A machine on our network was compromised with Meterpreter.
We have traffic captures from the entire period of the compromise and a memory dump of the infected machine at a time when the connection was established.
Can we decode the HTTPS/SSL traffic we have captured?
So far we have used Volatility's dumpcerts plugin to extract some public certs but no private ones are apparent. Surely the private keys must be in memory somewhere since the connection was still established?
The TLS version is TLSv1 1.0. The algorithm identifier is sha256WithRSAEncryption.