Software Diagnostics Services launches its first cyber satellite to survey the state of cyber space and mine its patterns:
http://www.dumpanalysis.com/cybervostok
Notice a satellite logo: it has an UML 2.0 interface sink similar to Software Diagnostics Institute logo:
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Injected Symbols pattern can be used to add missing symbols when we have Reduced Symbol Information like it was done previously in this old case study. For example, TestWER module was compiled with static MFC and CRT libraries and its private PDB file contains all necessary symbols including MSG structure. We can load that module into notepad.exe process space and apply symbols:
0:000:x86> lm
start end module name
00fc0000 00ff0000 notepad (pdb symbols) c:\mss\notepad.pdb\E325F5195AE94FAEB58D25C9DF8C0CFD2\notepad.pdb
10000000 10039000 WinCRT (deferred)
727f0000 7298e000 comctl32 (deferred)
72aa0000 72af1000 winspool (deferred)
72b10000 72b19000 version (deferred)
72e40000 72e48000 wow64cpu (deferred)
72e50000 72eac000 wow64win (pdb symbols) c:\mss\wow64win.pdb\B2D08CC152D64E71B79167DC0A0A53E91\wow64win.pdb
72eb0000 72eef000 wow64 (deferred)
733d0000 733e3000 dwmapi (deferred)
735b0000 73606000 uxtheme (deferred)
746f0000 746fc000 CRYPTBASE (deferred)
74700000 74760000 sspicli (deferred)
747c0000 74817000 shlwapi (deferred)
74830000 7547a000 shell32 (deferred)
755d0000 7564b000 comdlg32 (deferred)
75650000 7567e000 imm32 (deferred)
75770000 75810000 advapi32 (deferred)
75810000 75920000 kernel32 (pdb symbols) c:\mss\wkernel32.pdb\1C690A8592304467BB15A09CEA7180FA2\wkernel32.pdb
75920000 759b0000 gdi32 (deferred)
759b0000 759f7000 KERNELBASE (deferred)
75a00000 75b00000 user32 (pdb symbols) c:\mss\wuser32.pdb\0FCE9CC301ED4567A819705B2718E1D62\wuser32.pdb
75b00000 75b8f000 oleaut32 (deferred)
75be0000 75c7d000 usp10 (deferred)
75ff0000 76009000 sechost (deferred)
76010000 76100000 rpcrt4 (deferred)
76230000 762dc000 msvcrt (deferred)
76470000 7647a000 lpk (deferred)
76480000 7654c000 msctf (deferred)
76550000 766ac000 ole32 (deferred)
766d0000 76753000 clbcatq (deferred)
76e40000 76fe9000 ntdll (deferred)
77020000 771a0000 ntdll_77020000 (pdb symbols) c:\mss\wntdll.pdb\D74F79EB1F8D4A45ABCD2F476CCABACC2\wntdll.pdb
0:000:x86> .sympath+ C:\DebuggingTV\TestWER\x86
Symbol search path is: srv*;C:\DebuggingTV\TestWER\x86
Expanded Symbol search path is: SRV*c:\mss*http://msdl.microsoft.com/download/symbols;c:\debuggingtv\testwer\x86
0:000:x86> .reload /f /i C:\DebuggingTV\TestWER\x86\TestWER.exe=10000000
0:000:x86> lm
start end module name
00fc0000 00ff0000 notepad (pdb symbols) c:\mss\notepad.pdb\E325F5195AE94FAEB58D25C9DF8C0CFD2\notepad.pdb
10000000 10039000 TestWER (private pdb symbols) c:\debuggingtv\testwer\x86\TestWER.pdb
727f0000 7298e000 comctl32 (deferred)
72aa0000 72af1000 winspool (deferred)
72b10000 72b19000 version (deferred)
72e40000 72e48000 wow64cpu (deferred)
72e50000 72eac000 wow64win (pdb symbols) c:\mss\wow64win.pdb\B2D08CC152D64E71B79167DC0A0A53E91\wow64win.pdb
72eb0000 72eef000 wow64 (deferred)
733d0000 733e3000 dwmapi (deferred)
735b0000 73606000 uxtheme (deferred)
746f0000 746fc000 CRYPTBASE (deferred)
74700000 74760000 sspicli (deferred)
747c0000 74817000 shlwapi (deferred)
74830000 7547a000 shell32 (deferred)
755d0000 7564b000 comdlg32 (deferred)
75650000 7567e000 imm32 (deferred)
75770000 75810000 advapi32 (deferred)
75810000 75920000 kernel32 (pdb symbols) c:\mss\wkernel32.pdb\1C690A8592304467BB15A09CEA7180FA2\wkernel32.pdb
75920000 759b0000 gdi32 (deferred)
759b0000 759f7000 KERNELBASE (deferred)
75a00000 75b00000 user32 (pdb symbols) c:\mss\wuser32.pdb\0FCE9CC301ED4567A819705B2718E1D62\wuser32.pdb
75b00000 75b8f000 oleaut32 (deferred)
75be0000 75c7d000 usp10 (deferred)
75ff0000 76009000 sechost (deferred)
76010000 76100000 rpcrt4 (deferred)
76230000 762dc000 msvcrt (deferred)
76470000 7647a000 lpk (deferred)
76480000 7654c000 msctf (deferred)
76550000 766ac000 ole32 (deferred)
766d0000 76753000 clbcatq (deferred)
76e40000 76fe9000 ntdll (deferred)
77020000 771a0000 ntdll_77020000 (pdb symbols) c:\mss\wntdll.pdb\D74F79EB1F8D4A45ABCD2F476CCABACC2\wntdll.pdb
0:000:x86> kv
ChildEBP RetAddr Args to Child
0013fe34 75a1790d 0013fe74 00000000 00000000 user32!NtUserGetMessage+0x15
0013fe50 00fc148a 0013fe74 00000000 00000000 user32!GetMessageW+0×33
0013fe90 00fc16ec 00fc0000 00000000 00354082 notepad!WinMain+0xe6
0013ff20 758233aa 7efde000 0013ff6c 77059ef2 notepad!_initterm_e+0×1a1
0013ff2c 77059ef2 7efde000 57785ae5 00000000 kernel32!BaseThreadInitThunk+0xe
0013ff6c 77059ec5 00fc3689 7efde000 00000000 ntdll_77020000!__RtlUserThreadStart+0×70
0013ff84 00000000 00fc3689 7efde000 00000000 ntdll_77020000!_RtlUserThreadStart+0×1b
0:000:x86> dt -r MSG 0013fe74
TestWER!MSG
+0x000 hwnd : 0x0007149c HWND__
+0x000 unused : ??
