Which Volatility 2/3 plugin helps identify injected or hidden code by listing DLLs loaded by processes?

• A. pslist
• B. dlllist
• C. netscan
• D. hivelist

Answer: (B)

Identifying injected or hidden code hinges on seeing what libraries are loaded into each running process. The Volatility plugin that does this exactly—listing all dynamic-link libraries mapped into every process and showing their paths—is the one that reveals injected or unusual modules. By comparing the loaded DLLs against known-good libraries, you can spot suspicious or unexpected modules that indicate code injection or stealthy activity. The other plugins serve different purposes: one enumerates processes themselves, another scans network connections, and another lists registry hives. So this plugin is the right tool for uncovering injected or hidden code by detailing the DLLs loaded per process.