#1Tools for analyzing RAM dumps to find running processes, network connections, and hidden malware.
Kitploit recommended
kaandemir993/vidar-stealer-reverse-engineering"In-depth reverse engineering analysis of Vidar Stealer 2.0 covering Task Scheduler tampering (1999 timestamps), Explorer.exe process hollowing, and…
agent-hellboy/ltmltm is a machine-history debugger for Linux. It records process, file, network, memory, and block-I/O metadata via eBPF, then lets you query the…
skelsec/pypykatzMimikatz implementation in pure Python
memoryforensics1/volexpvolatility explorer (volatility 2)
forrest-orr/artifacts-kitPseudo-malicious usermode memory artifact generator kit designed to easily mimic the footprints left by real malware on an infected Windows OS.
mmozeiko/aes-finderUtility to find AES keys in running processes
magnetforensics/swishdbgextIncident Response & Digital Forensics Debugging Extension
apr4h/cobaltstrikescanScan files or process memory for CobaltStrike beacons and parse their configuration
forrest-orr/monetaMoneta is a live usermode memory analysis tool for Windows with the capability to detect malware IOCs
memoryforensics1/vol3xpVolatility Explorer Suit (volatility 3)
strongcourage/uafuzzBinary-level directed fuzzer specialized in detecting Use-After-Free vulnerabilities via ordering-aware input metrics and static analysis, enabling…
xchwarze/magic-extractorUniversal Windows extraction tool that detects unknown files and routes them to the right bundled extractor.
kaandemir993/advanced-loader-reverse-engineering"In-depth reverse engineering analysis of an advanced multi-phase loader targeting Shellhost.exe, amsi.dll, mstscax.dll, and clbcatq.dll using module…
mandiant/flare-vmA collection of software installations scripts for Windows systems that allows you to easily setup and maintain a reverse engineering environment on…
hamza-megahed/volatility-guiGUI for Volatility forensics tool written in PyQT5
