In this lecture we will learn about the list plugin in volatility.
So this tool not only displays a list of all running processor, but also gives a useful information
such as the process ID and parent process ID.
So in order to run this plugin, you need to like specify the directory of volatility file like volatility
program and then up specify the directory of virtual memory file with this parameter and then use the
PS list PS list plugin in after this.
After the specifying the file name here.
And as you can see here, we got this useful information from it.
So now I want to actually.
Let's see.
Yeah.
Yes, Actually, you can see pretty much everything, but I'm going to.
Decrease the font size a little bit.
So you can see more?
Yeah.
You know, think it's okay here.
So.
This is the output.
Here we have the name process, ID, PID threads, hands and C session.
We have Windows 64.
All of this is zero because we we have a 32 bit system and the start time of the.
Executable, uh, task here.
So here, uh, in this code we have, uh, system.
System.
Uh, we have winlogon.
And we have services and also we have CBC host Xs here executables.
And this services here are started at first here, as you can see these time here.
So and after that we it started the read SL here read the cell that x LG dot x here.
Algae, not eggs.
And finally the VM VMware user that exit here.
So the process ID here identifies the processes and the PID identifies the parent process, parent of
the process here.
So looking at the list output here.
We can see that the winlogon here.
Winlogon.
Oops.
We can see that Winlogon.
Your services and winlogon.
Here is the parent process here.
Services.
676 and 600.
Yeah.
634 632.
So this IDs specifies the these IDs of the services and services and l a s s lsas here directly after
the winlogon dot x process.
And these are both 630 632 here.
Here services A here 632.
And, uh, the process ID is here.
536.
Here.
Now, as you can see, when we go down, we have a VMware tray that has a different parent process ID.
So for this new parent process ID and process themselves, a quick Google search can assist with identification
and description information.
It is also useful to become familiar with many of the startup processes in order to really point out
processes that may be unusual or suspect here.
So the timing and order of the processes should be also noted as they that these may assist in investigation.
So although not seen in the previous output due to the limited screen space.
Here.
Um, if you scroll a bit.
We can also see the Explorer dot exe with the process ID of 1956.
So is the process ID of reader SL here, as you can see, 1956.
So.
Adding to the analysis, we can see that there are two instances of assault here and w w assault here,
as you can see here.
Which it's it's actually a little bit suspected here.