 ss.x 68
0 54
4 11 35
6 0 021-81 0:62 UC00
000-1 60:3 T+00
0f1c7 wnoo.x
xfe98 ilgnee 62
3 54
4 18 51
1 0 021-81 0:62 UC00
000-1 60:3 T+00
0f272 srie.x
xf400 evcsee 66
7 62
3 16 29
6 0 021-81 0:62 UC00
000-1 60:4 T+00
0f252 lasee
xf500 ss.x 68
8 62
3 19 35
4 0 021-81 0:62 UC00
000-1 60:4 T+00
0f283 vatl.x
xf120 mchpee 84
4 66
7 1 24 0 021-81 0:62 UC00
000-1 60:4 T+00
08f8d scotee
x0f88 vhs.x 86
5 66
7 17 19
9 0 021-81 0:62 UC00
000-1 60:4 T+00
0f276 scotee
xf150 vhs.x 96
3 66
7 10 20
7 0 021-81 0:62 UC00
000-1 60:4 T+00
08ff1 scotee
x0b90 vhs.x 12
08 66
7 71 15
35 0 021-81 0:62 UC00
000-1 60:4 T+00
0f2d5 scotee
xf258 vhs.x 18
08 66
7 4 79 0 021-81 0:62 UC00
000-1 60:5 T+00
0f238 scotee
xf0b0 vhs.x 14
18 66
7 14 28
0 0 021-81 0:62 UC00
000-1 60:6 T+00
0f17a solvee
xfdd0 pos.x 13
42 66
7 13 15
3 0 021-81 0:62 UC00
000-1 60:6 T+00
0f182 vtos.x
xfbb8 moldee 16
68 66
7 5 22
2 0 021-81 0:63 UC00
000-1 60:5 T+00
0f1d8 VUgaeepr
xffc8 MprdHle 18
78 66
7 4 10
0 0 021-81 0:63 UC00
000-1 60:8 T+00
0f132 TAtCnSce
xf4b8 Puoonv. 16
98 66
7 5 10
0 0 021-81 0:63 UC00
000-1 60:9 T+00
0f2ae agee
xf570 l.x 26
1 66
7 6 15
0 0 021-81 0:63 UC00
000-1 60:9 T+00
0f341 wctyee
xf630 snf.x 88 12
8 08 1 27 0 021-81 0:64 UC00
000-1 60:9 T+00
0f3bf TAtCnete
xf858 Puoonc. 18
04 16
98 1 61 0 021-81 0:65 UC00
000-1 60:2 T+00
0f36d epoe.x
xf850 xlrree 12
74 10
78 12 37
1 0 021-81 0:92 UC00
000-1 60:9 T+00
0f36e VwrTa.x
xf678 Maeryee 42 12
3 74 1 49 0 021-81 0:93 UC00
000-1 60:1 T+00
0f348 VwrUe.x
xf790 Maesree 42 12
5 74 7 12
9 0 021-81 0:93 UC00
000-1 60:2 T+00
08f48 wactee
x0958 uul.x 48 12
6 08 4 15
3 0 021-81 0:93 UC00
000-1 60:7 T+00
08fb2 IXLR.X
x0100 EPOEEE 18
84 12
74 9 31
5 0 021-81 1:40 UC00
000-5 85:5 T+00
0f35c cdee
xf860 m.x 13
16 16
68 0----
---- 0 021-81 1:15 UC00
000-5 90:1 T+00 21-
00
0-51:15 UC00
81 90:1 T+00

I [] !yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mmpsa
n 2: pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve scn

