Re: [Vol-users] procexedump Error: Cannot acquire process AS

The process doesn't appear to have exited based on pslist (and it was still generating network traffic while I dumped ram) Offset(V) Name PID PPID Thds Hnds Sess Wow64 Start Exit ---------- -------------------- ------ ------ ------ -------- ------ ------ -------------------- -------------------- 0x8b3802a8 System 4 0 127 -------- ------ 0 0x89be3290 smss.exe 312 4 2 -------- ------ 0 2012-10-26 02:29:26 [...] 0x89b1e020 redactedxx.e 1684 432 15 -------- ------ 0 2012-10-26 02:29:39 Don't know if this helps psxview Volatile Systems Volatility Framework 2.2 Offset(P) Name PID pslist psscan thrdproc pspcdid csrss ---------- -------------------- ------ ------ ------ -------- ------- ----- 0x09b17b70 svchost.exe 2632 True True False False False [...] 0x09b1e020 redactedxx.e 1684 True True False False False psscan sansforensics@SIFT-Workstation:~/Desktop$ vol.py -f ~/Desktop/image.raw --profile Win2003SP2x86 psscan Volatile Systems Volatility Framework 2.2 Offset(P) Name PID PPID PDB Time created Time exited ---------- ---------------- ------ ------ ---------- -------------------- -------------------- 0x09b1e020 redactedxx.e 1684 432 0xcf3392c0 2012-10-26 02:29:39 On Mon, Oct 29, 2012 at 6:44 PM, Michael Hale Ligh <michael.hale(a)gmail.com> wrote: