Index A ACE model, 321­322 Advanced Forensic Format (AFF), 232 Altor networks, 314 AMD Virtualization (AMD-V), 58 anti-debugging libraries, 306­307 antivirtualization techniques detection, 184 hardware detection identifiers hard drives, 186 hypervisor environment, 187 MAC addresses, 185 PCI identifiers, 186­187 virtualization utilities, 184 VMware I/O port, 184­185 application fuzzing, 215 application testing application tester, 192 C Citrix XenServer, 277 compatible time sharing system (CTSS), 4 cray time sharing system (CTSS), 6 CWSandbox, XML analysis report Bot-like behavior, 181­183 interpretation binary updates from Bot, 175­176 Bot installation, 168­169 C&C server communication, 174­175 infected new hosts, 169­170 malicious operations, 176­181 protecting local host, 171­173 live version of, 182 registry section, 163­164 root element, 159­160 TCP connection, 164­165