Beyond good ol’ Run key, Part 133 March 5, 2021 in Anti-Forensics, Autostart (... 2021-03-06 08:18:20 | 阅读: 261 | 收藏 | www.hexacorn.com software javasoft launch4j development malicious

Event ID 7039 – out…pid a pid February 26, 2021 in Compromise Detection, S... 2021-02-27 04:18:16 | 阅读: 211 | 收藏 | www.hexacorn.com sysmon scm processes badly liberty

Beyond good ol’ Run key, Part 132 February 24, 2021 in Anti-Forensics, Autosta... 2021-02-25 08:19:41 | 阅读: 215 | 收藏 | www.hexacorn.com specifies loaded autostart poor documenting

DownLOLoloaders DownLOLoloadersFebruary 19, 2021 in Anti-For... 2021-02-19 09:00:17 | 阅读: 209 | 收藏 | www.hexacorn.com attractive download retrieved combing handy

Yet another secret of hosts file February 18, 2021 in Anti-*, Anti-Forensics,... 2021-02-19 08:41:52 | 阅读: 242 | 收藏 | www.hexacorn.com windows unicode16 dnsrslvr hostss

Misre-presentation host February 8, 2021 in Living off the land, LOL... 2021-02-09 08:34:12 | 阅读: 221 | 收藏 | www.hexacorn.com iexplore clickonce

Beyond good ol’ Run key, Part 131 February 6, 2021 in Anti-Forensics, Autostar... 2021-02-07 06:44:08 | 阅读: 251 | 收藏 | www.hexacorn.com microsoft software editorhklm mhtml editorhkcu

Desperate downloader lolbin February 5, 2021 in LOLBins... 2021-02-06 08:41:33 | 阅读: 263 | 收藏 | www.hexacorn.com msoxmled verb inetcache proxy download

Mitre Domin&trix Mitre Domin&trixFebruary 3, 2021 in Mitre At... 2021-02-04 07:56:07 | 阅读: 341 | 收藏 | www.hexacorn.com domin trix forth utopian promoted

Recoll – a perfect tool for Threat Intelligence Analysts and other Report Readers February 1, 2021 in Productivity... 2021-02-02 04:10:08 | 阅读: 235 | 收藏 | www.hexacorn.com caught docfetcher searchable hoarder tones

aMus(ing)Notification January 3, 2021 in Archaeology, LOLBins, Und... 2021-01-04 08:31:56 | 阅读: 252 | 收藏 | www.hexacorn.com dialog invocations toast

handle..ing SHAllocShared December 25, 2020 in Code Injection... 2020-12-26 08:53:14 | 阅读: 276 | 收藏 | www.hexacorn.com memory shlwapi relies

Beyond Fear Beyond FearDecember 22, 2020 in Preaching... 2020-12-22 09:50:25 | 阅读: 273 | 收藏 | www.hexacorn.com fear programmers genius

Propagate, Ribbonate December 22, 2020 in Anti-Forensics, Code In... 2020-12-22 09:09:18 | 阅读: 298 | 收藏 | www.hexacorn.com hwnd windows analysis injection

FaaS for noobs This is the first version of this article. Due to nuances, and things I forgot while wri... 2020-12-06 09:53:07 | 阅读: 283 | 收藏 | www.hexacorn.com faas ec2 python regions spot

csrss.exe and its manifests This is yet another odd behavior I spotted using Procmon. I was curious what .manifest f... 2020-12-06 08:23:39 | 阅读: 282 | 收藏 | www.hexacorn.com windows microsoft manifestc mui syswow64

TestHooks, take 2 December 2, 2020 in Archaeology... 2020-12-03 08:20:43 | 阅读: 354 | 收藏 | www.hexacorn.com windows microsoft software testhook 0gtweet

Re-sauce, Part 3 I like extracting data from many samples because this way I often discover new things. C... 2020-11-28 07:36:56 | 阅读: 332 | 收藏 | www.hexacorn.com microsoft msdn urn library

Updated appid_calc.pl & dexray.pl November 26, 2020 in appid_calc.pl, DeXRAY,... 2020-11-27 07:56:24 | 阅读: 347 | 收藏 | www.hexacorn.com appid dexray download stuart pinged

Commander Minority Report November 21, 2020 in Random ideas... 2020-11-21 09:55:24 | 阅读: 339 | 收藏 | www.hexacorn.com emerged spoofing intricacies sysmon 4688