Ofe() Nm
fstP ae PD PI PB
I PD D Tm cetd
ie rae Tm eie
ie xtd
----- -------- --- --- ----- --------------- ---------------
----- -------- --- --- ----- --------------- --------------
-
000e2 IXLR.X
x1700 EPOEEE 18
84 12 00c0a 21-81 1:40 UC00
74 x6c20 000-5 85:5 T+00
0003a wactee
x1cd0 uul.x 13
72 12 00c0c 21-81 0:74 UC00
08 x6c20 000-1 60:4 T+00 21-81 1:85 UC00
000-5 85:3 T+00
00078 wactee
x1f58 uul.x 48 12 00c08 21-81 0:93 UC00
6 08 x6c10 000-1 60:7 T+00
00121 scotee
x1290 vhs.x 12
08 6600c02 21-81 0:62 UC00
7 x6c10 000-1 60:4 T+00
001bd scotee
x1588 vhs.x 86
5 6600c0e 21-81 0:62 UC00
7 x6c00 000-1 60:4 T+00
00246 Sse
x1160 ytm 4 000390
x0100
001a2 TAtCnSce
x21b8 Puoonv. 16
98 6600c06 21-81 0:63 UC00
7 x6c20 000-1 60:9 T+00
0091f TAtCnete
x4c58 Puoonc. 18
04 16 00c02 21-81 0:65 UC00
98 x6c20 000-1 60:2 T+00
00a6d epoe.x
x4050 xlrree 12
74 10 00c08 21-81 0:92 UC00
78 x6c20 000-1 60:9 T+00
00a7c cdee
x4060 m.x 13
16 16 00c0c 21-81 1:15 UC00
68 x6c20 000-5 90:1 T+00 21-81 1:15 UC00
000-5 90:1 T+00
00ba8 VwrUe.x
x4590 Maesree 42 12 00c00 21-81 0:93 UC00
5 74 x6c30 000-1 60:2 T+00
00b9e VwrTa.x
x4e78 Maeryee 42 12 00c0e 21-81 0:93 UC00
3 74 x6c20 000-1 60:1 T+00
00cb1 wctyee
x4230 snf.x 88 12 00c00 21-81 0:64 UC00
8 08 x6c20 000-1 60:9 T+00
00412 ss.x
x5700 msee 54
4 400c02 21-81 0:62 UC00
x6c00 000-1 60:1 T+00
00f2e agee
x5070 l.x 26
1 6600c04 21-81 0:63 UC00
7 x6c20 000-1 60:9 T+00
00f72 lasee
x5400 ss.x 68
8 6200c0a 21-81 0:62 UC00
3 x6c00 000-1 60:4 T+00
00052 srie.x
x6100 evcsee 66
7 6200c08 21-81 0:62 UC00
3 x6c00 000-1 60:4 T+00
001f5 scotee
x6e58 vhs.x 18
08 6600c04 21-81 0:62 UC00
7 x6c10 000-1 60:5 T+00
00343 vatl.x
x6820 mchpee 84
4 6600c0c 21-81 0:62 UC00
7 x6c00 000-1 60:4 T+00
00356 scotee
x6c50 vhs.x 96
3 6600c00 21-81 0:62 UC00
7 x6c10 000-1 60:4 T+00
00498 scotee
x69b0 vhs.x 14
18 6600c06 21-81 0:62 UC00
7 x6c10 000-1 60:6 T+00
005f8 VUgaeepr
x65c8 MprdHle 18
78 6600c0e 21-81 0:63 UC00
7 x6c10 000-1 60:8 T+00
00607 wnoo.x
x6f98 ilgnee 62
3 5400c06 21-81 0:62 UC00
4 x6c00 000-1 60:3 T+00
0060a crsee
x6fd0 ss.x 68
0 5400c04 21-81 0:62 UC00
4 x6c00 000-1 60:3 T+00
0095a solvee
x64d0 pos.x 13
42 6600c0a 21-81 0:62 UC00
7 x6c10 000-1 60:6 T+00
00952 vtos.x
x6db8 moldee 16
68 6600c0c 21-81 0:63 UC00
7 x6c10 000-1 60:5 T+00

I [] dt =!yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mmpls
n 3: aa pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve sit
dt
aa

Ot3: [Vltl SsesVltlt Faeok23apa,
u[] 'oaie ytm oaiiy rmwr ._lh'

127.0.0.1:8888/ba57c8ab-a007-4bff-a15f-b95809b912b3/print 1/6

Ot3: [Vltl SsesVltlt Faeok23apa,
u[] 'oaie ytm oaiiy rmwr ._lh'
'fstV Nm
Ofe() ae PD PI
I PD Td hs Hd
ns Ss Ww4Sat
es o6 tr Ei
xt
',
'--------------- --- --- --- ---- --- --- --------------- --
----- ---------- --- --- --- ---- --- --- --------------- --
-------------'
-------------,
'x1b60Sse
08016 ytm 4 0 59 13---
8 --- 0
',
'xfa00ss.x
0f2b2 msee 54
4 4 3 2 ---
1 --- 021-81 0:62 UC00
000-1 60:1 T+00
',
'xfed0crsee
0f1ca ss.x 68
0 54
4 11 35
6 0 021-81 0:62 UC00
000-1 60:3 T+00
',
'xfe98wnoo.x
0f1c7 ilgnee 62
3 54
4 18 51
1 0 021-81 0:62 UC00
000-1 60:3 T+00
',
'xf400srie.x
0f272 evcsee 66
7 62
3 16 29
6 0 021-81 0:62 UC00
000-1 60:4 T+00
',
'xf500lasee
0f252 ss.x 68
8 62
3 19 35
4 0 021-81 0:62 UC00
000-1 60:4 T+00
',
'xf120vatl.x
0f283 mchpee 84
4 66
7 1 24 0 021-81 0:62 UC00
000-1 60:4 T+00
',
'x0f88scotee
08f8d vhs.x 86
5 66
7 17 19
9 0 021-81 0:62 UC00
000-1 60:4 T+00
',
'xf150scotee
0f276 vhs.x 96
3 66
7 10 20
7 0 021-81 0:62 UC00
000-1 60:4 T+00
',
'x0b90scotee
08ff1 vhs.x 12
08 66
7 71 15
35 0 021-81 0:62 UC00
000-1 60:4 T+00
',
'xf258scotee
0f2d5 vhs.x 18
08 66
7 4 79 0 021-81 0:62 UC00
000-1 60:5 T+00
',
'xf0b0scotee
0f238 vhs.x 14
18 66
7 14 28
0 0 021-81 0:62 UC00
000-1 60:6 T+00
',
'xfdd0solvee
0f17a pos.x 13
42 66
7 13 15
3 0 021-81 0:62 UC00
000-1 60:6 T+00
',
'xfbb8vtos.x
0f182 moldee 16
68 66
7 5 22
2 0 021-81 0:63 UC00
000-1 60:5 T+00
',
'xffc8VUgaeepr
0f1d8 MprdHle 18
78 66
7 4 10
0 0 021-81 0:63 UC00
000-1 60:8 T+00
',
'xf4b8TAtCnSce
0f132 Puoonv. 16
98 66
7 5 10
0 0 021-81 0:63 UC00
000-1 60:9 T+00
',
'xf570agee
0f2ae l.x 26
1 66
7 6 15
0 0 021-81 0:63 UC00
000-1 60:9 T+00
',
'xf630wctyee
0f341 snf.x 88 12
8 08 1 27 0 021-81 0:64 UC00
000-1 60:9 T+00
',
'xf858TAtCnete
0f3bf Puoonc. 18
04 16
98 1 61 0 021-81 0:65 UC00
000-1 60:2 T+00
',
'xf850epoe.x
0f36d xlrree 12
74 10
78 12 37
1 0 021-81 0:92 UC00
000-1 60:9 T+00
',
'xf678VwrTa.x
0f36e Maeryee 42 12
3 74 1 49 0 021-81 0:93 UC00
000-1 60:1 T+00
',
'xf790VwrUe.x
0f348 Maesree 42 12
5 74 7 12
9 0 021-81 0:93 UC00
000-1 60:2 T+00
',
'x0958wactee
08f48 uul.x 48 12
6 08 4 15
3 0 021-81 0:93 UC00
000-1 60:7 T+00
',
'x0100IXLR.X
08fb2 EPOEEE 18
84 12
74 9 31
5 0 021-81 1:40 UC00
000-5 85:5 T+00
',
'xf860cdee
0f35c m.x 13
16 16
68 0----
---- 0 021-81 1:15 UC00
000-5 90:1 T+00
21-81 1:15 UC00 '
000-5 90:1 T+00 ]

