MemProcFS Analyzer Files

Automated Forensic Analysis of Windows Memory Dumps for DFIR

This is an exact mirror of the MemProcFS Analyzer project, hosted at https://github.com/LETHAL-FORENSICS/MemProcFS-Analyzer. SourceForge is not affiliated with MemProcFS Analyzer. For more information, see the SourceForge Open Source Mirror Directory.

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
MemProcFS-Analyzer-v1.0.zip	2023-11-22	606.0 kB	0
MemProcFS-Analyzer v1.0 source code.tar.gz	2023-11-22	4.2 MB	0
MemProcFS-Analyzer v1.0 source code.zip	2023-11-22	4.2 MB	0
README.md	2023-11-22	316 Bytes	0
Totals: 4 Items		9.1 MB	0

Added: Improved Hunting for Suspicious Scheduled Tasks Added: 318 YARA Custom Rules Added: Get-YaraCustomRules Added: Kroll RECmd Batch File v1.22 (2023-06-20) Added: Checkbox Forensic Timeline (CSV) Added: Checkbox Forensic Timeline (XLSX) Added: FindEvil: AV_DETECT Fixed: Other minor fixes and improvements

Source: README.md, updated 2023-11-22

You Might Also Like

Gen AI apps are built with MongoDB Atlas

The database for AI-powered applications.

MongoDB Atlas is the developer-friendly database used to build, scale, and run gen AI and LLM-powered apps—without needing a separate vector database. Atlas offers built-in vector search, global availability across 115+ regions, and flexible document modeling. Start building AI apps faster, all in one place.

Start Free

MongoDB Atlas runs apps anywhere

Deploy in 115+ regions with the modern database for every enterprise.

MongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.

Start Free

Recommended Projects

YARA
YARA is a tool aimed at (but not limited to) helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families (or whatever you want to describe) based on textual or binary patterns. Each description, a.k.a rule, consists of a set of...
Volatility
Volatility is a widely used open-source framework for analyzing memory captures (RAM dumps) from Windows, Linux, and macOS systems. It enables investigators and malware analysts to extract process lists, network connections, DLLs, strings, artifacts, and more. Volatility supports many plugins...
GRR
GRR Rapid Response is an incident response framework focused on remote live forensics. It consists of a python client (agent) that is installed on target systems, and python server infrastructure that can manage and talk to clients. The goal of GRR is to support forensics and investigations in a...
FTimes
FTimes is a forensic system baselining, searching, and evidence collection tool. Its primary purpose is to gather and/or develop topographical information and attributes about specified directories and files in a manner conducive to intrusion and forensic analysis.
DeepBlueCLI
DeepBlueCLI is a PowerShell-centric threat-hunting toolkit built to extract, normalize, and flag suspicious activity from Windows event logs and Sysmon telemetry. It parses common sources—including Windows Security, System, Application, PowerShell logs, and Sysmon event ID 1—then applies a rich...

MemProcFS Analyzer Files

Automated Forensic Analysis of Windows Memory Dumps for DFIR

Get an email when there's a new version of MemProcFS Analyzer