+0×004 message : 0×113
+0×008 wParam : 0×38a508
+0×00c lParam : 0n1921500630
+0×010 time : 0×2079a177
+0×014 pt : tagPOINT
+0×000 x : 0n1337
+0×004 y : 0n448- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Sometimes we have Reduced Symbolic Information for modules which can range from stripped or public symbol files to exported only function names. In such cases we can use API function prototypes, structure definitions and possible String Parameters to make sense of function arguments:
0:000:x86> kv
ChildEBP RetAddr Args to Child
0013fe34 75a1790d 0013fe74 00000000 00000000 user32!NtUserGetMessage+0x15
0013fe50 00fc148a 0013fe74 00000000 00000000 user32!GetMessageW+0×33
0013fe90 00fc16ec 00fc0000 00000000 00354082 notepad!WinMain+0xe6
0013ff20 758233aa 7efde000 0013ff6c 77059ef2 notepad!_initterm_e+0×1a1
0013ff2c 77059ef2 7efde000 57785ae5 00000000 kernel32!BaseThreadInitThunk+0xe
0013ff6c 77059ec5 00fc3689 7efde000 00000000 ntdll_77020000!__RtlUserThreadStart+0×70
0013ff84 00000000 00fc3689 7efde000 00000000 ntdll_77020000!_RtlUserThreadStart+0×1b
The first parameter of GetMessage API is a pointer to MSG structure:
0:000:x86> dt MSG 0013fe74
Symbol MSG not found.
From MSDN we find this structure definition:
typedef struct tagMSG { HWND hwnd; UINT message; WPARAM wParam; LPARAM lParam; DWORD time; POINT pt; } MSG, *PMSG, *LPMSG;
0:000:x86> dc 0013fe74 L7
0013fe74 0007149c 00000113 0038a508 7287c5d6 ……….8….r
0013fe84 2079a177 00000539 000001c0 w.y 9…….
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Sometimes we have a Truncated Stack Trace and need to perform manual stack trace reconstruction of the missing part to get approximate full stack trace. Often we are only able to reconstruct some parts and glue them together perhaps with some missing intermediate frames:
For example, we have this truncated stack trace due to the lack of symbols:
1: kd> k
ChildEBP RetAddr
97543b6c 85adf579 nt!KiTrap0E+0x2ac
WARNING: Stack unwind information not available. Following frames may be wrong.
97543be8 85adf770 myfault+0x579
97543bf4 85adf7fc myfault+0x770
97543c2c 81827ecf myfault+0x7fc
97543c44 81988f65 nt!IofCallDriver+0x63
97543c64 81989f25 nt!IopSynchronousServiceTail+0x1e0
97543d00 8198ee8d nt!IopXxxControlFile+0x6b7
97543d34 8188c96a nt!NtDeviceIoControlFile+0x2a
97543d34 77510f34 nt!KiFastCallEntry+0x12a
0012f9a0 7750f850 ntdll!KiFastSystemCallRet
0012f9a4 77417c92 ntdll!NtDeviceIoControlFile+0xc
0012fa04 00401a5b kernel32!DeviceIoControl+0x14a
0012fa94 7700becf NotMyfault+0x1a5b
0012facc 00000000 USER32!xxxDrawButton+0xc1
Manual stack reconstruction brings this fragment:
1: kd> k L=0012fb94 0012fb94 0012fb94
ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012fb94 77001ae8 0x12fb94
0012fc0c 7700286a USER32!UserCallWinProcCheckWow+0x14b
0012fc4c 77002bba USER32!SendMessageWorker+0x4b7
0012fc6c 7700c6b4 USER32!SendMessageW+0x7c
0012fc84 7700c7c9 USER32!xxxButtonNotifyParent+0x41
0012fca0 7700c7e8 USER32!xxxBNReleaseCapture+0xf7
0012fd24 7701632e USER32!ButtonWndProcWorker+0x910
0012fd44 77001a10 USER32!ButtonWndProcA+0x4c
0012fd70 77001ae8 USER32!InternalCallWinProc+0x23
0012fde8 77002a47 USER32!UserCallWinProcCheckWow+0x14b
0012fe4c 77002a98 USER32!DispatchMessageWorker+0x322
0012fe5c 76ff11fc USER32!DispatchMessageW+0xf
0012fe80 76fe98d2 USER32!IsDialogMessageW+0x586
0012fea0 00401cc9 USER32!IsDialogMessageA+0xff
0012ff10 004022ec NotMyfault+0x1cc9
00000000 00000000 NotMyfault+0x22ec
And finally we get the 3rd usual thread start fragment:
1: kd> k L=0012ffa0 0012ffa0 0012ffa0
ChildEBP RetAddr
WARNING: Frame IP not in any known module. Following frames may be wrong.
