Hey Michael,

trying to list the hooked API-calls in the zeus.vmem-image according page 666 of your “Cookbook”  with Volatility 2.0 and maware.py r97  I get the following result only:

C:\Python27\Scripts>python vol.py apihooks -f "D:\X-Ways-Images\Malware\zeus.vmem"

Volatile Systems Volatility Framework 2.0

Name                             Type     Target                                   Value

wuauclt.exe[468]@wuaueng.dll     iat      sfc.dll!*invalid*                        0x0 0x76c69828 (sfc_os.dll)

Finished after 383.752000093 seconds

Did I miss something or should I use an older version of Volatility and the malware-Plugin?

Kindest regards

Michael