Volatility - objects

[adulau]

mutantscan

JSON export field name

"columns": [
    "Offset(P)",
    "Pointers",
    "Handles",
    "Signal",
    "Thread",
    "CID",
    "Name"
  ]
[33379968, 1, 1, "1", 0, "", ""], [33382448, 2, 1, "1", 0, "", "746bbf3569adEncrypt"], [33387864, 1, 1, "1", 0, "", ""], [33394584, 1, 1, "1", 0, "", ""], [33427592, 2, 1, "1", 0, "", "_SHuassist.mtx"]

SSDT

  "columns": [
    "Table",
    "TableOffset",
    "NumEntries",
    "Entry",
    "Addr",
    "Function",
    "Owner"
  ]
[
      "SSDT[1]",
      3214515072,
      667,
      4761,
      3214226858,
      "NtGdiUMPDEngFreeUserMem",
      "win32k.sys"
    ],
    [
      "SSDT[1]",
      3214515072,
      667,
      4762,
      3212932649,
      "NtGdiDrawStream",
      "win32k.sys"
    ]

modules

 "columns": [
    "Offset(V)",
    "Name",
    "Base",
    "Size",
    "File"
  ]
   [
      2182709560,
      "ParVdm.SYS",
      4173201408,
      8192,
      "\\SystemRoot\\System32\\Drivers\\ParVdm.SYS"
    ],
    [
      2183500848,
      "srv.sys",
      4152414208,
      335872,
      "\\SystemRoot\\system32\\DRIVERS\\srv.sys"
    ],
    [
      2182893856,
      "HTTP.sys",
      4150018048,
      266240,
      "\\SystemRoot\\System32\\Drivers\\HTTP.sys"
    ]

connscan

{
  "rows": [
    [
      34108960,
      "172.16.112.128:1038",
      "41.168.5.140:8080",
      1484
    ],
    [
      37388296,
      "172.16.112.128:1037",
      "125.19.103.198:8080",
      1484
    ]
  ],
  "columns": [
    "Offset(P)",
    "LocalAddress",
    "RemoteAddress",
    "PID"
  ]
}

This one can be easily mapped to netflow object.