0012ffa0 77413833 0x12ffa0
0012ffac 774ea9bd kernel32!BaseThreadInitThunk+0xe
0012ffec 00000000 ntdll!_RtlUserThreadStart+0x23
Gluing them together we get this approx. stack trace:
97543b6c 85adf579 nt!KiTrap0E+0x2ac
WARNING: Stack unwind information not available. Following frames may be wrong.
97543be8 85adf770 myfault+0x579
97543bf4 85adf7fc myfault+0x770
97543c2c 81827ecf myfault+0x7fc
97543c44 81988f65 nt!IofCallDriver+0x63
97543c64 81989f25 nt!IopSynchronousServiceTail+0x1e0
97543d00 8198ee8d nt!IopXxxControlFile+0x6b7
97543d34 8188c96a nt!NtDeviceIoControlFile+0x2a
97543d34 77510f34 nt!KiFastCallEntry+0x12a
0012f9a0 7750f850 ntdll!KiFastSystemCallRet
0012f9a4 77417c92 ntdll!NtDeviceIoControlFile+0xc
0012fa04 00401a5b kernel32!DeviceIoControl+0x14a
0012fa94 7700becf NotMyfault+0x1a5b
0012fc0c 7700286a USER32!UserCallWinProcCheckWow+0x14b
0012fc4c 77002bba USER32!SendMessageWorker+0x4b7
0012fc6c 7700c6b4 USER32!SendMessageW+0x7c
0012fc84 7700c7c9 USER32!xxxButtonNotifyParent+0x41
0012fca0 7700c7e8 USER32!xxxBNReleaseCapture+0xf7
0012fd24 7701632e USER32!ButtonWndProcWorker+0x910
0012fd44 77001a10 USER32!ButtonWndProcA+0x4c
0012fd70 77001ae8 USER32!InternalCallWinProc+0x23
0012fde8 77002a47 USER32!UserCallWinProcCheckWow+0x14b
0012fe4c 77002a98 USER32!DispatchMessageWorker+0x322
0012fe5c 76ff11fc USER32!DispatchMessageW+0xf
0012fe80 76fe98d2 USER32!IsDialogMessageW+0x586
0012fea0 00401cc9 USER32!IsDialogMessageA+0xff
0012ff10 004022ec NotMyfault+0x1cc9
0012ffac 774ea9bd kernel32!BaseThreadInitThunk+0xe
0012ffec 00000000 ntdll!_RtlUserThreadStart+0x23
We call this pattern Glued Stack Trace.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Inter-Correlation analysis between a normal and a problem logs to find a Bifurcation Point (and a possible root cause) becomes a difficult task when both traces come from different environments with widely differing Background Components. Here a new analysis pattern called Sheaf of Activities (borrowed from sheaves from mathematics) can help. Basically this pattern is also a tool in tracking properties of trace message subsets. First we find out important message types around some Activity Region where we hope to find a difference between two traces:
Then we create several Adjoint Threads from different message types, for example, based on operation type or function name:
Then we analyze subtraces separately to find out a bifurcation point in each of them and then use this knowledge to find out differences between the original full traces.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
The discovery of a “black hole horizon” in a complete memory dump inspired this fictitious malware. There in a dump we discovered an innocuous ASCII message:
fffff880`15925010 fffff880`159250d0 "Dumping physical memory to disk: 80% ."
A little thought and we realized that this page was saved to a page file at the time when only 80% of memory were dumped. So we do not know what were in that page during the rest of the time (and would never know). I guess Cadaver Worms live there spreading from PC to PC and causing blue screens immediately upon infection to minimize discovery. They are not in crash dumps because they relocate themselves during the system dump procedure. They thaw frozen CPUs and send themselves to network. Who would suspect a computer showing a blue screen sending network packets?
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Out-of-Module Pointer pattern is about pointers to addresses outside the container module range. Typical example here would be some kernel table or structure, for example, a driver IRP dispatch table having pointers to outside that driver module address range. Other examples may include 32-bit SSDT pointing outside nt module range and IDT entries pointing outside hal and expected drivers:
[...]
818809dc 8193c4e7 nt!NtQueryOpenSubKeys
818809e0 8193c76b nt!NtQueryOpenSubKeysEx
818809e4 81a909b0 nt!NtQueryPerformanceCounter
818809e8 819920e7 nt!NtQueryQuotaInformationFile
818809ec 819e34f2 nt!NtQuerySection
818809f0 819f470b nt!NtQuerySecurityObject
818809f4 81a882fe nt!NtQuerySemaphore
818809f8 819eff54 nt!NtQuerySymbolicLinkObject
818809fc 81a8a223 nt!NtQuerySystemEnvironmentValue
81880a00 81a8a831 nt!NtQuerySystemEnvironmentValueEx
81880a04 96ca1a73
81880a08 81a7ac06 nt!NtQuerySystemTime
81880a0c 81a8f913 nt!NtQueryTimer
81880a10 81a7aeeb nt!NtQueryTimerResolution
81880a14 8193985a nt!NtQueryValueKey
81880a18 819e9273 nt!NtQueryVirtualMemory
81880a1c 8199274e nt!NtQueryVolumeInformationFile
81880a20 81a1a655 nt!NtQueueApcThread
[…]
0: kd> lm m nt
start end module name
81800000 81ba1000 nt
Such pointers may also be Raw Pointers but it also could be the case that all pointers are raw in the absence of symbols with only a few outside of the expected range.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Raw Pointer pattern is about pointers without matching symbol files. They may be in the expected module range or in some other known module range in the form of module+offset or can be completely out of range of any module from the loaded module list and therefore just a number. For example, usually we have certain structures or arrays (tables) where we expect pointers with matching symbols such as IAT, IDT and 32-bit SSDT where an occurrence of a raw pointer immediately triggers a suspicion such as in this Import Address Table from ProcessA:
[...]
