[profiles]

packages=fast

[extension]

random=False

#[env]

#HOMEDRIVE=C:

[dump]

dump=mft,ram,mbr,registry

mft_export=True

[registry]

custom_registry_keys="HKCU\SOFTWARE\Locky"

registry_recursive=False

get_autoruns=True

[output]

type=csv

destination=local

dir=output

[filecatcher]

all_users=True

path=%USERPROFILE%/AppData|*

mime_filter=application/msword;application/octet-stream;application/x-archive;application/x-ms-pe;application/x-ms-dos-executable;application/x-lha;application/x-dosexec;application/x-elc;application/x-executable, statically linked, stripped;application/x-gzip;application/x-object, not stripped;application/x-zip;text/html;text/rtf;text/xml;UTF-8 Unicode HTML document text, with CRLF line terminators;UTF-8 Unicode HTML document text, with very long lines, with CRLF, LF line terminators

mime_zip=application/x-ms-pe;application/x-ms-dos-executable;application/x-dosexec;application/x-executable, statically linked, stripped

compare=AND

size_min=1k

size_max=100M

ext_file=*

zip_ext_file=*

zip=True

limit_days=unlimited

[modules]

pe

yara

[pe]

pe_mime_type=application/x-ms-pe;application/x-ms-dos-executable;application/x-ms-pe;application/x-dosexec;application/x-executable, statically linked, stripped

filtered_certificates=True

cert_filtered_issuer=issuer;O=Microsoft Corporation|Microsoft Time-Stamp PCA|Microsoft Time-Stamp PCA Microsoft Windows Verification PCA

cert_filtered_subject=subject;O=Microsoft Corporation|Microsoft Time-Stamp Service|Microsoft Time-Stamp Service Microsoft Windows

[yara]

filtered_yara=False

dir_rules=yara-rules