// industry vertical
retail / POS / loss prevention
POS terminal forensics, EMV trace analysis, refund-fraud pattern detection, RAM-scraper malware family ID.
start here · primary tools
ordered. work top-down. the first tool is the suggested entry point for this vertical.
- process memory string extractordrop raw memory dump or strings text · streaming ascii utf-16le extraction · urls ips credentials c2 iocs · csv export · runs locally
- memory string timeline reconstructordrop multiple timestamped string extractions or timeline csv · new removed persistent strings · ioc temporal tracking · runs locally
- credential artifact scannerdrop a memory dump · scan for plaintext credentials · NTLM hashes · OAuth tokens · API keys · session cookies · Base64 secrets · export CSV · runs locally
- pe analyzerdrop a Windows executable · parse PE headers · sections · imports · exports · entropy per section · detect packers · imphash · runs locally
- ransomware family identifierdrop encrypted file samples · ransom notes · iocs · fingerprint against 200+ families · output family name · known decryptors · nomoransom hints · extension patterns · c2 patterns · runs locally
- case report generatorfill in case number · examiner · dates · findings · drop evidence files for auto hash · generates structured forensic report PDF · runs locally
also useful · secondary tools
cross-cutting tools that surface depending on the specific investigation.
- string ioc correlatorpaste string output or drop binary · match against 300+ known malware family signatures · C2 patterns · mutex names · registry keys · user-agents · export matches · runs locally
- yara scannerwrite YARA-like rules · scan any file locally · string and byte pattern matching · condition logic · export match report · runs locally
- evidence manifest generatordrop evidence files · compute md5 sha1 sha256 · chain of custody manifest · case number · analyst · export pdf and csv · runs locally
want deeper retail coverage?
this vertical is intentionally sparse — deep-moat coverage grows over time. tracked in the forensics rollout.