00000001`3f8a9048 00000000`76e282d0 ntdll!RtlSizeHeap
00000001`3f8a9050 00000000`76bf9070 kernel32!GetStringTypeWStub
00000001`3f8a9058 00000000`76c03580 kernel32!WideCharToMultiByteStub
00000001`3f8a9060 00000000`76e33f20 ntdll!RtlReAllocateHeap
00000001`3f8a9068 00000000`76e533a0 ntdll!RtlAllocateHeap
00000001`3f8a9070 00000000`76bfc420 kernel32!GetCommandLineWStub
00000001`3f8a9078 00000001`3f8a1638 ProcessA+0×10ac
00000001`3f8a9080 00000000`76c2cc50 kernel32!IsProcessorFeaturePresent
00000001`3f8a9088 00000000`76c02d60 kernel32!GetLastErrorStub
00000001`3f8a9090 00000000`76c02d80 kernel32!SetLastError
00000001`3f8a9098 00000000`76bf3ee0 kernel32!GetCurrentThreadIdStub
[…]
Note that structures are not limited to the above and can me any OS or even application specific structure where we have symbol files. Raw pointers that are outside of expected module range are covered in the next pattern.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Hooksware pattern originally came from memory dump analysis pattern catalog and is too general for malware analysis pattern catalog. So we decided to factor out 3 separate patterns. The first one is called Patched Code and includes cases such as in-place patching:
0:004> u ntdll!ZwQueryDirectoryFile
ntdll!ZwQueryDirectoryFile:
77814db4 b8da000000 mov eax,0DAh
77814db9 bae8af0500 mov edx,5AFE8h
77814dbe ff12 call dword ptr [edx]
77814dc0 c22c00 ret 2Ch
77814dc3 90 nop
ntdll!NtQueryDirectoryObject:
77814dc4 b8db000000 mov eax,0DBh
77814dc9 ba0003fe7f mov edx,offset SharedUserData!SystemCallStub (7ffe0300)
77814dce ff12 call dword ptr [edx]
and detour patching:
0:004> u wininet!InternetReadFile
wininet!InternetReadFile:
7758654b e98044ac88 jmp 0004a9d0
77586550 83ec24 sub esp,24h
77586553 53 push ebx
77586554 56 push esi
77586555 57 push edi
77586556 33ff xor edi,edi
77586558 393db8116277 cmp dword ptr [wininet!GlobalDataInitialized (776211b8)],edi
7758655e 897df4 mov dword ptr [ebp-0Ch],edi
In case of WinDbg such pattern is usually detected on the crash spot such as from RIP Stack Trace or from !chkimg command output.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Indexical Trace pattern describes an Inter-Correlation pattern variant when we have a trace that has messages of interest pointing to specific activity regions in another trace. The latter trace can be very huge, from another computer and split into many parts (Split Trace). This pattern is very helpful when the problem needs to be diagnosed in the large split trace but we don’t know when it happened. Then an index trace that may have recorded software execution account (for example, in the case of a broker-like architecture) and can point to the right trace fragment from the split trace.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
If debugging were profitable, everybody would be debugging.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Steps:
1. Open a crash dump or attach WinDbg to a process you can sacrifice.
2. Enter this command: eb rsp <UNICODE string> [00 00]
0: kd> eb rsp 42 00 65 00 65 00 74 00 68 00 6F 00 76 00 65 00 6E 00 3A 00 20 00 53 00 79 00 6D 00 70 00 68 00 6F 00 6E 00 69 00 65 00 73 00 20 00 31 00 20 00 61 00 6E 00 64 00 20 00 33 00 00 00
Note: use esp for a 32-bit dump. Last NULL terminators 00 00 are not necessary if the string already has them.
3. Enter this command: du rsp
0: kd> du rsp
fffff880`15925ae8 "Beethoven: Symphonies 1 and 3"
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
As usual a new pattern arises with the need to communicate analysis findings. Most often when analyzing malware we don’t have symbol files (No Component Symbols) for an Unknown Module. By looking at IAT (if any present) we can guess module purpose. Sometimes a module itself is not malicious but is used in the larger malicious context such as screen grabbing:
[...]
10002000 76376101 gdi32!CreateCompatibleDC
10002004 763793d6 gdi32!StretchBlt
10002008 76377461 gdi32!CreateDIBSection
1000200c 763762a0 gdi32!SelectObject
10002010 00000000
10002024 77429ced user32!ReleaseDC
10002028 77423ba7 user32!NtUserGetWindowDC
1000202c 77430e21 user32!GetWindowRect
10002030 00000000
10002034 744a75e9 GdiPlus!GdiplusStartup
10002038 744976dd GdiPlus!GdipSaveImageToStream
1000203c 744cdd38 GdiPlus!GdipGetImageEncodersSize
10002040 744971cf GdiPlus!GdipDisposeImage
10002044 744a8591 GdiPlus!GdipCreateBitmapFromHBITMAP
10002048 744cdbae GdiPlus!GdipGetImageEncoders
[...]
There are also cases where these API names are not in IAT but found as String Hint in raw data such LoadLibrary / GetProcAddress and even a group of modules themselves as a collective API:
[...]
00058e20 "kernel32.dll"
00058e3c "user32.dll"
00058e54 "ws2_32.dll"
00058e6c "ntdll.dll"
00058e80 "wininet.dll"
00058e98 "nspr4.dll"
00058eac "ssl3.dll"
[...]
We name this pattern Namespace.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
It is a well-known fact that page heap is implemented by placing allocations at the end of pages with the next non-accessible page to catch buffer overruns leading to heap corruption. The best way to see it is to use !address command that dumps all such allocations:
0:004> !gflag
Current NtGlobalFlag contents: 0x02000000
hpa - Place heap allocations at ends of pages
0:004> !address
[...]
