svcscan

The svcscan plugin allows the analyst to list out the services running. This plugin gives more detail to the running processes in the event that the analyst requires additional details such as the display name, binary path, or service type. The following command will list the processes:

forensics@ubuntu:~/Documents$ volatility -f stuxnet.vmem --profile=WinXPSP2x86 svcscan

The abridged output is shown in the following screenshot. As can be seen, the output provides a great deal more information concerning the active processes than the pslist plugin:

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset