Has anyone seen the Volatility “cmd_history” plugin developed by Eoghan Casey? I want to try it out. Pulls cmd lines from CSRSS.EXE memory.