I [] !yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mmcnetos
n 6: pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve oncin

Ofe() LclAdes
fstV oa drs Rmt Ades
eoe drs Pd
i
----- ----------------------------
----- ------------ ------------ -

I [] !yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mmsces
n 7: pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve okt

Ofe()
fstV PD Pr PooPooo
I ot rt rtcl Ades
drs Cet Tm
rae ie
----- ---- --- --- ----------------------
----- ---- --- --- ------- ------- -----
08f10
x0d08 4 0 4 GE
7 R 0000
... 21-81 0:80 UC00
000-1 60:0 T+00
0f321
xf6d8 18
08 16
06 1 UP
7 D 0000
... 21-81 1:41 UC00
000-5 85:3 T+00
0f280
xf508 68
8 50
0 1 UP
7 D 0000
... 21-81 0:63 UC00
000-1 60:5 T+00
0f370
xf608 4 45
4 6TP
C 0000
... 21-81 0:61 UC00
000-1 60:7 T+00
08fc2
x0f18 96
3 15
3 6TP
C 0000
... 21-81 0:62 UC00
000-1 60:4 T+00
0f257
xf2b0 68
8 0 25Rsre
5 eevd 0000
... 21-81 0:63 UC00
000-1 60:5 T+00
0f240
xf508 12
08 13
2 1 UP
7 D 17001
2... 21-81 1:15 UC00
000-5 90:1 T+00
08fe3
x0c90 18
08 12
05 1 UP
7 D 0000
... 21-81 0:63 UC00
000-1 60:8 T+00
0f172
xf2d8 26 12
1 06 6TP
C 17001
2... 21-81 0:63 UC00
000-1 60:9 T+00



0f20c
xf680 18
08 15
03 1 UP
7 D 0000
... 21-81 1:40 UC00
000-5 85:9 T+00
08fc0
x0d78 18
84 15
01 1 UP
7 D 17001
2... 21-81 1:40 UC00
000-5 85:7 T+00
0f282
xf420 14
18 10
90 1 UP
7 D 17001
2... 21-81 1:15 UC00
000-5 90:1 T+00
0f185
xfb20 68
8 40
50 1 UP
7 D 0000
... 21-81 0:63 UC00
000-1 60:5 T+00
0f329
xf8e8 4 13
03 6TP
C 0000
... 21-81 0:80 UC00
000-1 60:0 T+00
08fd4
x0bc0 4 45
4 1 UP
7 D 0000
... 21-81 0:61 UC00
000-1 60:7 T+00

I [] !yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mmhvls
n 9: pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve ieit

Vrul
ita Pyia
hscl Nm
ae
----- ----- --
----- ----- --
0ec90 006c0 eieHrdsVlm1DcmnsadStigoaSrieLclStigplcto
x1408 x3d08 Dvcadikoueouet n etnsLclevcoa etnsApiain
DtirsfidwsCasdt
aaMcootWnosUrls.a
0ec16 00006 eieHrdsVlm1DcmnsadStigoaSrieNUE.A
x14b0 x41b0 Dvcadikoueouet n etnsLclevcTSRDT
0ea93 001b3 eieHrdsVlm1DcmnsadStigewrSrieLclStigplcto
x1368 x2e68 Dvcadikoueouet n etnsNtokevcoa etnsApiain
DtirsfidwsCasdt
aaMcootWnosUrls.a
0ea30 00f80 eieHrdsVlm1DcmnsadStigewrSrieNUE.A
x1308 x1908 Dvcadikoueouet n etnsNtokevcTSRDT
0e5a6 00bd6 eieHrdsVlm1WNOSsse3ofgsfwr
x13b0 x67b0 DvcadikoueIDWytm2cniotae
0e520 00c80 eieHrdsVlm1WNOSsse3ofgdfut
x1408 x6408 DvcadikoueIDWytm2cnieal
0e576 00a46 ytmotSse3ofgSCRT
x13b0 x6eb0 SseRoytm2CniEUIY
0e540 00cb0 eieHrdsVlm1WNOSsse3ofgSM
x1408 x6408 DvcadikoueIDWytm2cniA
0e3e8 00bd8 [onm]
x1a50 x1b50 n ae
0e0b0 00870 eieHrdsVlm1WNOSsse3ofgsse
x1108 x1608 DvcadikoueIDWytm2cniytm
0e087 00847 [onm]
x1098 x1298 n ae
0ee5c 0092c eieHrdsVlm1DcmnsadStigdiitaooa Stigplcto
x1180 x0780 Dvcadikoueouet n etnsAmnsrtrLcl etnsApiain
DtirsfidwsCasdt
aaMcootWnosUrls.a
0ed40 00fe0 eieHrdsVlm1DcmnsadStigdiitaoTSRDT
x1a08 x0608 Dvcadikoueouet n etnsAmnsrtrNUE.A

