Memory Forensics and investigation

Executed memory forensic analysis on a raw memory dump (`exercise1.raw`) using Volatility Framework 2.5. Identified OS profile (`Win7SP1x64`), performed process enumeration (`pslist`), analyzed active TCP/UDP network connections (`netscan`), and ran process anomaly detection (`psxview`) to uncover hidden or unlinked malicious processes during incident triage.