custom-nodes-security-scan/dast/.cuckoo/conf/memory.conf

# Volatility configuration

# Basic settings
[basic]
# Profile to avoid wasting time identifying it
guest_profile = WinXPSP2x86
# Delete memory dump after volatility processing.
delete_memdump = no

# List of available modules
# enabled: enable this module
# filter: use filters to remove benign system data from the logs
# Filters are defined in the mask section at below

# Scans for hidden/injected code and dlls
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#malfind
[malfind]
enabled = yes
filter = yes

# Lists hooked api in user mode and kernel space
# Expect it to be very slow when enabled
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#apihooks
[apihooks]
enabled = no
filter = yes

# Lists official processes. Does not detect hidden processes
# http://code.google.com/p/volatility/wiki/CommandReference23#pslist
[pslist]
enabled = yes
filter = no

# Lists hidden processes. Uses several tricks to identify them
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#psxview
[psxview]
enabled = yes
filter = no

# Show callbacks
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#callbacks
[callbacks]
enabled = yes
filter = no

# Show idt
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#idt
[idt]
enabled = yes
filter = no

# Show timers
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#timers
[timers]
enabled = yes
filter = no

# Show messagehooks
# Expect it to be very slow when enabled
# http://code.google.com/p/volatility/wiki/CommandReferenceGui23#messagehooks
[messagehooks]
enabled = no
filter = no

# Show sids
# http://code.google.com/p/volatility/wiki/CommandReference23#getsids
[getsids]
enabled = yes
filter = no

# Show privileges
# http://code.google.com/p/volatility/wiki/CommandReference23#privs
[privs]
enabled = yes
filter = no

# Display processes' loaded DLLs- Does not display hidden DLLs
# http://code.google.com/p/volatility/wiki/CommandReference23#dlllist
[dlllist]
enabled = yes
filter = yes

# List open handles of processes
# http://code.google.com/p/volatility/wiki/CommandReference23#handles
[handles]
enabled = yes
filter = yes

# Displays processes' loaded DLLs - Even hidden one (unlinked from PEB linked list)
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#ldrmodules
[ldrmodules]
enabled = yes
filter = yes

# Scan for Mutexes (whole system)
# http://code.google.com/p/volatility/wiki/CommandReference23#mutantscan
[mutantscan]
enabled = yes
filter = yes

# List devices and drivers
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#devicetree
[devicetree]
enabled = yes
filter = yes

# Scan for services
# http://code.google.com/p/volatility/wiki/CommandReferenceMal23#svcscan
[svcscan]
enabled = yes
filter = yes

# Scan for kernel drivers (includes hidden, unloaded)
# http://code.google.com/p/volatility/wiki/CommandReference23#modscan
[modscan]
enabled = yes
filter = yes

[yarascan]
enabled = yes
filter = yes

[ssdt]
enabled = yes
filter = yes

[gdt]
enabled = yes
filter = yes

# This will only run on XP profiles.
[sockscan]
enabled = yes
filter = no

# This will only run on Vista/7 profiles.
[netscan]
enabled = yes
filter = no

# Masks. Data that should not be logged
# Just get this information from your plain VM Snapshot (without running malware)
# This will filter out unwanted information in the logs
[mask]
enabled = no
pid_generic =