I [0: #- =IDWytm2cniA
n 1] y WNOSsse3ofgSM
#- =IDWytm2cniytm
s WNOSsse3ofgsse
!yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mm-poieWnPPx6hsdm
pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve -rfl iXS28 ahup

Amnsrtr50e2a6499243183ac6:867aef17d6d8078c:
diitao:0:5cc71aa2ab0ff6bd84fee8b1a0bd3b56::
Get51adb3b10eadb3b10e:16f01a917c970090:
us:0:a345544ea345544e3dced6e3b35dec8c::
HlAssat10:e5c0045c58e4ea3b8241c538e7c5e908::
epsitn:00487042e3d3d6ddc6:4b034abfc6a45151:
SPOT384a:02adb3b10eadb3b10e:f78a12f77c28a4e1:
UPR_895010:a345544ea345544e8535645c8436a29a::

I [1: tx_tig =!tig /otDstpmmslnbne.mm
n 1] etsrns srns ro/eko/e/ietakrve

I [2: tx_tig[:0
n 1] etsrns01]

Ot1] [sON'
u[2: 'Qt2,
'+`'
ta$,
'nai priint'
Ivld atto a,
' laigoeaigsse'
r odn prtn ytm,
'isn oeaigsse'
Msig prtn ytm,
'DL,
,c'
'IE'
FL0,
'IE'
FL0,
'IE'
FL0,
'IE'
FL0]

I [3: dfgep(erhtr,tx_tig)
n 1] e rpysac_em etsrns:
tm_it[
epls=]
frie i tx_tig:
o tm n etsrns
i sac_emi ie:
f erhtr n tm
tm_itapn(tm
epls.pedie)
rtr tm_it
eun epls

gep(Vstd " tx_tig)
rpy"iie: , etsrns

Ot1] [Vstd Amnsrtrht:/oemcootcm,
u[3: 'iie: diitao@tp/hm.irsf.o'
'iie:AmnsrtraotHm'
Vstd diitao@bu:oe,
'iie:Amnsrtrht:/w.irsf.o/sp/ei.l?r=epe=&rmnoe,
Vstd diitao@tp/wwmcootcmiairdrdlpdi&vr6a=shm'
'iie:Amnsrtrht:/w.s.o'
Vstd diitao@tp/wwmncm,
'iie:Amnsrtrht:/oemcootcm,
Vstd diitao@tp/hm.irsf.o'
'iie:AmnsrtraotHm'
Vstd diitao@bu:oe,
'iie:Amnsrtrht:/w.s.o'
Vstd diitao@tp/wwmncm,
'iie:Amnsrtrfl:/C/IDW/ytm2ob/cselhm,
Vstd diitao@ie//:WNOSsse3/oeathl.t'



'wiie:Amnsrtrhp/sse/optt/optoehm,
wVstd diitao@c:/ytmcmacrcmamd.t'
'wiie:Amnsrtrhp/sse/optt/optoehm]
wVstd diitao@c:/ytmcmacrcmamd.t'

I [4: scesls =!yhn/ets/oesc/oaiiyvlp - ~Dstpmmslnbne.mmsces
n 1] okt_it pto pnetfrnisvltlt/o.y f /eko/e/ietakrve okt

I [5: frie i scesls[::
n 1] o tm n okt_it3]
ie =ie.pi(
tm tmslt)
pitie[] ie[] ie[]
rn tm5, tm6, tm7

000021-81 0:80
... 000-1 60:0
000021-81 1:41
... 000-5 85:3
000021-81 0:63
... 000-1 60:5
000021-81 0:61
... 000-1 60:7
000021-81 0:62
... 000-1 60:4
000021-81 0:63
... 000-1 60:5
1700121-81 1:15
2... 000-5 90:1
000021-81 0:63
... 000-1 60:8
1700121-81 0:63
2... 000-1 60:9
000021-81 1:40
... 000-5 85:9
1700121-81 1:40
2... 000-5 85:7
1700121-81 1:15
2... 000-5 90:1
000021-81 0:63
... 000-1 60:5
000021-81 0:80
... 000-1 60:0
000021-81 0:61
... 000-1 60:7

