Hi Curt/Michael,<br><br>           Thanks for the reponse, i need little bit of help, as i&#39;m new to memory forensics...i  need your help in understanding how to interpret the results ....any material on additional information on this topic will be helpful<br>
<br>Thanks,<br>Monnappa<br><br><div class="gmail_quote">On Tue, Oct 25, 2011 at 9:55 AM, Curt Wilson <span dir="ltr">&lt;<a href="mailto:research@perpetualhorizon.org">research@perpetualhorizon.org</a>&gt;</span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
  
    
  
  <div bgcolor="#FFFFFF" text="#000000">
    <br>
    <br>
    Michael Ligh responded, but it&#39;s possible that you might need more
    explanation. While I&#39;m not an expert, I&#39;m getting better and would
    be glad to try to help you understand the assembly if necessary. Let
    me know and I&#39;ll see if I can help, if you don&#39;t already have it
    down.<div><div></div><div class="h5"><br>
    <br>
    <br>
    <br>
    <br>
    <br>
    On 10/22/2011 3:17 PM, malware monna wrote:
    </div></div><blockquote type="cite"><div><div></div><div class="h5">Hi All,<br>
      <br>
              I&#39;m new to volatility and i was reading one of the article
      on the internet and found the below output, so i was curious to
      know what does below ouput mean?, can anybody please help me
      understand the malfind pluging and the below ouput, any info would
      be useful.<br>
      <br>
---------------------------------------------------------------------------------------------------------------------------------------<br>
      <code></code>
      <p>VMwareTray.exe       432    0x00e30000 0xe30fff00 VadS    
        0      PAGE_EXECUTE_R<br>
        EADWRITE<br>
        Dumped to:
        c:\re\zeus_demo\VMwareTray.exe.4be97e8.00e30000-00e30fff.dmp<br>
        0x00e30000   b8 35 00 00 00 e9 cd d7 ad 7b b8 91 00 00 00 e9   
        .5.......{......</p>
      <p>0x00e30010   4f df ad 7b 8b ff 55 8b ec e9 ef 17 3e 76 8b ff   
        O..{..U.....&gt;v..</p>
      <p>0x00e30020   55 8b ec e9 95 76 39 76 8b ff 55 8b ec e9 be 53   
        U....v9v..U....S</p>
      <p>0x00e30030   3a 76 8b ff 55 8b ec e9 d6 18 3e 76 8b ff 55 8b   
        :v..U.....&gt;v..U.</p>
      <p>0x00e30040   ec e9 14 95 39 76 8b ff 55 8b ec e9 4f 7e 3c 76   
        ....9v..U...O~&lt;v</p>
      <p>0x00e30050   8b ff 55 8b ec e9 0a 32 3a 76 8b ff 55 8b ec e9   
        ..U....2:v..U...</p>
      <p>0x00e30060   7d 61 39 76 6a 2c 68 b8 8d 1c 77 e9 01 8c 39 76   
        }a9vj,h...w...9v</p>
      <p>0x00e30070   8b ff 55 8b ec e9 c4 95 c8 70 8b ff 55 8b ec e9   
        ..U......p..U...</p>
      <p><code>Disassembly:<br>
          00e30000: b835000000                       MOV EAX, 0x35<br>
          00e30005: e9cdd7ad7b                       JMP 0x7c90d7d7<br>
          00e3000a: b891000000                       MOV EAX, 0x91<br>
          00e3000f: e94fdfad7b                       JMP 0x7c90df63<br>
          00e30014: 8bff                             MOV EDI, EDI<br>
          00e30016: 55                               PUSH EBP<br>
          00e30017: 8bec                             MOV EBP, ESP<br>
          00e30019: e9ef173e76                       JMP 0x7721180d<br>
          00e3001e: 8bff                             MOV EDI, EDI<br>
          00e30020: 55                               PUSH EBP</code></p>
---------------------------------------------------------------------------------------------------------------------------------------------<br>
      <br>
      Thanks<br>
      <br>
      <fieldset></fieldset>
      <br>
      </div></div><div class="im"><pre>_______________________________________________
Vol-users mailing list
<a href="mailto:Vol-users@volatilityfoundation.org" target="_blank">Vol-users@volatilityfoundation.org</a>
<a href="http://lists.volatilityfoundation.org/mailman/listinfo/vol-users" target="_blank">http://lists.volatilityfoundation.org/mailman/listinfo/vol-users</a>
</pre>
    </div></blockquote><font color="#888888">
    <br>
    <br>
    <pre cols="72">-- 
Curt Wilson
Research Analyst, Arbor Networks ASERT <a href="mailto:cwilson@arbor.net" target="_blank">cwilson@arbor.net</a>
Personal Security Research: <a href="mailto:research@perpetualhorizon.org" target="_blank">research@perpetualhorizon.org</a>
</pre>
  </font></div>

</blockquote></div><br>