Datasetpublic

jhenning/dfir-validation-data

DFIR Validation Data Reference data used for Volatility 3 / DFIR tool validation (tool-testing corpus). cridex.vmem Description: Public memory-forensics training sample — a RAM image of a Windows XP SP3 x86 host infected with the Cridex banking trojan. Long-standing Volatility Foundation reference sample. Acquired: 2012-07-22 Size: 536,870,912 bytes SHA-256: 02a63be2fcf3a63446c3c8ca9151aff963f888204d141e46c6be60ddde7c3e8d Original provenance: Volatility… See the full description on the dataset page: https://huggingface.co/datasets/jhenning/dfir-validation-data.

sourceHugging Faceotherupdated 3mo agoView on Hugging Face

0likes107downloads

Dataset Card

DFIR Validation Data

Reference data used for Volatility 3 / DFIR tool validation (tool-testing corpus).

`cridex.vmem`

—Description: Public memory-forensics training sample — a RAM image of a Windows XP SP3 x86 host infected with the Cridex banking trojan. Long-standing Volatility Foundation reference sample.
—Acquired: 2012-07-22
—Size: 536,870,912 bytes
—SHA-256: 02a63be2fcf3a63446c3c8ca9151aff963f888204d141e46c6be60ddde7c3e8d
—Original provenance: Volatility Foundation memory samples (originally files.sempersecurus.org/dumps/cridex_memdump.zip); mirrored here for reproducible validation.

Known ground truth (for accuracy testing)

—windows.info → Windows XP, NtMajorVersion 5 / NtMinorVersion 1, NTBuildLab 2600.xpsp
—windows.psscan → 16 processes incl. explorer.exe (PID 1484) and reader_sl.exe (PID 1640, PPID 1484)

Mirrored by James A. Henning II (Threads) for the monthly DFIR tool validation suite.