Skip to content

Commit 2880f67

Browse files
evild3adevild3ad
committed
Update README.md
1 parent 8ff5856 commit 2880f67

File tree

1 file changed

+25
-25
lines changed

1 file changed

+25
-25
lines changed

‎README.md‎

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -49,81 +49,81 @@ Download the latest version of **MemProcFS-Analyzer** from the [Releases](https:
4949
## Usage
5050
Launch Windows PowerShell (or Windows PowerShell ISE or Visual Studio Code w/ PSVersion: 5.1) as Administrator and open/run MemProcFS-Analyzer.ps1.
5151

52-
![File-Browser](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/01.png)
52+
![File-Browser](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/01.png)
5353
**Fig 1:** Select your Raw Physical Memory Dump and select your pagefile.sys (Optional)
5454

55-
![Auto-Install](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/02.png)
55+
![Auto-Install](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/02.png)
5656
**Fig 2:** MemProcFS-Analyzer auto-installs dependencies (First Run)
5757

58-
![Microsoft-Internet-Symbol-Store](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/03.png)
58+
![Microsoft-Internet-Symbol-Store](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/03.png)
5959
**Fig 3:** Accept Terms of Use (First Run)
6060

61-
![MemProcFS](https://github.com/evild3ad/MemProcFS-Analyzer/blob/f15d4c17150fabb6382d1b261fc52055c6046a88/Screenshots/04.png)
61+
![MemProcFS](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/04.png)
6262
**Fig 4:** If you find MemProcFS useful, please become a sponsor at: https://github.com/sponsors/ufrisk
6363

64-
![Mounted](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/05.png)
64+
![Mounted](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/05.png)
6565
**Fig 5:** You can investigate the mounted memory dump by exploring drive letter X:
6666

67-
![Auto-Update](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/06.png)
67+
![Auto-Update](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/06.png)
6868
**Fig 6:** MemProcFS-Analyzer checks for updates (Second Run)
6969

7070
Note: It's recommended to uncomment/disable the "Updater" function after installation. Check out the "Main" in the bottom of the script.
7171

72-
![FindEvil](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/07.png)
72+
![FindEvil](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/07.png)
7373
**Fig 7:** FindEvil feature and additional analytics
7474

75-
![Processes](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/08.png)
75+
![Processes](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/08.png)
7676
**Fig 8:** Processes
7777

78-
![RunningAndExited](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/09.png)
78+
![RunningAndExited](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/09.png)
7979
**Fig 9:** Running and Exited Processes
8080

81-
![ProcessTree](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/10.png)
81+
![ProcessTree](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/10.png)
8282
**Fig 10:** Process Tree (GUI)
8383

84-
![ProcessTreeSearch](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/11.png)
84+
![ProcessTreeSearch](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/11.png)
8585
**Fig 11:** Checking Process Tree (to find anomalies)
8686

87-
![ProcessTreeAlerts](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/12.png)
87+
![ProcessTreeAlerts](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/12.png)
8888
**Fig 12:** Process Tree: Alert Messages w/ Process Call Chain
8989

90-
![PropertiesView](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/13.png)
90+
![PropertiesView](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/13.png)
9191
**Fig 13:** Process Tree: Properties View → Double-Click on a process or alert message
9292

93-
![IPinfo](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/14.png)
93+
![IPinfo](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/14.png)
9494
**Fig 14:** GeoIP w/ IPinfo.io
9595

96-
![MapReport](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/15.png)
96+
![MapReport](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/15.png)
9797
**Fig 15:** Map IPs w/ IPinfo.io
9898

99-
![EVTX](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/16.png)
99+
![EVTX](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/16.png)
100100
**Fig 16:** Processing Windows Event Logs (EVTX)
101101

102-
![Zircolite](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/17.png)
102+
![Zircolite](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/17.png)
103103
**Fig 17:** Zircolite - A standalone SIGMA-based detection tool for EVTX (Mini-GUI)
104104

105-
![Amcache](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/18.png)
105+
![Amcache](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/18.png)
106106
**Fig 18:** Processing extracted Amcache.hve → XLSX
107107

108-
![ShimCache](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/19.png)
108+
![ShimCache](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/19.png)
109109
**Fig 19:** Processing ShimCache → XLSX
110110

111-
![Timeline-Explorer](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/20.png)
111+
![Timeline-Explorer](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/20.png)
112112
**Fig 20:** Analyze CSV output w/ Timeline Explorer (TLE)
113113

114-
![ELK-Import](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/21.png)
114+
![ELK-Import](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/21.png)
115115
**Fig 21:** ELK Import
116116

117-
![ELK-Timeline](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/22.png)
117+
![ELK-Timeline](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/22.png)
118118
**Fig 22:** Happy ELK Hunting!
119119

120-
![Secure-Archive-Container](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/23.png)
120+
![Secure-Archive-Container](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/23.png)
121121
**Fig 23:** Multi-Threaded ClamAV Scan to help you finding evil! ;-)
122122

123-
![Message-Box](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/24.png)
123+
![Message-Box](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/24.png)
124124
**Fig 24:** Press **OK** to shutdown MemProcFS and Elastisearch/Kibana
125125

126-
![Output](https://github.com/evild3ad/MemProcFS-Analyzer/blob/e081cfb94cb4b8b7a8795e99bec28e0a3f7b0432/Screenshots/25.png)
126+
![Output](https://github.com/evild3ad/MemProcFS-Analyzer/blob/8ff585672b7bbe689ad10080555f62dce2b0c06d/Screenshots/25.png)
127127
**Fig 25:** Secure Archive Container (PW: MemProcFS)
128128

129129
## Introduction MemProcFS and Memory Forensics

0 commit comments

Comments
 (0)