I [6: scesls
n 1] okt_it

Ot1] [Vltl SsesVltlt Faeok23apa,
u[6: 'oaie ytm oaiiy rmwr ._lh'
'fstV
Ofe() PD Pr PooPooo
I ot rt rtcl Ades
drs Cet Tm'
rae ie,
'--------- --- --- ----------------------,
----- ---- --- --- ------- ------- -----'
'x0d08
08f10 4 0 4 GE
7 R 0000
... 21-81 0:80 UC00'
000-1 60:0 T+00,
'xf6d8
0f321 18
08 1606 1 UP
7 D 0000
... 21-81 1:41 UC00'
000-5 85:3 T+00,
'xf508
0f280 68
8 50
0 1 UP
7 D 0000
... 21-81 0:63 UC00'
000-1 60:5 T+00,
'xf608
0f370 4 45
4 6TP
C 0000
... 21-81 0:61 UC00'
000-1 60:7 T+00,
'x0f18
08fc2 96
3 15
3 6TP
C 0000
... 21-81 0:62 UC00'
000-1 60:4 T+00,
'xf2b0
0f257 68
8 0 25Rsre
5 eevd 0000
... 21-81 0:63 UC00'
000-1 60:5 T+00,
'xf508
0f240 12
08 13
2 1 UP
7 D 17001
2... 21-81 1:15 UC00'
000-5 90:1 T+00,
'x0c90
08fe3 18
08 1205 1 UP
7 D 0000
... 21-81 0:63 UC00'
000-1 60:8 T+00,
'xf2d8
0f172 26 12
1 06 6TP
C 17001
2... 21-81 0:63 UC00'
000-1 60:9 T+00,
'xf680
0f20c 18
08 1503 1 UP
7 D 0000
... 21-81 1:40 UC00'
000-5 85:9 T+00,
'x0d78
08fc0 18
84 1501 1 UP
7 D 17001
2... 21-81 1:40 UC00'
000-5 85:7 T+00,
'xf420
0f282 14
18 1090 1 UP
7 D 17001
2... 21-81 1:15 UC00'
000-5 90:1 T+00,
'xfb20
0f185 68 40
8 50 1 UP
7 D 0000
... 21-81 0:63 UC00'
000-1 60:5 T+00,
'xf8e8
0f329 4 13
03 6TP
C 0000
... 21-81 0:80 UC00'
000-1 60:0 T+00,
'x0bc0
08fd4 4 45
4 1 UP
7 D 0000
... 21-81 0:61 UC00'
000-1 60:7 T+00]

I [7: !yhn/ets/oesc/oaiiyvlp - ~Dstpmmslnbne.mmmlid
n 1] pto pnetfrnisvltlt/o.y f /eko/e/ietakrve afn

Poes crseePd 68Ades 07600
rcs: ss.x i: 0 drs: xff00
VdTg Vd Poeto:PG_XCT_EDRT
a a: a rtcin AEEEUERAWIE
Fas Poeto:6
lg: rtcin

07600
xff00 c 0 0 0 f 0 0 0 f e f e 0 7 0 0
8 0 0 0 f 1 0 0 f e f e 8 0 0 0 ........
......p.
07601
xff00 0 0 0 0 0 f 0 0 0 0 1 0 0 2 0 0
8 0 0 0 0 e 0 0 0 0 0 0 0 0 0 0 ........
........
07602
xff00 0 0 0 0 0 2 0 0 8 0 0 0 f e f 7
0 2 0 0 0 0 0 0 d 1 0 0 f f d f ........
........
07603
xff00 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
3 0 8 6 0 0 0 0 0 0 0 0 0 0 0 0 ........
........

07600 c000
xff00 8000 ETR00 00
NE x, x
07600 f0
xff04 f1 ICDOD[C]
N WR EX
07600 00
xff06 00 AD[A] A
D EX, L
07600 f
xff08 f D 0f
B xf
07600 e
xff09 e OTD,A
U X L
07600 f
xff0a f D 0f
B xf
07600 e
xff0b e OTD,A
U X L
07600 070
xff0c 800 O [A+x] D
R EX00, H
07600 00
xff0f 08 AD[A] C
D EX, L
07601 00
xff01 00 AD[A] A
D EX, L
07601 00
xff03 00 AD[A] A
D EX, L
I [8: dlupls =!yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mmdlup- 18
n 1] ldm_it pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve ldm p 84

