Forum Discussion

kevinh's avatar
kevinh
Silver I
24 days ago
Solved

DFIR CTF: Malware Memory - Question 9

For 

What is the name of the JSON file that exists inside the NetDefender directory?

when running the command:

vol.py -f malwarememory.vmem --profile=Win7SP1x86_23418 filescan | grep -i "NetDefender" <-- Aided by Gemini for faster querying based on the possible arguments

.in terms of using filescan to grep for NetDefender directory files, no JSON files were observed. I am wondering about what I am doing wrong.

 

  • Hi, have you tried using mftparser to look at the Master File Table? 😉

1 Reply

  • Hi, have you tried using mftparser to look at the Master File Table? 😉