{
    "info": {
        "author": "Alexandre D'Hondt",
        "author_email": "alexandre.dhondt@gmail.com",
        "bugtrack_url": null,
        "classifiers": [
            "Development Status :: 4 - Beta",
            "Environment :: Console",
            "Intended Audience :: Developers",
            "Intended Audience :: End Users/Desktop",
            "Intended Audience :: Information Technology",
            "License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)",
            "Programming Language :: Python :: 2",
            "Programming Language :: Python :: 2.7"
        ],
        "description": "[![PyPi](https://img.shields.io/pypi/v/appmemdumper.svg)](https://pypi.python.org/pypi/appmemdumper/)\n[![Build Status](https://travis-ci.org/dhondta/AppmemDumper.svg?branch=master)](https://travis-ci.org/dhondta/AppmemDumper)\n[![DOI](https://zenodo.org/badge/DOI/10.5281/zenodo.804958.svg)](https://doi.org/10.5281/zenodo.804958)\n[![Python Versions](https://img.shields.io/pypi/pyversions/appmemdumper.svg)](https://pypi.python.org/pypi/appmemdumper/)\n[![Requirements Status](https://requires.io/github/dhondta/AppmemDumper/requirements.svg?branch=master)](https://requires.io/github/dhondta/AppmemDumper/requirements/?branch=master)\n[![Known Vulnerabilities](https://snyk.io/test/github/dhondta/AppmemDumper/badge.svg?targetFile=requirements.txt)](https://snyk.io/test/github/dhondta/AppmemDumper?targetFile=requirements.txt)\n[![License](https://img.shields.io/pypi/l/appmemdumper.svg)](https://pypi.python.org/pypi/appmemdumper/)\n\n\n## Table of Contents\n\n   * [Introduction](#introduction)\n   * [System Requirements](#system-requirements)\n   * [Installation](#installation)\n   * [Quick Start](#quick-start)\n   * [Issues management](#issues-management)\n\n\n## Introduction\n\nThis tool automates the research of some artifacts for forensics purpose in memory dumps based upon Volatility for a series of common Windows applications.\n\nIt can also open multiple archive formats. In case of an archive, the tool will extract all its files to a temporary directory and then try to open each file as a memory dump (except files named README or README.md).\n\n\n## System Requirements\n\nThis framework was tested on an Ubuntu 18.04 with Python 2.7.\n\n\n## Installation\n\n1. Install system requirements\n\n ```session\n $ sudo apt-get install foremost\n $ git clone https://github.com/volatilityfoundation/volatility /tmp/vol-setup\n $ cd /tmp/vol-setup && sudo python setup.py install\n ```\n\n > **Behind a proxy ?**\n > \n > Do not forget to configure your Network system settings (or manually edit `/etc/apt/apt.conf`).\n \n2. Install AppMemDumper from Pip\n\n ```session\n $ pip install appmemdumper\n ```\n\n > **Behind a proxy ?**\n > \n > Do not forget to add option `--proxy=http://[user]:[pwd]@[host]:[port]` to your pip command.\n\n\n## Quick Start\n\n1. Help\n\n ```session\n $ app-mem-dumper -h\n usage: app-mem-dumper [-a APPS] [-d DUMP_DIR] [-f] [-p PLUGINS] [-s SYST]\n                         [-t TEMP_DIR] [-u] [-h] [-v]\n                         dump\n \n AppMemDumper v2.3.0\n Author   : Alexandre D'Hondt\n Copyright: \u00a9 2019 A. D'Hondt\n License  : GNU Affero General Public License v3.0\n \n This tool automates the research of some artifacts for forensics purpose in\n  memory dumps based upon Volatility for a series of common Windows applications.\n \n It can also open multiple archive formats (it uses pyunpack). In case of an\n  archive, the tool will extract all its files to a temporary directory and then\n  try to open each file as a memory dump.\n \n positional arguments:\n   dump                  memory dump file path\n \n optional arguments:\n   -a APPS               comma-separated list of integers designating applications to be parsed\n                          Currently supported: \n                           [0] AdobeReader             [8] Notepad\n                           [1] Chrome                  [9] OpenOffice\n                           [2] Firefox                 [10] PDFLite\n                           [3] FoxitReader             [11] SumatraPDF\n                           [4] InternetExplorer        [12] Thunderbird\n                           [5] KeePass                 [13] TrueCrypt\n                           [6] MSPaint                 [14] Wordpad\n                           [7] MediaPlayerClassic    \n                          (default: all)\n   -d DUMP_DIR, --dump-dir DUMP_DIR\n                         dump directory (default: files)\n   -f, --force           force profile search, do not use cached profile (default: False)\n   -p PLUGINS, --plugins-dir PLUGINS\n                         path to custom plugins directory (default: None)\n   -s SYST               comma-separated list of integers designating system items to be parsed\n                          Currently supported: \n                           [0] Clipboard               [8] Mimikatz\n                           [1] CommandLines            [9] NetworkConnections\n                           [2] CriticalProcessesInfo   [10] ProcessesInfo\n                           [3] Devices                 [11] Registry\n                           [4] DumpInfo                [12] Timeline\n                           [5] Kernel                  [13] UserActivities\n                           [6] LsaSecrets              [14] UserHashes\n                           [7] Malfind               \n                          (default: none)\n   -t TEMP_DIR, --temp-dir TEMP_DIR\n                         temporary directory for decompressed images (default: .temp)\n   -u, --update          update previous dump directories (default: False)\n \n extra arguments:\n   -h, --help            show this help message and exit\n   -v, --verbose         verbose mode (default: False)\n \n Usage examples:\n   app-mem-dumper memory.dmp\n   app-mem-dumper my-dumps.tar.gz\n   app-mem-dumper dumps.zip -g all\n   app-mem-dumper dump.raw -a 1,2,4 -f\n   app-mem-dumper dump.mem -a 0,3,10,11 -g 0\n \n ```\n \n2. Example of output\n\n ```session\n $ app-mem-dumper memory.dump -v -p plugins\n [appmemdumper] XX:XX:XX [DEBUG] Attempting to decompress 'memory.dump'...\n [appmemdumper] XX:XX:XX [DEBUG] Not an archive, continuing...\n [appmemdumper] XX:XX:XX [DEBUG] Setting output directory to 'files/memory.dump'...\n [appmemdumper] XX:XX:XX [INFO] Opening dump file 'memory.dump'...\n [appmemdumper] XX:XX:XX [INFO] Getting profile...\n [appmemdumper] XX:XX:XX [INFO] Getting processes...\n [appmemdumper] XX:XX:XX [DEBUG] > Executing command 'pslist'...\n [appmemdumper] XX:XX:XX [DEBUG] Found       : mspaint.exe\n [appmemdumper] XX:XX:XX [DEBUG] Not handled : audiodg.exe, csrss.exe, dllhost.exe, [...]\n [appmemdumper] XX:XX:XX [DEBUG] Profile: Win7SP0x86\n [appmemdumper] XX:XX:XX [INFO] Processing dumper 'dumpinfo'...\n [appmemdumper] XX:XX:XX [INFO] Processing dumper 'mspaint'...\n [appmemdumper] XX:XX:XX [DEBUG] Dumping for PID XXXX\n [appmemdumper] XX:XX:XX [DEBUG] > Calling command 'memdump'...\n [appmemdumper] XX:XX:XX [DEBUG] >> volatility --plugins=/path/to/plugins --file=[...]\n [appmemdumper] XX:XX:XX [INFO] > /path/to/files/memory.dump/mspaint-2640-memdump.data\n [appmemdumper] XX:XX:XX [WARNING] \n The following applies to collected objects of:\n - mspaint\n \n Raw data (.data files) requires manual handling ;\n Follow this procedure:\n  1. Open the collected resources with Gimp\n  2. Set the width and height to the expected screen resolution\n  3. Set another color palette than 'RVB'\n Restart this procedure by setting other parameters for width|height|palette.\n\n ```\n\n\n## Issues management\n\nPlease [open an Issue](https://github.com/dhondta/appmemdumper/issues/new) if you want to contribute or submit suggestions. \n\nThe *labels* usage convention is as follows :\n - General question: *question*\n - Suggestion: *help wanted*\n - Bug/exception/problem: *bug*\n - Improvement/contribution: *enhancement* ; NB: please precise if you are motivated and able to contribute\n\nIf you want to build and submit new dumpers, please open a Pull Request.",
        "description_content_type": "text/markdown",
        "docs_url": null,
        "download_url": "",
        "downloads": {
            "last_day": -1,
            "last_month": -1,
            "last_week": -1
        },
        "home_page": "https://github.com/dhondta/AppmemDumper",
        "keywords": "forensics,volatility,foremost,artifacts,windows,applications",
        "license": "AGPLv3",
        "maintainer": "",
        "maintainer_email": "",
        "name": "appmemdumper",
        "package_url": "https://pypi.org/project/appmemdumper/",
        "platform": "",
        "project_url": "https://pypi.org/project/appmemdumper/",
        "project_urls": {
            "Homepage": "https://github.com/dhondta/AppmemDumper"
        },
        "release_url": "https://pypi.org/project/appmemdumper/2.3.2/",
        "requires_dist": null,
        "requires_python": ">=2.7,<3",
        "summary": "This tool allows to collect various forensics artifacts in Windows memory dumps using Volatility and Foremost for common Windows applications.",
        "version": "2.3.2"
    },
    "last_serial": 5201924,
    "releases": {
        "2.0.0": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "a876dcf0dedc6862bdd11fd18b41fe1e",
                    "sha256": "2cdfbff674bb1d3c15fb4be2766fa685381085912c9cb38ec7aec2930348e7f8"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.0.0.tar.gz",
                "has_sig": false,
                "md5_digest": "a876dcf0dedc6862bdd11fd18b41fe1e",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, <4",
                "size": 11804,
                "upload_time": "2018-11-11T10:47:31",
                "url": "https://files.pythonhosted.org/packages/e3/8c/5dd8f75b96020501af95b2306e5c05c07698b37c7a3cfe6c9c4fd69d372d/appmemdumper-2.0.0.tar.gz"
            }
        ],
        "2.0.1": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "a7ba957897948b30d464eabb5233e133",
                    "sha256": "1d5293933b9f5638475a54ad5b2abe32270c5cc77763fdb01f76dd4fa1459dc7"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.0.1.tar.gz",
                "has_sig": false,
                "md5_digest": "a7ba957897948b30d464eabb5233e133",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7, !=3.0.*, !=3.1.*, !=3.2.*, !=3.3.*, <4",
                "size": 17507,
                "upload_time": "2018-11-11T11:02:08",
                "url": "https://files.pythonhosted.org/packages/d9/17/5251ddcc873c1fdb80ce5dad4797eb2fb8c27415a288de2be610ef004737/appmemdumper-2.0.1.tar.gz"
            }
        ],
        "2.0.2": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "782c46ab10ca02fc308154afbd064b9c",
                    "sha256": "3da6ea555b10991f3db1d69549cbc68826b95a9a8a9035356e16ec08f90ebe2c"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.0.2.tar.gz",
                "has_sig": false,
                "md5_digest": "782c46ab10ca02fc308154afbd064b9c",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 17467,
                "upload_time": "2018-11-11T11:20:36",
                "url": "https://files.pythonhosted.org/packages/ad/11/541318a195ae4d5ecf001ca00d410575b6360156b85b9d9a8c75eefdd990/appmemdumper-2.0.2.tar.gz"
            }
        ],
        "2.0.3": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "01e8bee6edfe4b4d7266177e77c3a193",
                    "sha256": "2adca139a30b1dffe41ac093055498bc18a07b7f6baf1b5f0592e61b3adad862"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.0.3.tar.gz",
                "has_sig": false,
                "md5_digest": "01e8bee6edfe4b4d7266177e77c3a193",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 17657,
                "upload_time": "2018-11-12T14:16:14",
                "url": "https://files.pythonhosted.org/packages/1a/a4/ab91644873f2c67979a9a4e0b6f7327170e3e615e07d703507b644033572/appmemdumper-2.0.3.tar.gz"
            }
        ],
        "2.0.4": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "31208fcb4698809a489239f9efa81b59",
                    "sha256": "3614d233673b131916e30056fe486f0f26238a7a64449f871434de5953294dbd"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.0.4.tar.gz",
                "has_sig": false,
                "md5_digest": "31208fcb4698809a489239f9efa81b59",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 17651,
                "upload_time": "2018-11-12T14:17:32",
                "url": "https://files.pythonhosted.org/packages/49/be/ecaf202a91ef7b7053d4dfed29d3206259396656fdd4202e95a64e17fb40/appmemdumper-2.0.4.tar.gz"
            }
        ],
        "2.1.0": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "4424d8a8abc3902137effd77c05294cb",
                    "sha256": "4f9349f281169ec2b3c604eafbdce5ee54ca3cca70bce00a17ab2c64edce33f1"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.1.0.tar.gz",
                "has_sig": false,
                "md5_digest": "4424d8a8abc3902137effd77c05294cb",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 18981,
                "upload_time": "2019-03-07T15:53:04",
                "url": "https://files.pythonhosted.org/packages/f5/fa/a9e2cb539e04e6e0b89f03a9f03f1888700bacac829feb62a2539a733868/appmemdumper-2.1.0.tar.gz"
            }
        ],
        "2.1.1": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "655734df32891097355cfb5bf968eff7",
                    "sha256": "27437cf488dbce9ddadab5c09410d0f904bf43b725f55cf16edcf999ac3cfc98"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.1.1.tar.gz",
                "has_sig": false,
                "md5_digest": "655734df32891097355cfb5bf968eff7",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 19034,
                "upload_time": "2019-03-12T21:50:56",
                "url": "https://files.pythonhosted.org/packages/83/f8/9deb0394d66a3e72a173aa603da575b09f4c62dbb057b6ad797bf64cf050/appmemdumper-2.1.1.tar.gz"
            }
        ],
        "2.1.2": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "3521b9331cdd074e6704ff755a642d3c",
                    "sha256": "b28f65e7564b4834ab97960134f62f900998f656b4ec574e0d8b2b4924700ed2"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.1.2.tar.gz",
                "has_sig": false,
                "md5_digest": "3521b9331cdd074e6704ff755a642d3c",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 19047,
                "upload_time": "2019-03-12T22:02:50",
                "url": "https://files.pythonhosted.org/packages/49/bb/4bbbc95bfe64eddd7a0a3a0446e80959902a6f5e53e975150a0fe2fc15e3/appmemdumper-2.1.2.tar.gz"
            }
        ],
        "2.1.3": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "6e27b1b6f0bfc947b8d1ba41c0cc05b6",
                    "sha256": "4132bdfd4f9e05fb5ff898752999918b5e62e0065eb9529e55b6e72a4b5a350e"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.1.3.tar.gz",
                "has_sig": false,
                "md5_digest": "6e27b1b6f0bfc947b8d1ba41c0cc05b6",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 19399,
                "upload_time": "2019-03-16T20:35:36",
                "url": "https://files.pythonhosted.org/packages/42/26/98d751dda08ceea7d2edb3c55a2910f0fb628f89208d7d3c301b740bf306/appmemdumper-2.1.3.tar.gz"
            }
        ],
        "2.1.4": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "78c377323fdaaf47e51f941543340a76",
                    "sha256": "5db7a93e8589c0120eaf1adb27d3fa85666bc6b575c04971d9fdacdbc9c76850"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.1.4.tar.gz",
                "has_sig": false,
                "md5_digest": "78c377323fdaaf47e51f941543340a76",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 19609,
