Tags: memory forensic volatility 

Rating: 1.0

**https://hec-ker.tistory.com/194
**
The analysis will be conducted on the given 'foren.raw' file in the previous step.

We already know OS information (imageinfo), so let's check the list of processes through 'pslist'.

Original writeup (https://hec-ker.tistory.com/194).