Forensics on sys-net

There are lot of things you can try. I do recommend an independent template HVM with Kaisen OS. It depends on your skill and what you are used to. I can give you links all that long and tips but I can’t transfer decades of experience. If you think they use some memory leak to break through (very common) you can look into TDMalloc or other memory allocation. It is just guessing. Try the Kaisen OS independent HVM!