I [9: dlupls
n 1] ldm_it



Ot1] [Vltl SsesVltlt Faeok23apa,
u[9: 'oaie ytm oaiiy rmwr ._lh'
'rcs()Nm
PoesV ae Mdl Bs Mdl Nm
oue ae oue ae Rsl'
eut,
'--------------- ---------------- ---'
----- ---------- ----- ---------- ---,
'x0100IXLR.X
08fb2 EPOEEE 000000ixlr.x
x0400 epoeee O:mdl.841700400.l'
K oue18.0e2.000dl,
'x0100IXLR.X
08fb2 EPOEEE 00c000ndldl
x7900 tl.l O:mdl.8417007900.l'
K oue18.0e2.c000dl,
'x0100IXLR.X
08fb2 EPOEEE 007e00MAM2dl
x7b00 SC3.l O:mdl.8417007b00.l'
K oue18.0e2.7e00dl,
'x0100IXLR.X
08fb2 EPOEEE 007400apepdl
x7b00 pHl.l O:mdl.8417007b00.l'
K oue18.0e2.7400dl,
'x0100IXLR.X
08fb2 EPOEEE 006300WNRS.l
x7c00 ITUTdl O:mdl.8417007c00.l'
K oue18.0e2.6300dl,
'x0100IXLR.X
08fb2 EPOEEE 007600SDCWdl
x7700 HOV.l O:mdl.8417007700.l'
K oue18.0e2.7600dl,
'x0100IXLR.X
08fb2 EPOEEE 00a700uteedl
x5d00 xhm.l O:mdl.8417005d00.l'
K oue18.0e2.a700dl,
'x0100IXLR.X
08fb2 EPOEEE 006800ruisdl
x7e00 ttl.l O:mdl.8417007e00.l'
K oue18.0e2.6800dl,
'x0100IXLR.X
08fb2 EPOEEE 005800BOSU.l
x7f00 RWEIdl O:mdl.8417007f00.l'
K oue18.0e2.5800dl,
'x0100IXLR.X
08fb2 EPOEEE 000000bosl.l
x2000 rwecdl O:mdl.8417002000.l'
K oue18.0e2.0000dl,
'x0100IXLR.X
08fb2 EPOEEE 006c00UEEVdl
x7900 SRN.l O:mdl.8417007900.l'
K oue18.0e2.6c00dl,
'x0100IXLR.X
08fb2 EPOEEE 007b00WNNTdl
x7100 IIE.l O:mdl.8417007100.l'
K oue18.0e2.7b00dl,
'x0100IXLR.X
08fb2 EPOEEE 004f00mit.l
x7600 smfdl O:mdl.8417007600.l'
K oue18.0e2.4f00dl,
'x0100IXLR.X
08fb2 EPOEEE 006c00rsdl.l
x7f00 aahpdl O:mdl.8417007f00.l'
K oue18.0e2.6c00dl,
'x0100IXLR.X
08fb2 EPOEEE 007d00AVP3.l
x7d00 DAI2dl O:mdl.8417007d00.l'
K oue18.0e2.7d00dl,
'x0100IXLR.X
08fb2 EPOEEE 006200DSP.l
x7f00 NAIdl O:mdl.8417007f00.l'
K oue18.0e2.6200dl,
'x0100IXLR.X
08fb2 EPOEEE 006600WDP2dl
x7f00 LA3.l O:mdl.8417007f00.l'
K oue18.0e2.6600dl,
'x0100IXLR.X
08fb2 EPOEEE 001900whci.l
x7a00 stppdl O:mdl.8417007a00.l'
K oue18.0e2.1900dl,
'x0100IXLR.X
08fb2 EPOEEE 00e100pgitdl
x5300 nfl.l O:mdl.8417005300.l'
K oue18.0e2.e100dl,
'x0100IXLR.X
08fb2 EPOEEE 007000VRINdl
x7c00 ESO.l O:mdl.8417007c00.l'
K oue18.0e2.7000dl,
'x0100IXLR.X
08fb2 EPOEEE 002b00snaidl
x7200 esp.l O:mdl.8417007200.l'
K oue18.0e2.2b00dl,
'x0100IXLR.X
08fb2 EPOEEE 006d00CBAQDL
x7f00 LCT.L O:mdl.8417007f00.l'
K oue18.0e2.6d00dl,
'x0100IXLR.X
08fb2 EPOEEE 007600SLAIdl
x7f00 HWP.l O:mdl.8417007f00.l'
K oue18.0e2.7600dl,
'x0100IXLR.X
08fb2 EPOEEE 004200MCFdl
x7700 ST.l O:mdl.8417007700.l'
K oue18.0e2.4200dl,
'x0100IXLR.X
08fb2 EPOEEE 001500mwokdl
x7a00 ssc.l O:mdl.8417007a00.l'
K oue18.0e2.1500dl,
'x0100IXLR.X
08fb2 EPOEEE 006000mhme.l
x7200 stlddl O:mdl.8417007200.l'
K oue18.0e2.6000dl,
'x0100IXLR.X
08fb2 EPOEEE 00b600NTP3.l
x5800 EAI2dl O:mdl.8417005800.l'
K oue18.0e2.b600dl,
'x0100IXLR.X
08fb2 EPOEEE 007700RCT.l
x7e00 PR4dl O:mdl.8417007e00.l'
K oue18.0e2.7700dl,
'x0100IXLR.X
08fb2 EPOEEE 006800Igtldl
x6800 mUi.l O:mdl.8417006800.l'
K oue18.0e2.6800dl,
'x0100IXLR.X
08fb2 EPOEEE 006500ipesdl
x6e00 eer.l O:mdl.8417006e00.l'
K oue18.0e2.6500dl,
'x0100IXLR.X
08fb2 EPOEEE 006900rsa.l
x7e00 amndl O:mdl.8417007e00.l'
K oue18.0e2.6900dl,
'x0100IXLR.X
08fb2 EPOEEE 001200sdccdl
x0500 hol.l O:mdl.8417001200dl,
K oue18.0e2.500.l'
'x0100IXLR.X
08fb2 EPOEEE 001b00xs2e.l
x0500 pprsdl O:mdl.8417001b00dl,
K oue18.0e2.500.l'
'x0100IXLR.X
08fb2 EPOEEE 001b00w23.l
x7a00 s_2dl O:mdl.8417007a00.l'
K oue18.0e2.1b00dl,
'x0100IXLR.X
08fb2 EPOEEE 001d00wok2dl
x7a00 sc3.l O:mdl.8417007a00.l'
