Volatility

1. Download Volatility.
2. get a sample for analyzing.
3. run as below.

C:\Users\admin\Desktop>volatility_2.6_win64_standalone -f windows.raw imageinfo
Volatility Foundation Volatility Framework 2.6
INFO    : volatility.debug    : Determining profile based on KDBG search...
          Suggested Profile(s) : Win7SP1x64, Win7SP0x64, Win2008R2SP0x64, Win2008R2SP1x64_23418, Win2008R2SP1x64, Win7SP1x64_23418
                     AS Layer1 : WindowsAMD64PagedMemory (Kernel AS)
                     AS Layer2 : FileAddressSpace (C:\Users\admin\Desktop\windows.raw)
                      PAE type : No PAE
                           DTB : 0x187000L
                          KDBG : 0xf800027f90a0L
          Number of Processors : 1
     Image Type (Service Pack) : 1
                KPCR for CPU 0 : 0xfffff800027fad00L
             KUSER_SHARED_DATA : 0xfffff78000000000L
           Image date and time : 2014-07-19 02:46:55 UTC+0000
     Image local date and time : 2014-07-18 19:46:55 -0700

4. and then look at suggested fields.

5. run below which picked up from suggested profile Win7SP1.x64.

C:\Users\admin\Desktop>volatility_2.6_win64_standalone -f windows.raw --profile=Win7SP1x64 pslist
Volatility Foundation Volatility Framework 2.6
Offset(V)          Name                    PID   PPID   Thds     Hnds   Sess  Wow64 Start                          Exit
------------------ -------------------- ------ ------ ------ -------- ------ ------ ------------------------------ ------------------------------
0xfffffa8000697040 System                    4      0     74      509 ------      0 2014-07-19 02:39:15 UTC+0000
0xfffffa800151cb30 smss.exe                224      4      2       29 ------      0 2014-07-19 02:39:15 UTC+0000
0xfffffa8001be0b30 csrss.exe               316    308      8      414      0      0 2014-07-19 02:39:22 UTC+0000
0xfffffa8001bf5060 csrss.exe               352    344      8      248      1      0 2014-07-19 02:39:37 UTC+0000
0xfffffa8001bc2620 wininit.exe             360    308      3       75      0      0 2014-07-19 02:39:38 UTC+0000
0xfffffa8001bfe060 winlogon.exe            388    344      7      133      1      0 2014-07-19 02:39:38 UTC+0000
0xfffffa8001114b30 services.exe            448    360      7      197      0      0 2014-07-19 02:39:42 UTC+0000
0xfffffa8001f5a230 lsass.exe               464    360      7      555      0      0 2014-07-19 02:39:42 UTC+0000
0xfffffa8001f5db30 lsm.exe                 472    360      9      144      0      0 2014-07-19 02:39:42 UTC+0000
0xfffffa80020bd060 svchost.exe             564    448     10      361      0      0 2014-07-19 02:39:45 UTC+0000
0xfffffa80012ed450 svchost.exe             636    448     10      258      0      0 2014-07-19 02:39:46 UTC+0000
0xfffffa8001488260 sppsvc.exe              820    448      5      160      0      0 2014-07-19 02:40:00 UTC+0000
0xfffffa8001f5fb30 svchost.exe             860    448     20      423      0      0 2014-07-19 02:40:01 UTC+0000
0xfffffa800159d060 svchost.exe             884    448     36      999      0      0 2014-07-19 02:40:01 UTC+0000
0xfffffa80021aeb30 svchost.exe             920    448     19      455      0      0 2014-07-19 02:40:02 UTC+0000
0xfffffa80021f5b30 svchost.exe             260    448     13      325      0      0 2014-07-19 02:40:25 UTC+0000
0xfffffa80021f9060 svchost.exe             252    448     17      471      0      0 2014-07-19 02:40:25 UTC+0000
0xfffffa8002299430 TrustedInstall          840    448      5      125      0      0 2014-07-19 02:40:27 UTC+0000
0xfffffa80022e0b30 spoolsv.exe            1128    448     12      273      0      0 2014-07-19 02:40:29 UTC+0000
0xfffffa800230eb30 svchost.exe            1156    448     19      306      0      0 2014-07-19 02:40:29 UTC+0000
0xfffffa8001c3cb30 svchost.exe            1804    448     15      235      0      0 2014-07-19 02:40:59 UTC+0000
0xfffffa8001ca33a0 SearchIndexer.         1880    448     15      755      0      0 2014-07-19 02:41:00 UTC+0000
0xfffffa8001c56910 SearchProtocol         1176   1880     10      449      0      0 2014-07-19 02:41:05 UTC+0000
0xfffffa8001440740 taskhost.exe           1760    448      8      192      1      0 2014-07-19 02:41:11 UTC+0000
0xfffffa8001c93b30 dwm.exe                1788    860      3       78      1      0 2014-07-19 02:41:11 UTC+0000
0xfffffa8001ef5060 explorer.exe            984   1868     41     1089      1      0 2014-07-19 02:41:12 UTC+0000
0xfffffa8001ce2060 regsvr32.exe           1848    984      0 --------      1      0 2014-07-19 02:41:24 UTC+0000   2014-07-19 02:41:26 UTC+0000
0xfffffa8000e2cb30 wmpnetwk.exe            732    448      9      210      0      0 2014-07-19 02:42:00 UTC+0000
0xfffffa8000e81780 mscorsvw.exe           2344    448      7       95      0      1 2014-07-19 02:42:32 UTC+0000
0xfffffa8000ecbb30 mscorsvw.exe           2368    448      7       89      0      0 2014-07-19 02:42:33 UTC+0000
0xfffffa8000f2ab30 svchost.exe            2408    448     14      343      0      0 2014-07-19 02:42:34 UTC+0000
0xfffffa8001e8f520 SearchProtocol         2844   1880      8      280      1      0 2014-07-19 02:44:08 UTC+0000
0xfffffa80007503d0 WmiPrvSE.exe           2912    564      7      125      0      0 2014-07-19 02:44:32 UTC+0000
0xfffffa8002005b30 WinSCP.exe             2668   2580      6      165      1      1 2014-07-19 02:46:02 UTC+0000
0xfffffa8000f2d560 SearchFilterHo          548   1880      9      181      0      0 2014-07-19 02:46:09 UTC+0000
0xfffffa8000ef6960 DumpIt.exe              708    984      2       45      1      1 2014-07-19 02:46:52 UTC+0000
0xfffffa8000ed1060 conhost.exe             808    352      2       51      1      0 2014-07-19 02:46:52 UTC+0000

C:\Users\admin\Desktop>