{"id":13612374,"url":"https://github.com/kevthehermit/volatility_plugins","last_synced_at":"2026-02-11T08:10:59.977Z","repository":{"id":133007748,"uuid":"69238286","full_name":"kevthehermit/volatility_plugins","owner":"kevthehermit","description":"Volatility Plugins","archived":false,"fork":false,"pushed_at":"2023-07-22T20:35:07.000Z","size":36,"stargazers_count":61,"open_issues_count":2,"forks_count":22,"subscribers_count":4,"default_branch":"main","last_synced_at":"2025-04-14T02:38:34.107Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kevthehermit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2016-09-26T10:15:09.000Z","updated_at":"2025-03-19T04:24:43.000Z","dependencies_parsed_at":"2024-01-12T03:36:18.018Z","dependency_job_id":"1d879e05-1032-4d19-806d-1b35483806f2","html_url":"https://github.com/kevthehermit/volatility_plugins","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/kevthehermit/volatility_plugins","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevthehermit%2Fvolatility_plugins","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevthehermit%2Fvolatility_plugins/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevthehermit%2Fvolatility_plugins/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevthehermit%2Fvolatility_plugins/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kevthehermit","download_url":"https://codeload.github.com/kevthehermit/volatility_plugins/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kevthehermit%2Fvolatility_plugins/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29329721,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-11T06:13:03.264Z","status":"ssl_error","status_checked_at":"2026-02-11T06:12:55.843Z","response_time":97,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T20:00:28.913Z","updated_at":"2026-02-11T08:10:59.954Z","avatar_url":"https://github.com/kevthehermit.png","language":"Python","funding_links":[],"categories":["Volatility plugins","\u003ca id=\"4d2a33083a894d6e6ef01b360929f30a\"\u003e\u003c/a\u003eVolatility"],"sub_categories":[],"readme":"# volatility_plugins\nA collection of plugins for the Volatility Memory Framework\n\nPlease see individual folders for details. \n\n## Vol3\n\n### ZoneID3\nScans memory for ZoneIdentifier 3 ADS streams assocaited with files downloaded from the internet\n\n```\n$ vol -r pretty -p ~/github/volatility_plugins -f Win10Dev-Snapshot1.vmem zoneid3\nVolatility 3 Framework 2.5.0\nFormatting...0.00               PDB scanning finished\n  | ZoneID |                                                                             Host URL |                                            Referrer Url\n* |      3 |                                   https://download.sysinternals.com/files/Sysmon.zip | https://learn.microsoft.com/\n* |      3 | https://raw.githubusercontent.com/olafhartong/sysmon-modular/master/sysmonconfig.xml | NotPresent\n* |      3 |                  https://download.splunk.com/products/universalforwarder/release.msi | NotPresent\n* |      3 |                                           https://mh-nexus.de/downloads/HxDSetup.zip | https://mh-nexus.de/en/downloads.php?product=HxD20\n* |      3 |                                                                           NotPresent | C:\\Users\\User\\Downloads\\PE-bear_0.6.1_x64_win_vs13.zip\n```\n\n### Cobalt Strike\nScans process memory for each process to identify CobaltStrike config and prints the config elements\n\n```\n❯ vol  -r pretty -p ~/github/volatility_plugins -f Server16-CobaltStrike.raw cobaltstrike\nVolatility 3 Framework 2.5.0\nFormatting...0.00               PDB scanning finished                        \n  |  PID |        Process | Port | Sleep | Jitter |            Server |   POST_PATH |               x86 Install_Path |                x64 Install_Path |                Pipe | License ID\n* | 4396 | ShellExperienc | 4444 | 10000 |      0 |                   |             | %windir%\\syswow64\\rundll32.exe | %windir%\\sysnative\\rundll32.exe | \\\\.\\pipe\\msagent_89 | 1234567890\n* | 4396 | ShellExperienc | 4444 | 10000 |      0 |                   |             | %windir%\\syswow64\\rundll32.exe | %windir%\\sysnative\\rundll32.exe | \\\\.\\pipe\\msagent_89 | 1234567890\n* | 4604 |   rundll32.exe |  443 |  5000 |      0 | 54.170.175.43,/ca | /submit.php | %windir%\\syswow64\\rundll32.exe | %windir%\\sysnative\\rundll32.exe |                     | 1234567890\n```\n\n### Password Managers\nExtracts cached passwords from browser process memory. \nSupports:\n- Lastpass\n\n```\n$ vol -p ~/github/volatility_plugins -f Win7-Analysis-1d23dece.vmem passwordmanager \nVolatility 3 Framework 2.5.0\nProgress:  100.00               PDB scanning finished                                                                                              \nPID     Process Username        Password        Domain\n\n3400    chrome.exe      Not found       mt5JwaPvLctWFzBj        https://www.demodomain.co.uk/\n3400    chrome.exe      Not found       Not found       https://leakforums.net/\n3400    chrome.exe      Not found       rmH61LVBqHSVJ9a2        https://leakforums.net/\n3400    chrome.exe      Not found       Not found       https://leakforums.net/\n```\n\n### Rich Header\n\nPrints the XOR Key and Rich Header Hash for all process executables. \n\n```\n$ vol -p ~/github/volatility_plugins -f Server16-CobaltStrike.raw richheader\nVolatility 3 Framework 2.5.0\nProgress:  100.00               PDB scanning finished                        \nPID     Process XOR Key Rich Header Hash\n\n380     smss.exe        e8fbb614        b4da76d938693e03d2d455ef37561772\n512     csrss.exe       fba319c1        e4971216867bfffb7beb058dca378a84\n592     csrss.exe       fba319c1        e4971216867bfffb7beb058dca378a84\n608     wininit.exe     75318913        f8116f1336d2c70bd16b01ad8be7bb6d\n644     winlogon.exe    4bc258ac        c4f0d2eedff3968a8af33cf724e22790\n716     services.exe    b05eb20c        75daeb432ccb73aa5349c09bd00c2945\n728     lsass.exe       631ad1fb        5a2611fd92fa692a9663952ec838d57b\n800     svchost.exe     fdedd411        bdf4caf91c4d0776c4021998c204944a\n852     svchost.exe     fdedd411        bdf4caf91c4d0776c4021998c204944a\n\n```\n\n## Vol2\n\nThese plugins are no longer activly maintained and will be / have been ported to Volatilty V3\n\n### USBSTOR\nParses the USBSTOR and other registry values from memory to identify USB Devices connected to the system\n\n### LastPass\nRead browser memory space and attempt to recover any resident artefacts\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkevthehermit%2Fvolatility_plugins","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkevthehermit%2Fvolatility_plugins","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkevthehermit%2Fvolatility_plugins/lists"}