K oue18.0e2.1d00dl,
'x0100IXLR.X
08fb2 EPOEEE 00df00WNTPdl
x4400 IHT.l O:mdl.8417004400.l'
K oue18.0e2.df00dl,
'x0100IXLR.X
08fb2 EPOEEE 007e00oe2dl
x7400 l3.l O:mdl.8417007400.l'
K oue18.0e2.7e00dl,
'x0100IXLR.X
08fb2 EPOEEE 007200STPP.l
x7900 EUAIdl O:mdl.8417007900.l'
K oue18.0e2.7200dl,
'x0100IXLR.X
08fb2 EPOEEE 006400WNMdl
x7b00 IM.l O:mdl.8417007b00.l'
K oue18.0e2.6400dl,
'x0100IXLR.X
08fb2 EPOEEE 003000WNPO.R
x7000 ISOLDV O:mdl.8417007000.l'
K oue18.0e2.3000dl,
'x0100IXLR.X
08fb2 EPOEEE 007100GI2dl
x7f00 D3.l O:mdl.8417007f00.l'
K oue18.0e2.7100dl,
'x0100IXLR.X
08fb2 EPOEEE 007200OEU3.l
x7100 LAT2dl O:mdl.8417007100.l'
K oue18.0e2.7200dl,
'x0100IXLR.X
08fb2 EPOEEE 007400UE3.l
x7d00 SR2dl O:mdl.8417007d00.l'
K oue18.0e2.7400dl,
'x0100IXLR.X
08fb2 EPOEEE 005900SSDL
x7e00 X.L O:mdl.8417007e00.l'
K oue18.0e2.5900dl,
'x0100IXLR.X
08fb2 EPOEEE 006e00RSP3.L
x7e00 AAI2DL O:mdl.8417007e00.l'
K oue18.0e2.6e00dl,
'x0100IXLR.X
08fb2 EPOEEE 006600ihpp.l
x7d00 plaidl O:mdl.8417007d00.l'
K oue18.0e2.6600dl,
'x0100IXLR.X
08fb2 EPOEEE 004800mxl.l
x7900 sm3dl O:mdl.8417007900.l'
K oue18.0e2.4800dl,
'x0100IXLR.X
08fb2 EPOEEE 006900IM2DL
x7300 M3.L O:mdl.8417007300.l'
K oue18.0e2.6900dl,
'x0100IXLR.X
08fb2 EPOEEE 00cc00SEL2dl
x7900 HL3.l O:mdl.8417007900.l'
K oue18.0e2.cc00dl,
'x0100IXLR.X
08fb2 EPOEEE 00c000kre3.l
x7800 enl2dl O:mdl.8417007800.l'
K oue18.0e2.c000dl,
'x0100IXLR.X
08fb2 EPOEEE 007d00cmt3.l
x7300 ocl2dl O:mdl.8417007300.l'
K oue18.0e2.7d00dl,
'x0100IXLR.X
08fb2 EPOEEE 005500jcitdl
x7c00 srp.l O:mdl.8417007c00.l'
K oue18.0e2.5500dl,
'x0100IXLR.X
08fb2 EPOEEE 006000CCL.l
x7600 SDLdl O:mdl.8417007600.l'
K oue18.0e2.6000dl,
'x0100IXLR.X
08fb2 EPOEEE 006b00hecgdl
x6200 ntf.l O:mdl.8417006200.l'
K oue18.0e2.6b00dl,
'x0100IXLR.X
08fb2 EPOEEE 007100mvr.l
x7c00 sctdl O:mdl.8417007c00.l'
K oue18.0e2.7100dl,
'x0100IXLR.X
08fb2 EPOEEE 005d00CYTIdl
x7400 RPU.l O:mdl.8417007400.l'
K oue18.0e2.5d00dl,
'x0100IXLR.X
08fb2 EPOEEE 007200ccidl
x7a00 su.l O:mdl.8417007a00.l'
K oue18.0e2.7200dl,
'x0100IXLR.X
08fb2 EPOEEE 00d300mhm.l
x7c00 stldl O:mdl.8417007c00.l'
K oue18.0e2.d300dl,
'x0100IXLR.X
08fb2 EPOEEE 007d00mdmpdl
x7b00 iia.l O:mdl.8417007b00.l'
K oue18.0e2.7d00dl,
'x0100IXLR.X
08fb2 EPOEEE 007500CMe.l
x7000 ORsdl O:mdl.8417007000.l'
K oue18.0e2.7500dl,
'x0100IXLR.X
08fb2 EPOEEE 007600ulo.l
x7200 rmndl O:mdl.8417007200.l'
K oue18.0e2.7600dl,
'x0100IXLR.X
08fb2 EPOEEE 006b00TP3.l
x7e00 AI2dl O:mdl.8417007e00.l'
K oue18.0e2.6b00dl,
'x0100IXLR.X
08fb2 EPOEEE 007700mv_.l
x7c00 s10dl O:mdl.8417007c00.l'
K oue18.0e2.7700dl,
'x0100IXLR.X
08fb2 EPOEEE 002200wmu.r
x7d00 daddv O:mdl.8417007d00.l'
K oue18.0e2.2200dl,
'x0100IXLR.X
08fb2 EPOEEE 007800CYT2dl
x7a00 RP3.l O:mdl.8417007a00.l'
K oue18.0e2.7800dl,
'x0100IXLR.X
08fb2 EPOEEE 006900IAEL.l
x7c00 MGHPdl O:mdl.8417007c00.l'
K oue18.0e2.6900dl,
'x0100IXLR.X
08fb2 EPOEEE 001a00W2EPdl
x7a00 SHL.l O:mdl.8417007a00.l'
K oue18.0e2.1a00dl,
'x0100IXLR.X
08fb2 EPOEEE 004c00ml3.l
x7600 ss1dl O:mdl.8417007600.l'
K oue18.0e2.4c00dl,
'x0100IXLR.X
08fb2 EPOEEE 00d900cmt3.l
x5000 ocl2dl O:mdl.8417005000.l'
K oue18.0e2.d900dl,
'x0100IXLR.X
08fb2 EPOEEE 007e00Scr2dl
x7f00 eu3.l O:mdl.8417007f00.l'
K oue18.0e2.7e00dl,
'x0100IXLR.X
08fb2 EPOEEE 005f00magdl
x7c00 ln.l O:mdl.8417007c00.l'
K oue18.0e2.5f00dl,
'x0100IXLR.X
08fb2 EPOEEE 007200MAN.l
x7b00 SS1dl O:mdl.8417007b00.l'
K oue18.0e2.7200dl,



