427 Botnet fm qxd

www.syngress.com
360
Chapter 10 • Using Sandbox Tools for Botnets
427_Botnet_10.qxd 1/9/07 3:06 PM Page 360

---

parentindex="0" starttime="00:00.219" terminationtime="00:02.328"
startreason="AnalysisTarget" terminationreason="NormalTermination"
executionstatus="OK">
■
index
Each process gets its own unique process index for later iden-
tification.
■
pid
The process identifier that is assigned by the operating system.
■
filename
The filename from which the process initially was created.
■
filesize
The size of this process file.
■
md5
The MD5 hash value of this process file.
■
username
The username of the security context the process is run-
ning within.
■
parentindex
The index of the parent process that has started this one;
the value 0 indicates that the process was started by the sandbox
application.
■
starttime
The relative time when the process was started or injected,
as described in the 

section.
■
endtime
The relative time when the process was terminated; from the
difference between 
starttime
and 
endtime
you can know the overall
execution time of this process.
■
startreason
The reason this process was monitored as described in the

section.
■
terminationreason
The reason the process was terminated.
NormalTermination
means that the process has terminated by itself.
Another possible value would be 
Timeout
, which means that the
sandbox has terminated this process at the end of the specified max-
imum analysis duration time.
■
executionstatus
Normally this attribute has the value 
OK
; if for some
reason the process could not be started—for example, because it is no
valid Win32 application—the value 
CouldNotCreateProcess
is used.
The 


element always contains several sections, which describe all
the actions performed during the execution of this process. For each of the