20b10000 20b11000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b11000 20b12000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b12000 20b13000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b13000 20b14000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b14000 20b15000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b15000 20b1a000 5000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b1a000 20b1b000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b1b000 20b1c000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b1c000 20b1d000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b1d000 20b1e000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b1e000 20b1f000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b1f000 20b20000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
+ 20b20000 20b21000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b21000 20b26000 5000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b26000 20b27000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b27000 20b28000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b28000 20b29000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b29000 20b2a000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b2a000 20b2b000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b2b000 20b2f000 4000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b2f000 20b30000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b30000 20b3f000 f000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b3f000 20b40000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b40000 20b41000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b41000 20b42000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b42000 20b45000 3000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b45000 20b46000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b46000 20b4b000 5000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b4b000 20b4c000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b4c000 20b4d000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b4d000 20b4e000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b4e000 20b4f000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b4f000 20b50000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b50000 20b51000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b51000 20b52000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b52000 20b57000 5000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b57000 20b58000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b58000 20b5d000 5000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b5d000 20b5e000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b5e000 20b5f000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b5f000 20b60000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b60000 20b61000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b61000 20b62000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b62000 20b6b000 9000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b6b000 20b6f000 4000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b6f000 20b71000 2000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b71000 20b72000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b72000 20b73000 1000 MEM_PRIVATE MEM_RESERVE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
20b73000 20b74000 1000 MEM_PRIVATE MEM_COMMIT PAGE_READWRITE PageHeap [PageHeap: 1f241000; NormalHeap: 1f410000]
[…]
0:004> dc 20b26000 20b27000
20b26000 00000000 00000000 00000000 00000000 …………….
20b26010 00000000 00000000 00000000 00000000 …………….
20b26020 00000000 00000000 00000000 00000000 …………….
20b26030 00000000 00000000 00000000 00000000 …………….
20b26040 00000000 00000000 00000000 00000000 …………….
20b26050 00000000 00000000 00000000 00000000 …………….
20b26060 00000000 00000000 00000000 00000000 …………….
20b26070 00000000 00000000 00000000 00000000 …………….
20b26080 00000000 00000000 00000000 00000000 …………….
20b26090 00000000 00000000 00000000 00000000 …………….
20b260a0 00000000 00000000 00000000 00000000 …………….
20b260b0 00000000 00000000 00000000 00000000 …………….
20b260c0 00000000 00000000 00000000 00000000 …………….
20b260d0 00000000 00000000 00000000 00000000 …………….
20b260e0 00000000 00000000 00000000 00000000 …………….
20b260f0 00000000 00000000 00000000 00000000 …………….
20b26100 00000000 00000000 00000000 00000000 …………….
20b26110 00000000 00000000 00000000 00000000 …………….
20b26120 00000000 00000000 00000000 00000000 …………….
20b26130 00000000 00000000 00000000 00000000 …………….
20b26140 00000000 00000000 00000000 00000000 …………….
20b26150 00000000 00000000 00000000 00000000 …………….
20b26160 00000000 00000000 00000000 00000000 …………….
20b26170 00000000 00000000 00000000 00000000 …………….
20b26180 00000000 00000000 00000000 00000000 …………….
20b26190 00000000 00000000 00000000 00000000 …………….
20b261a0 00000000 00000000 00000000 00000000 …………….
20b261b0 00000000 00000000 00000000 00000000 …………….
20b261c0 00000000 00000000 00000000 00000000 …………….
20b261d0 00000000 00000000 00000000 00000000 …………….
20b261e0 00000000 00000000 00000000 00000000 …………….
20b261f0 00000000 00000000 00000000 00000000 …………….
20b26200 00000000 00000000 00000000 00000000 …………….
20b26210 00000000 00000000 00000000 00000000 …………….
20b26220 00000000 00000000 00000000 00000000 …………….
20b26230 00000000 00000000 00000000 00000000 …………….
20b26240 00000000 00000000 00000000 00000000 …………….
20b26250 00000000 00000000 00000000 00000000 …………….
20b26260 00000000 00000000 00000000 00000000 …………….
20b26270 00000000 00000000 00000000 00000000 …………….
20b26280 00000000 00000000 00000000 00000000 …………….
20b26290 00000000 00000000 00000000 00000000 …………….
20b262a0 00000000 00000000 00000000 00000000 …………….
20b262b0 00000000 00000000 00000000 00000000 …………….
20b262c0 00000000 00000000 00000000 00000000 …………….
20b262d0 00000000 00000000 00000000 00000000 …………….
20b262e0 00000000 00000000 00000000 00000000 …………….
20b262f0 00000000 00000000 00000000 00000000 …………….
20b26300 00000000 00000000 00000000 00000000 …………….
20b26310 00000000 00000000 00000000 00000000 …………….
20b26320 00000000 00000000 00000000 00000000 …………….
20b26330 00000000 00000000 00000000 00000000 …………….
20b26340 00000000 00000000 00000000 00000000 …………….
20b26350 00000000 00000000 00000000 00000000 …………….
20b26360 00000000 00000000 00000000 00000000 …………….
20b26370 00000000 00000000 00000000 00000000 …………….
20b26380 00000000 00000000 00000000 00000000 …………….
20b26390 00000000 00000000 00000000 00000000 …………….
20b263a0 00000000 00000000 00000000 00000000 …………….
20b263b0 00000000 00000000 00000000 00000000 …………….
20b263c0 00000000 00000000 00000000 00000000 …………….
20b263d0 00000000 00000000 00000000 00000000 …………….
20b263e0 00000000 00000000 00000000 00000000 …………….
20b263f0 00000000 00000000 00000000 00000000 …………….
20b26400 00000000 00000000 00000000 00000000 …………….
