Forum Discussion

kevinh's avatar
kevinh
Silver I
24 days ago
Solved

DFIR CTF: Malware Memory - Question 9

For  What is the name of the JSON file that exists inside the NetDefender directory? when running the command: vol.py -f malwarememory.vmem --profile=Win7SP1x86_23418 filescan | grep -i "NetDefend...
  • LewisMutton's avatar
    23 days ago

    Hi, have you tried using mftparser to look at the Master File Table? 😉