What was actually running when the machine was captured — processes, injected code, open
connections, and registry state that a disk image alone can't show. Organized by what each
plugin surfaces, why it's worth checking, what a suspicious value looks like, and exactly how
to pull it up.
Click any card for why it matters, what a suspicious value looks like, its IOC type, and exactly how to pull it up.
Acquisition & Setup
Before Analysis
Getting the memory image in the first place, and telling Volatility what OS it's looking at, before any plugin will run correctly.
volatility3 -f memory.dmp windows.info
Process Analysis
First Pass
What was running, and — critically — whether every method of asking agrees on the answer.
volatility -f memory.dmp --profile=PROFILE pstree
Process Internals
Deep Dive
Once a process is worth a second look — what it loaded, what it was told to do, and what it had open.
What the host was talking to, registry state as it actually sat in memory — sometimes different from what's on disk — and credentials that only ever existed in RAM.