20b26410 00000000 00000000 00000000 00000000 …………….
20b26420 00000000 00000000 00000000 00000000 …………….
20b26430 00000000 00000000 00000000 00000000 …………….
20b26440 00000000 00000000 00000000 00000000 …………….
20b26450 00000000 00000000 00000000 00000000 …………….
20b26460 00000000 00000000 00000000 00000000 …………….
20b26470 00000000 00000000 00000000 00000000 …………….
20b26480 00000000 00000000 00000000 00000000 …………….
20b26490 00000000 00000000 00000000 00000000 …………….
20b264a0 00000000 00000000 00000000 00000000 …………….
20b264b0 00000000 00000000 00000000 00000000 …………….
20b264c0 00000000 00000000 00000000 00000000 …………….
20b264d0 00000000 00000000 00000000 00000000 …………….
20b264e0 00000000 00000000 00000000 00000000 …………….
20b264f0 00000000 00000000 00000000 00000000 …………….
20b26500 00000000 00000000 00000000 00000000 …………….
20b26510 00000000 00000000 00000000 00000000 …………….
20b26520 00000000 00000000 00000000 00000000 …………….
20b26530 00000000 00000000 00000000 00000000 …………….
20b26540 00000000 00000000 00000000 00000000 …………….
20b26550 00000000 00000000 00000000 00000000 …………….
20b26560 00000000 00000000 00000000 00000000 …………….
20b26570 00000000 00000000 00000000 00000000 …………….
20b26580 00000000 00000000 00000000 00000000 …………….
20b26590 00000000 00000000 00000000 00000000 …………….
20b265a0 00000000 00000000 00000000 00000000 …………….
20b265b0 00000000 00000000 00000000 00000000 …………….
20b265c0 00000000 00000000 00000000 00000000 …………….
20b265d0 00000000 00000000 00000000 00000000 …………….
20b265e0 00000000 00000000 00000000 00000000 …………….
20b265f0 00000000 00000000 00000000 00000000 …………….
20b26600 00000000 00000000 00000000 00000000 …………….
20b26610 00000000 00000000 00000000 00000000 …………….
20b26620 00000000 00000000 00000000 00000000 …………….
20b26630 00000000 00000000 00000000 00000000 …………….
20b26640 00000000 00000000 00000000 00000000 …………….
20b26650 00000000 00000000 00000000 00000000 …………….
20b26660 00000000 00000000 00000000 00000000 …………….
20b26670 00000000 00000000 00000000 00000000 …………….
20b26680 00000000 00000000 00000000 00000000 …………….
20b26690 00000000 00000000 00000000 00000000 …………….
20b266a0 00000000 00000000 00000000 00000000 …………….
20b266b0 00000000 00000000 00000000 00000000 …………….
20b266c0 00000000 00000000 00000000 00000000 …………….
20b266d0 00000000 00000000 00000000 00000000 …………….
20b266e0 00000000 00000000 00000000 00000000 …………….
20b266f0 00000000 00000000 00000000 00000000 …………….
20b26700 00000000 00000000 00000000 00000000 …………….
20b26710 00000000 00000000 00000000 00000000 …………….
20b26720 00000000 00000000 00000000 00000000 …………….
20b26730 00000000 00000000 00000000 00000000 …………….
20b26740 00000000 00000000 00000000 00000000 …………….
20b26750 00000000 00000000 00000000 00000000 …………….
20b26760 00000000 00000000 00000000 00000000 …………….
20b26770 00000000 00000000 00000000 00000000 …………….
20b26780 00000000 00000000 00000000 00000000 …………….
20b26790 00000000 00000000 00000000 00000000 …………….
20b267a0 00000000 00000000 00000000 00000000 …………….
20b267b0 00000000 00000000 00000000 00000000 …………….
20b267c0 00000000 00000000 00000000 00000000 …………….
20b267d0 00000000 00000000 00000000 00000000 …………….
20b267e0 00000000 00000000 00000000 00000000 …………….
20b267f0 00000000 00000000 00000000 00000000 …………….
20b26800 00000000 00000000 00000000 00000000 …………….
20b26810 00000000 00000000 00000000 00000000 …………….
20b26820 00000000 00000000 00000000 00000000 …………….
20b26830 00000000 00000000 00000000 00000000 …………….
20b26840 00000000 00000000 00000000 00000000 …………….
20b26850 00000000 00000000 00000000 00000000 …………….
20b26860 00000000 00000000 00000000 00000000 …………….
20b26870 00000000 00000000 00000000 00000000 …………….
20b26880 00000000 00000000 00000000 00000000 …………….
20b26890 00000000 00000000 00000000 00000000 …………….
20b268a0 00000000 00000000 00000000 00000000 …………….
20b268b0 00000000 00000000 00000000 00000000 …………….
20b268c0 00000000 00000000 00000000 00000000 …………….
20b268d0 00000000 00000000 00000000 00000000 …………….
20b268e0 00000000 00000000 00000000 00000000 …………….
20b268f0 00000000 00000000 00000000 00000000 …………….
20b26900 00000000 00000000 00000000 00000000 …………….
20b26910 00000000 00000000 00000000 00000000 …………….
20b26920 00000000 00000000 00000000 00000000 …………….
20b26930 00000000 00000000 00000000 00000000 …………….
20b26940 00000000 00000000 00000000 00000000 …………….
20b26950 00000000 00000000 00000000 00000000 …………….
20b26960 00000000 00000000 00000000 00000000 …………….
20b26970 00000000 00000000 00000000 00000000 …………….
20b26980 00000000 00000000 00000000 00000000 …………….
20b26990 00000000 00000000 00000000 00000000 …………….
20b269a0 00000000 00000000 00000000 00000000 …………….