                "upload_time": "2019-04-15T14:57:58",
                "url": "https://files.pythonhosted.org/packages/51/47/57877454f4680077a273adf7473bfda6f795f7c670d2171c3fc760db4cb5/appmemdumper-2.1.4.tar.gz"
            }
        ],
        "2.1.5": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "1fad7ba67008d1674a1635bc3a15c513",
                    "sha256": "6fa58ff87f110541532e5c1fb2af3e65ea05cc3d4b2ed8da0bb8f8e086c272e2"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.1.5.tar.gz",
                "has_sig": false,
                "md5_digest": "1fad7ba67008d1674a1635bc3a15c513",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 19622,
                "upload_time": "2019-04-26T10:13:45",
                "url": "https://files.pythonhosted.org/packages/e7/49/b9d9a3d3b5c3b521101bcc1db3a24d6b4048db714d6babeace2b50130249/appmemdumper-2.1.5.tar.gz"
            }
        ],
        "2.3.0": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "4de44562f271d74f6db9991b41b9bf48",
                    "sha256": "7e141fe4bbbccdf4d89c2ce4edf6934fd50f09d7b84e9a8af461c8f5bf66d37a"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.3.0.tar.gz",
                "has_sig": false,
                "md5_digest": "4de44562f271d74f6db9991b41b9bf48",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 22900,
                "upload_time": "2019-04-28T21:19:17",
                "url": "https://files.pythonhosted.org/packages/86/dc/75791d8c1e6baa583e7f7d9a0cda408b87b9fa679706521b874962fa1975/appmemdumper-2.3.0.tar.gz"
            }
        ],
        "2.3.1": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "2ed187b3986c7b290c6dbab416c8c1ff",
                    "sha256": "5c83d9907f439b871e0e12bbce6030279a9cb3860bdf89fea05c8687947fff70"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.3.1.tar.gz",
                "has_sig": false,
                "md5_digest": "2ed187b3986c7b290c6dbab416c8c1ff",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 22905,
                "upload_time": "2019-04-29T06:28:51",
                "url": "https://files.pythonhosted.org/packages/55/e2/2f5d0db1f16fe9f769c09f41385f013118212c6fec52daab8b2a07e4f18e/appmemdumper-2.3.1.tar.gz"
            }
        ],
        "2.3.2": [
            {
                "comment_text": "",
                "digests": {
                    "md5": "9a495a350ae66531222fe659b273c468",
                    "sha256": "301f61db6320782255bcd7a3b0ee374d9110a7e512c9c3d239b73a67490a1745"
                },
                "downloads": -1,
                "filename": "appmemdumper-2.3.2.tar.gz",
                "has_sig": false,
                "md5_digest": "9a495a350ae66531222fe659b273c468",
                "packagetype": "sdist",
                "python_version": "source",
                "requires_python": ">=2.7,<3",
                "size": 23108,
                "upload_time": "2019-04-29T07:18:46",
                "url": "https://files.pythonhosted.org/packages/ac/4a/dcbead3b05bb9ee92bbffb3eb5f54840b5b65e5fb65e932ac7e7f53a4e0a/appmemdumper-2.3.2.tar.gz"
            }
        ]
    },
    "urls": [
        {
            "comment_text": "",
            "digests": {
                "md5": "9a495a350ae66531222fe659b273c468",
                "sha256": "301f61db6320782255bcd7a3b0ee374d9110a7e512c9c3d239b73a67490a1745"
            },
            "downloads": -1,
            "filename": "appmemdumper-2.3.2.tar.gz",
            "has_sig": false,
            "md5_digest": "9a495a350ae66531222fe659b273c468",
            "packagetype": "sdist",
            "python_version": "source",
            "requires_python": ">=2.7,<3",
            "size": 23108,
            "upload_time": "2019-04-29T07:18:46",
            "url": "https://files.pythonhosted.org/packages/ac/4a/dcbead3b05bb9ee92bbffb3eb5f54840b5b65e5fb65e932ac7e7f53a4e0a/appmemdumper-2.3.2.tar.gz"
        }
    ]
}