Oh, hello, in this lecture, we will be investigating Windows XP through data that get it from volatile
example's sample in order to do it all, not that type in Google and Google volatility.
Sample the image, Donat.
And click on the first result and Google, and you can see here we have several different options,
that fact infected was operating system memories, which I can see we will do to the two infected virus,
but one that we have in of seven 64 bit into it and not infected and creek that we have several more
images that infected by cryonics virus, Shylock virus and other which we have Android images, memory
images to download, as you can see here, and of course, images.
So I will download the Zeros app.
If these image you click on say OK, and you can see it, you are the one who stole nothing.
But I will not download now because it is holiday and upon the tone of the file.
And opening their archive, the password is infected.
Uh, click on Extract and I will select the music folder.
You can see the extraction completed successfully.
Close the browser.
And open the terminal in.
So in order to use one type of terminal type in terminal and after typing this, specify the direction
of memory file.
But you have to substraction and, uh, f which just means that you will be using volatility after the
specifying the pattern of emergent, uh, type imaging for and here is in a volatile is analyzing.
As you can see here, we have several information about the image, which is the images is Windows XP
Service Pack two and it's six, which was just 32 bit processor system.
And you can see an image that is two 11 and the October 10.
Uh, so we have several options, information about image, which we will specify the profile when analyzing
operating system image.
Uh, delete the image in full command.
And high profile.
Equals and could be the first profile, a security profile that can get it from IMMAGINE for comment
pasted and colleague list type lists, which is this command will give you the running processor's list
ideas and how many threads is running and when the process is started.
So as you can see here, we have a number of processes, which is VRM Services and Ligi Explorer that
Excel and CMT that takes them.
Then delete the list and type, yes, he has three, as you can see here, we have the processes that
are listed in the rule that out, which is you can see if it is system image at the top of that, all
of the explorer and, you know, all of the CFC laws they like and his which is this means that these
processes, his system processes and the top of the standard that and you can see it, explorer that
Excel, which is on top of that, we will try and see him.
That takes the.
And it appears to and pierce extra time instead of that, as you can see, we can see the precise side
as well that.
And this is this shows us this which is this process session where you can see here Sessions, the assessors
pizza options is showing that and -- can delete the last comment from the suit and tie.
Korn's you, which is this me?
This shows us the active connections and which connections, which connection is associated, which
profile, which you can see our full profile idea.
President's idea is one nine five six, so one nine five six provided it is, as you can see here,
explore that is using society one nine five six, which is the remote addresses.
And the report is here as information is shown us.
And so that is kind of same comment, but the associated and.
So it is shown here, which is a which others is using this circuit and we have here TCP UDP protocols
and the process I.D., which process is using these circuits and other informations about circuits?
And we have one commander.
Again, this is the same, the line commander which shows the scene, the commands history and that
which command is used and activated, executed by CMJ, which you can see here, that TSL is that the
is which process the six zero eight is associated is a command.
And there is you can see here we have several commands used by Adobe where a SEAL team did a six and
a look at the extent to which this means that someone or any implication is in use, it seemed to activate
and execute malicious programs.