20b269b0 00000000 00000000 00000000 00000000 …………….
20b269c0 00000000 00000000 00000000 00000000 …………….
20b269d0 00000000 00000000 00000000 00000000 …………….
20b269e0 00000000 00000000 00000000 00000000 …………….
20b269f0 00000000 00000000 00000000 00000000 …………….
20b26a00 00000000 00000000 00000000 00000000 …………….
20b26a10 00000000 00000000 00000000 00000000 …………….
20b26a20 00000000 00000000 00000000 00000000 …………….
20b26a30 00000000 00000000 00000000 00000000 …………….
20b26a40 00000000 00000000 00000000 00000000 …………….
20b26a50 00000000 00000000 00000000 00000000 …………….
20b26a60 00000000 00000000 00000000 00000000 …………….
20b26a70 00000000 00000000 00000000 00000000 …………….
20b26a80 00000000 00000000 00000000 00000000 …………….
20b26a90 00000000 00000000 00000000 00000000 …………….
20b26aa0 00000000 00000000 00000000 00000000 …………….
20b26ab0 00000000 00000000 00000000 00000000 …………….
20b26ac0 00000000 00000000 00000000 00000000 …………….
20b26ad0 00000000 00000000 00000000 00000000 …………….
20b26ae0 00000000 00000000 00000000 00000000 …………….
20b26af0 00000000 00000000 00000000 00000000 …………….
20b26b00 00000000 00000000 00000000 00000000 …………….
20b26b10 00000000 00000000 00000000 00000000 …………….
20b26b20 00000000 00000000 00000000 00000000 …………….
20b26b30 00000000 00000000 00000000 00000000 …………….
20b26b40 00000000 00000000 00000000 00000000 …………….
20b26b50 00000000 00000000 00000000 00000000 …………….
20b26b60 00000000 00000000 00000000 00000000 …………….
20b26b70 00000000 00000000 00000000 00000000 …………….
20b26b80 00000000 00000000 00000000 00000000 …………….
20b26b90 00000000 00000000 00000000 00000000 …………….
20b26ba0 00000000 00000000 00000000 00000000 …………….
20b26bb0 00000000 00000000 00000000 00000000 …………….
20b26bc0 00000000 00000000 00000000 00000000 …………….
20b26bd0 00000000 00000000 00000000 00000000 …………….
20b26be0 00000000 00000000 00000000 00000000 …………….
20b26bf0 00000000 00000000 00000000 00000000 …………….
20b26c00 00000000 00000000 00000000 00000000 …………….
20b26c10 00000000 00000000 00000000 00000000 …………….
20b26c20 00000000 00000000 00000000 00000000 …………….
20b26c30 00000000 00000000 00000000 00000000 …………….
20b26c40 00000000 00000000 00000000 00000000 …………….
20b26c50 00000000 00000000 00000000 00000000 …………….
20b26c60 00000000 00000000 00000000 00000000 …………….
20b26c70 00000000 00000000 00000000 00000000 …………….
20b26c80 00000000 00000000 00000000 00000000 …………….
20b26c90 00000000 00000000 00000000 00000000 …………….
20b26ca0 00000000 00000000 00000000 00000000 …………….
20b26cb0 00000000 00000000 00000000 00000000 …………….
20b26cc0 00000000 00000000 00000000 00000000 …………….
20b26cd0 00000000 00000000 00000000 00000000 …………….
20b26ce0 00000000 00000000 00000000 00000000 …………….
20b26cf0 00000000 00000000 00000000 00000000 …………….
20b26d00 00000000 00000000 00000000 00000000 …………….
20b26d10 00000000 00000000 00000000 00000000 …………….
20b26d20 00000000 00000000 00000000 00000000 …………….
20b26d30 00000000 00000000 00000000 00000000 …………….
20b26d40 00000000 00000000 00000000 00000000 …………….
20b26d50 00000000 00000000 00000000 00000000 …………….
20b26d60 00000000 00000000 00000000 00000000 …………….
20b26d70 00000000 00000000 00000000 00000000 …………….
20b26d80 00000000 00000000 00000000 00000000 …………….
20b26d90 00000000 00000000 00000000 00000000 …………….
20b26da0 00000000 00000000 00000000 00000000 …………….
20b26db0 00000000 00000000 00000000 00000000 …………….
20b26dc0 00000000 00000000 00000000 00000000 …………….
20b26dd0 00000000 00000000 00000000 00000000 …………….
20b26de0 00000000 00000000 00000000 00000000 …………….
20b26df0 00000000 00000000 00000000 00000000 …………….
20b26e00 00000000 00000000 00000000 00000000 …………….
20b26e10 00000000 00000000 00000000 00000000 …………….
20b26e20 00000000 00000000 00000000 00000000 …………….
20b26e30 00000000 00000000 00000000 00000000 …………….
20b26e40 00000000 00000000 00000000 00000000 …………….
20b26e50 00000000 00000000 00000000 00000000 …………….
20b26e60 00000000 00000000 00000000 00000000 …………….
20b26e70 00000000 00000000 00000000 00000000 …………….
20b26e80 00000000 00000000 00000000 00000000 …………….
20b26e90 00000000 00000000 00000000 00000000 …………….
20b26ea0 00000000 00000000 00000000 00000000 …………….
20b26eb0 00000000 00000000 00000000 00000000 …………….
20b26ec0 00000000 00000000 00000000 00000000 …………….
20b26ed0 00000000 00000000 abcdbbbb 1f241000 …………..$.
20b26ee0 00000108 00000108 00000000 00000000 …………….
20b26ef0 011c6b10 dcbabbbb 1f1bc8b4 00000002 .k…………..
20b26f00 20b79fd0 20b85fd0 20b28fe8 20b2ffe0 … ._. … …
20b26f10 20b3ffe0 20b4bfe8 20b51fe8 20b57fe8 … … … …
20b26f20 00000000 00000000 20b5dfa8 00000000 ……….. ….
20b26f30 00000000 00000000 1f1bcbf0 00000000 …………….
20b26f40 20b71ff8 00000010 1f1bcbf0 00000000 … …………
20b26f50 20b73ff8 00000010 1f1bcbf0 00000000 .?. …………
20b26f60 20b75ff8 00000010 1f1bcbf0 00000000 ._. …………
20b26f70 20b77ff8 00000010 00000000 00000000 … …………
20b26f80 c0c0c001 00000000 c0c00000 00000002 …………….
20b26f90 01000000 00000101 00000000 00000000 …………….
20b26fa0 00000000 c0c0c000 00000000 00000001 …………….
20b26fb0 00000000 00000000 00000000 00000000 …………….
20b26fc0 00000000 00000000 00000000 00000000 …………….
20b26fd0 00000000 00000000 00000000 00000000 …………….
20b26fe0 00000000 00000000 00000000 00000000 …………….
20b26ff0 00000000 00000000 00000000 c0c0c000 …………….
20b27000 ???????? ????
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
Memorianic prophecy 0m3 says: “Memory is infinitude of memories.” In monistic aspect plural interpretation of Memoidealism memory is also an attribute of itself. Memorianity considers all memories of the same substance as eternal Memory. All memories are distinct, yet they are one essence. There is only one Memory in memories. Each memory is only distinct in relation to other memories. In M-Memory M stands for Multiplicity. One analogy here is the concept of Trinity with the infinite number of hypostases instead of just 3.
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -
This pattern (we call it String Hint) covers traces of ASCII and UNICODE strings that look suspicious such as website, password and HTTP forms or strange names that intuitively shouldn’t be present according to the purpose of a module or its container process (example is taken from Victimware presentation case study):
0:005> s-sa 00040000 L1d000
0004004d "!This program cannot be run in D"
0004006d "OS mode."
00040081 "3y@"
000400b8 "Rich"
000401d0 ".text"
000401f7 "`.rdata"
0004021f "@.data"
00040248 ".reloc"
[...]
00054018 "GET /stat?uptime=%d&downlink=%d&"
00054038 "uplink=%d&id=%s&statpass=%s&comm"
00054058 "ent=%s HTTP/1.0"
000540ac "%s%s%s"
000540d8 "ftp://%s:%s@%s:%d"
000540fc "Accept-Encoding:"
00054118 "Accept-Encoding:"
00054130 "0123456789ABCDEF"
00054144 "://"
00054160 "POST %s HTTP/1.0"
00054172 "Host: %s"
0005417c "User-Agent: %s"
0005418c "Accept: text/html"
0005419f "Connection: Close"
000541b2 "Content-Type: application/x-www-"
000541d2 "form-urlencoded"
000541e3 "Content-Length: %d"
000541fc "id="
00054208 "POST %s HTTP/1.1"
0005421a "Host: %s"
00054224 "User-Agent: %s"
00054234 "Accept: text/html"
00054247 "Connection: Close"
0005425a "Content-Type: application/x-www-"
0005427a "form-urlencoded"
0005428b "Content-Length: %d"
000542a4 "id=%s&base="
000542b8 "id=%s&brw=%d&type=%d&data="
000542d8 "POST %s HTTP/1.1"
000542ea "Host: %s"
000542f4 "User-Agent: %s"
00054304 "Accept: text/html"
00054317 "Connection: Close"
0005432a "Content-Type: application/x-www-"
0005434a "form-urlencoded"
0005435b "Content-Length: %d"
00054378 "id=%s&os=%s&plist="
00054390 "POST %s HTTP/1.1"
000543a2 "Host: %s"
000543ac "User-Agent: %s"
000543bc "Accept: text/html"
000543cf "Connection: Close"
000543e2 "Content-Type: application/x-www-"
00054402 "form-urlencoded"
00054413 "Content-Length: %d"
00054430 "id=%s&data=%s"
00054440 "POST %s HTTP/1.1"
00054452 "Host: %s"
0005445c "User-Agent: %s"
0005446c "Accept: text/html"
0005447f "Connection: Close"
00054492 "Content-Type: application/x-www-"
000544b2 "form-urlencoded"
000544c3 "Content-Length: %d"
000544e0 "GET %s HTTP/1.0"
000544f1 "Host: %s"
000544fb "User-Agent: %s"
0005450b "Connection: close"
00054528 "POST /get/scr.html HTTP/1.0"
00054545 "Host: %s"
0005454f "User-Agent: %s"
0005455f "Connection: close"
00054572 "Content-Length: %d"
00054586 "Content-Type: multipart/form-dat"
000545a6 "a; boundary=--------------------"
000545c6 "-------%d"
000545d4 "-----------------------------%d"
000545f8 "%sContent-Disposition: form-data"
00054618 "; name="id""
00054630 "%sContent-Disposition: form-data"
00054650 "; name="screen"; filename="%d""
00054670 "Content-Type: application/octet-"
00054690 "stream"
000546a0 "%s(%d) : %s"
000546ac "%s failed with error %d: %s"
000546c8 "%02X"
000546d8 "BlackwoodPRO"
000546e8 "FinamDirect"
000546f4 "GrayBox"
000546fc "MbtPRO"
00054704 "Laser"
0005470c "LightSpeed"
00054718 "LTGroup"
00054720 "Mbt"
00054724 "ScotTrader"
00054730 "SaxoTrader"
00054740 "Program: %s"
0005474f "Username: %s"
0005475e "Password: %s"
0005476d "AccountNO: %s"
[...]
- Dmitry Vostokov @ DumpAnalysis.org + TraceAnalysis.org -