Volatility Plugins

Question 1

pslist

Answer 1

finds and walked the doubly linked list of processes and prints a summary of the data. This method typically cannot show you terminated or hidden processes

Question 2

pstree

Answer 2

takes the output from pslist and formats it in a tree view, so you can easily see parent and child relationships

Question 3

psscan

Answer 3

scans for _EPROCESS objects instead of relying on the linked list. This plugin can also find terminated and unlinked (hidden) processes
important to use in addition to pslist

Question 4

psxview

Answer 4

locates processes using alternate process listings, so you can then cross-reference different sources of information and reveal malicious discrepancies.