'x0100IXLR.X
08fb2 EPOEEE 002100mam2dv
x7d00 sc3.r O:mdl.8417007d00.l'
K oue18.0e2.2100dl]

I [0: !yhn/ets/oesc/oaiiyvlp - /otDstpmmslnbne.mmpoeeup-dm-i /otDstp
n 2] pto pnetfrnisvltlt/o.y f ro/eko/e/ietakrve rcxdm -updr ro/eko

PoesV Iaeae Nm
rcs() mgBs ae Rsl
eut
----- ----- ---------- ---
----- ----- ---------- ---
08016 ----- Sse
x1b60 ----- ytm Err PBa 00i pgd
ro: E t x s ae
0f2b2 04500 ss.x
xfa00 x8800 msee Err Iaeaedrs a 04500 i pgd
ro: mgBsAdes t x8800 s ae
0f1ca 04600 crsee
xfed0 xa800 ss.x O:eeual.0.x
K xctbe68ee
0f1c7 00000 wnoo.x
xfe98 x1000 ilgnee O:eeual.3.x
K xctbe62ee
0f272 00000 srie.x
xf400 x1000 evcsee O:eeual.7.x
K xctbe66ee
0f252 00000 lasee
xf500 x1000 ss.x O:eeual.8.x
K xctbe68ee
0f283 00400 vatl.x
xf120 x0000 mchpee Err emgc06 i ntavldDSsgaue
ro: _ai 04 s o ai O intr.
08f8d 00000 scotee
x0f88 x1000 vhs.x O:eeual.5.x
K xctbe86ee
0f276 00000 scotee
xf150 x1000 vhs.x O:eeual.3.x
K xctbe96ee
08ff1 00000 scotee
x0b90 x1000 vhs.x O:eeual.08ee
K xctbe12.x
0f2d5 00000 scotee
xf258 x1000 vhs.x O:eeual.08ee
K xctbe18.x
0f238 00000 scotee
xf0b0 x1000 vhs.x O:eeual.18ee
K xctbe14.x
0f17a 00000 solvee
xfdd0 x1000 pos.x O:eeual.42ee
K xctbe13.x
0f182 00400 vtos.x
xfbb8 x0000 moldee O:eeual.68ee
K xctbe16.x
0f1d8 00400 VUgaeepr
xffc8 x0000 MprdHle O:eeual.78ee
K xctbe18.x
0f132 00400 TAtCnSce
xf4b8 x0000 Puoonv. Err Iaeaedrs a 0400 i pgd
0f2ae 00000 agee
xf570 x1000 l.x O:eeual.1.x
K xctbe26ee
0f341 00000 wctyee
xf630 x1000 snf.x Err Iaeaedrs a 01000i pgd
0f3bf 00400 TAtCnete
xf858 x0000 Puoonc. O:eeual.04ee
K xctbe18.x
0f36d 00000 epoe.x
xf850 x1000 xlrree O:eeual.74ee
K xctbe12.x
0f36e 00400 VwrTa.x
xf678 x0000 Maeryee O:eeual.3.x
K xctbe42ee
0f348 00400 VwrUe.x
xf790 x0000 Maesree O:eeual.5.x
K xctbe42ee
08f48 00400 wactee
x0958 x0000 uul.x O:eeual.6.x
K xctbe48ee
08fb2 00400 IXLR.X
x0100 x0000 EPOEEE O:eeual.84ee
K xctbe18.x
0f35c ----- cdee
xf860 ----- m.x Err PBa 07ff0 i pgd
ro: E t xfd00 s ae


iPython Notebook Volatility Memory Forensics SilentBanker

Recommandé

Recommandé

Contenu connexe

En vedette

En vedette (16)

Similaire à iPython Notebook Volatility Memory Forensics SilentBanker

Similaire à iPython Notebook Volatility Memory Forensics SilentBanker (8)

Dernier

Dernier (20)

iPython Notebook Volatility Memory Forensics SilentBanker