Examine the output hive list to find the virtual memory address at which this registry keys from a specified hive.
Examine the output of hivelist. To find the virtual memory address at which this registry hive was loaded.
Question is .Run volatility hivedump - - output -file hivedump.txt - - hive-offset address (Substituting in the virtual memory address at the end).