From a140a2fa41deebc98e214d409685047599eaa8dd Mon Sep 17 00:00:00 2001 From: iMHLv2 Date: Wed, 3 Jul 2013 01:28:59 +0000 Subject: [PATCH] add wininet.dll to the list of DLLs checked by apihooks when --quick is supplied --- volatility/plugins/malware/apihooks.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility/plugins/malware/apihooks.py b/volatility/plugins/malware/apihooks.py index 6bd7ad9e..45b0c950 100644 --- a/volatility/plugins/malware/apihooks.py +++ b/volatility/plugins/malware/apihooks.py @@ -359,7 +359,7 @@ class ApiHooks(procdump.ProcExeDump): "advapi32.dll", "secur32.dll", "crypt32.dll", "user32.dll", "gdi32.dll", "shell32.dll", "shlwapi.dll", "lsasrv.dll", "cryptdll.dll", "wsock32.dll", "mswsock.dll", "urlmon.dll", - "csrsrv.dll", "winsrv.dll"] + "csrsrv.dll", "winsrv.dll", "wininet.dll"] # When scanning for calls to unknown code pages (UCP), only # analyze the following drivers. This is based on an analysis of