RAMDumpExplorer 🕵️‍♂️💻

RAMDumpExplorer is a C# program that scans a RAM dump file (.raw) generated by a third-party app and searches for specific patterns using regular expressions.

How to Use 🔍

To use RAMDumpExplorer, follow these simple steps:

1. Generate a RAM dump file using a third-party app.

2. Download it in the Releases

3. Open a command prompt or terminal and navigate to the folder containing the RAMDumpExplorer executable.

4. Run the program with the path to the RAM dump file as the only argument in CMD:

   RAMDumpExplorer.exe path/to/ram.raw
   

5. Wait for the program to finish scanning the file.

6. The program will output the matched patterns to the console.

Features 🚀

RAMDumpExplorer is designed to search for two specific patterns:

1. Command prompt history - Searches for the last executed commands in a command prompt window.
2. Suspicious files - Searches for files that have been recorded in the system's RAM.
3. DLLS - Searches for DLLs executed with rundll32/regsvr32.

Credits 👨‍💻👩‍💻

Created by Bacanoicua.

Version 📝

1.0