What does the free prescan check before I run anything?

It parses the Volatility tables in your browser, with no upload and no AI, and runs a fixed checklist: processes present in psscan but absent from pslist (the signature of an unlinked process), system binaries running outside their real install directory, unexpected parent processes against the fixed Windows launcher map, duplicate singleton processes such as a second lsass.exe, PAGE_EXECUTE_READWRITE regions from malfind and whether an MZ header sits in them, living-off-the-land binaries and encoded or hidden-window command lines, shadow-copy and backup-catalog deletion, execution from user-writable paths, and outbound sessions to public addresses or notable ports. Each family explains why it matters. It costs nothing and runs while you type.

Does RAM Triage check the model's answer against the evidence?

Yes, and that is the point of doing the parsing client-side. After the report renders, a reconciliation panel lists every prescan flag the report failed to address, any unlinked process missing from its suspicious-process table, any RWX region it did not assess, any evidence quote that cannot be found verbatim in your paste, any PID it cited that never appears in the pasted output at all, and every indicator and remote endpoint in the IOC and network tables that cannot be found in your paste — those rows are marked unverified where you read them, and the IOC CSV carries a found_in_paste column so an unconfirmed indicator can never reach a blocklist looking verified. Disagreements are shown, not hidden.

Which Volatility plugins should I paste?

windows.pslist, windows.psscan, windows.cmdline, windows.netscan and windows.malfind are the core five and the app tells you which of them are missing from your paste. windows.dlllist, windows.svcscan and windows.filescan are also parsed when present. Keep the '$ vol -f memory.raw windows.pslist' command lines in the paste - they are how the sections are told apart. If you drop saved files instead, the plugin is taken from the file name, so pslist.txt and windows.pslist.txt both work even though a redirected file holds no command line. Triage is only as wide as what you pasted, and the report is instructed to say so rather than treat a missing plugin as a clean result.

My paste is enormous. Does it get truncated?

It gets clipped, not truncated. Volatility output is tabular, so cutting at a character offset would sever a row mid-field and orphan the header that gives the remaining rows meaning. Instead each plugin section keeps its command line, its header row and as many whole rows as the budget allows, with an explicit marker saying how many rows were dropped from that section. The count is shown to you and passed to the model, so absence is never mistaken for evidence.

What does a run cost, and can I try it without signing in?

The prescan is free and always runs in your browser. The triage run is metered: a worst-case amount is reserved before the run and only what the run actually uses is charged, with both shown on the meter beside the button. Three bundled captures - a confirmed ransomware staging case, an ambiguous EDR alert and a clean baseline - replay their saved reports in full for free without signing in, so every verdict branch is reachable at zero cost.

RAM Triage — paste the Volatility output, get the memory-forensics verdict

The Volatility 3 output

Or pick files: they are read locally, nothing uploads until you run.

Case or host name — optional

What prompted the capture

Operating system

How the dump was acquired

Analyst context — optional, but it is what separates a finding from a false positive

The triage report

Executive summary

Assumptions & open questions

Suspicious processes

PID	PPID	Name	Path	Severity	Technique	Why, with the evidence

Injected memory Private committed pages that are writable and executable at once. A JIT engine produces these legitimately; so does shellcode.

PID	Process	Region	Protection	Verdict	Why

Network indicators

PID	Process	Local	Remote	State	Severity	Why

Persistence

Indicators of compromise

Type	Value	Confidence	Where it came from

Timeline

Run these next

Containment

Prescan reconciliation

Next steps

Summary

Result

How it works

No dump to hand? Load the — an unlinked process, a fake svchost.exe running out of Temp, an RWX region with an MZ header and shadow copies being deleted — the , where a backup agent spawning cmd.exe and a certutil download are exactly as explainable as they are alarming, or the , where the honest answer is that this output shows nothing.

Paste the plugin output — the prescan is free

No upload, no AI, no network: the parser splits the paste into plugin sections, rebuilds the process table from pslist and psscan, and runs a fixed checklist. It diffs psscan against pslist to find processes that are running while unlinked from the kernel's active-process list; checks every system binary name against its real install directory, so a svchost.exe in Temp is caught and the genuine explorer.exe in C:\Windows is not; compares each process against the fixed Windows launcher map; reads the malfind page protections and looks for an MZ header in the region; and flags living-off-the-land binaries, encoded and hidden-window command lines, shadow-copy deletion, and outbound sessions to public addresses or notable ports. Each family explains what it is and why it matters. This part costs nothing and happens while you type.

The AI triages — this is the metered part

An analyst's pass over the whole paste: which processes are suspicious and by what technique, each carrying a verbatim quote from your output that establishes it; whether each writable-executable region is injected code or a JIT artefact; which sessions matter and why; what persistence is visible; the indicators worth pushing to a blocklist; a timeline built only from timestamps that are actually there; and the next Volatility commands, targeted at the specific PIDs it flagged. It is told never to invent a PID, never to attribute to a named threat actor, and never to claim it ran anything. When the evidence is equivocal the posture is suspicious — needs follow-up, which is a complete answer. Pricing is honest too: a worst-case amount is reserved before the run and only what the run actually uses is charged.

Read the reconciliation, then export

The free lane audits the paid one. After the report renders, a reconciliation panel lists every prescan flag the report failed to address, any unlinked process missing from its table, any RWX region it did not assess, any evidence quote that is not a verbatim substring of your paste, any PID it cited that never appears in your output at all, and any indicator or remote endpoint the paste does not support — unverified rows are marked in the IOC and network tables themselves, and the IOC CSV carries a found_in_paste column so nothing unconfirmed reaches a blocklist looking verified. Then export: indicators as CSV for a blocklist, the process table as CSV, the report as Markdown or JSON, and the follow-up commands as a block you can paste straight into a shell. Cases are saved to your SkillSafe account and searchable by meaning, so when the second capture arrives you can pull up the first.

A derived work of the open-source @wshobson/memory-forensics agent skill (MIT). RAM Triage reads plugin output you paste; it does not acquire, parse or execute anything against a memory image.