View source for MoVP 1.3 Desktops, heaps, and ransomware

{{Publication
|Botnet=Accdfisa, Tigger,
|Year=2012
|Date=2012-09-12
|Editor=Volatility labs
|Link=http://volatility-labs.blogspot.com.es/2012/09/movp-13-desktops-heaps-and-ransomware.html
|Author=Michael Hale Ligh,
|Type=Blogpost
|Abstract=The MoVP 1.3 plugin, named deskscan, enumerates desktops, desktop heap allocations, and associated threads. In the GUI landscape, a desktop is essentially a container for application windows and user interface objects. Malware utilizes desktops in various ways, from launching applications in alternate desktops (i.e. so the current logged-on user doesn't see) to ransomware that locks users out of their own desktop. We'll see some examples of both in this post.
}}