medium10 pts · first answer countsincident-responsememory-forensicsvolatility

Hidden process in a memory dump

In Volatility 3, windows.psscan shows a process that windows.pslist does not. What is the most likely explanation?

A.psscan has a bug that makes up processes that never existedB.The process belongs to a different computer's memory imageC.pslist only shows processes started by the Administrator accountD.The process was unlinked from the active process list, a common hiding trick

Discussion 0

Join free to post in the discussion.

Hidden process in a memory dump

Discussion 0

Related questions