Another process Identification command that can be used to list processes is S3.
Here.
So this command shows the same list of processes as the PS list.
But I Dentation is also used to identify child and parent processes, so run the PS3 PS3 plugin by typing
this PS3 command and click enter.
As you can see, we got an output here.
Now, copy this.
And click on the notepad so we can analyze it further.
Here.
So.
In this here, the last five processes are listed in Explorer dot exe and VMware User Cmd.exe, VMware
Tray X and Reader SL.
So and here explorer by itself so is not intended while all the others are.
So indicating that they are child process of explorer explorer dot exe, which is the parent process.
So now we're going to use another another command here.
Named P.
S scan here.
So the scan command displays inactive and even hidden processes that can be used by malware such as
Rootkits and are very, very well known for doing just that to evade discovery by users and antivirus
programs.
So now we're going to use the profile because this needs a profile here.
Now, as you as you remember, our profile was the Windows XP Service Pack two.
But in order to remember that I'm going to I'm going to just imageinfo here and we're going to get the
Windows XP Service Pack two.
Here.
So as you can see, this is service pack two and 32 bit x.
Here.
We can also use the profile of service pack 2 to 3, but it's always better to use first profile in
volatility.
Here.
So now we're going to use the scan scan.
And after like before the specifying file file, memory file, we need to add the profile here.
Profile.
Equals Windows XP Service Pack two.
86.
Here now.
Click Enter.
Here we have this.
Now we're going to.
Copy this.
Two more.
For further investigation on the notepad.
Here.
This is our output result.
So since we don't need time exited here, we can delete it.
So we can zoom in further.
Here.
Yeah.
So the output of the scan plugin in this memory address is as follows here.
So the output of both PS list and PS scan comments will be compared to observe any anomalies.
So we need to compare this.
With the previous command that we used scan.
So actually, let's compare it, see if we got any, uh, different results or if we have any hidden
processes.
Here.
We're gonna add another tab.
And as you can see here.
We will observe it in lectures, but for now.
It's like we don't have any hidden processes because as you can see here, all of these lines is almost
the same if we just delete this command.
Yeah, they are actually almost the same files.
Let's.
Yeah.
As you can see here, both of them has 25 lines in it.
So in next.
The plugin we have is ps x v here.
Now we're going to use p.
S x.
Vive Ps6.
Vive.
So as with the scan plugin, the ps6 is used to find and list hidden processes.
But with Ps6, however, a variety of scans are run, including the PS list and PS scan here.
So in order to run this command you need to specify the profile.
So we already did.
And yeah, click on Enter.
Yeah, we got actually as you can see, we got the different results from previous commands.
Copy it.
And here.
Can you see it?
Actually, clearly?
Yeah.
So the Ps6 Vive plugin lists the processes and compares the outputs listed as true or false.
So a false output means that the process is hidden.
Here.
It means that process is hidden.
Uh, that as in the C.
S, r, s s that X session and this chart here.
This means that.
Yeah, with false outputs for system and SMS, SMS dot x and this here says dot, which tells us that
the processes are not found in the in these areas and should be inspected further.
So not now that we have weaved and documented the services that were running at the time the memory
dump was taken.
So let's try to find network services and connections that may also have been established at the time.