Closed Jymit closed 4 years ago
https://github.com/volatilityfoundation/volatility/wiki/Command-Reference#networking
vol.py -f memdump.mem imageinfo vol.py -f memdump.mem --profile=Win10x64_17134 psscan vol.py -f memdump.mem --profile=Win10x64_17134 pstree vol.py -f memdump.mem --profile=Win10x64_17134 procdump -p 8560 --dump-dir=./ vol.py -f memdump.mem --profile=Win10x64_17134 memdump vol.py -f memdump.mem --profile=Win10x64_17134 memdump --dump-dir=./ vol.py -f memdump.mem --profile=Win10x64_17134 netscan > netscan.txt vol.py -f memdump.mem --profile=Win10x64_17134 pstree | egrep 'lsass|winlogon|services' vol.py -f memdump.mem --profile=Win10x64_17134 yarascan -Y "www.google.com" vol.py -f memdump.mem --profile=Win10x64_17134 yarascan -y rules/ursnif.yar vol.py -f memdump.mem --profile=Win10x64_17134 hollowfind