Volatility3
List all plugins available
python3 vol.py -h
List all active processes in a parent-child tree format
(* indicates a child, ** is a child of that child, etc)
python3 vol.py -f <dumpfile> windows.pstree
Find the exact file location of a process
python3 vol.py -f <dumpfile> windows.cmdline | grep lssass.exe
List all network connections made by a process
python3 vol.py -f <dumpfile> windows.cmdline | grep lssass.exe
Dump file of a specific process and search for GET requests
python3 vol.py -f <dumpfile> windows.memmap.Memmap --pid 2748 --dump
strings pid.2748.dmp | grep -i "Get /"
Check for additional files related to a specific process
python3 vol.py -f <dumpfile> windows.filescan | grep lssass.exe