The world of partially downloaded files… Anytime you download a file via a browser, instant messenger, or other apps… it is first sa... 2023-11-23 07:23:3 | 阅读: 10 | 收藏 | Hexacorn - www.hexacorn.com download microsoft instant messenger brave

Lolbins for connoisseurs… Part 3 I love exploring unexplored software paths. And not necessarily on the assembly level – and that... 2023-11-16 06:52:24 | 阅读: 10 | 收藏 | Hexacorn - www.hexacorn.com software portablegit depthai mingw64

Who am I? Asking for my file friend: whoami.exe… There is a lot talk about whoami.exe recently, so here’s one more post about it…When we talk... 2023-11-12 07:28:40 | 阅读: 21 | 收藏 | Hexacorn - www.hexacorn.com whoami windows winsxs microsoft

Email domains AD 2023 Back in a day (90s/2000s), if you wanted an email, there were lots of (free) email providers ava... 2023-11-4 07:21:29 | 阅读: 58 | 收藏 | Hexacorn - www.hexacorn.com yahoo hotmail rr nl jp

Beyond the good ol’ .bashrc entry… Part 3 UpdateAfter I posted it, @netspooky pinged me with some additional info. Apparently, th... 2023-10-29 05:15:23 | 阅读: 18 | 收藏 | Hexacorn - www.hexacorn.com stephan apparently oriented autostart nodisplay

Beyond the good ol’ .bashrc entry… Part 2 Okay, okay, yup, it is a series now. Part two is here!Browsing available Ubuntu apps on... 2023-10-28 06:21:47 | 阅读: 16 | 收藏 | Hexacorn - www.hexacorn.com chm kchmviewer okay yup horrible

Hunting for Windows API prototypes and descriptions… Over the years I have made a lot of attempts to systematically extract Windows API information f... 2023-10-26 07:49:37 | 阅读: 25 | 收藏 | Hexacorn - www.hexacorn.com windows microsoft par kinda createfile

Mapping Chrome extension IDs to their names, Part 2 Nearly 2 years ago I published the first part, so it’s time for a quick update. And thi... 2023-10-21 06:19:51 | 阅读: 15 | 收藏 | Hexacorn - www.hexacorn.com publishing

What Champagne to drink? Reading articles about criminals enjoying (I really hope they are not just flexing) drinking the... 2023-10-18 06:49:54 | 阅读: 15 | 收藏 | Hexacorn - www.hexacorn.com champagne pérignon vintage drinking favorite

Dexray v2.33 Even in 2023 Dexray seems to be delivering value to DFIR practitioners. I am always very hu... 2023-10-14 06:43:54 | 阅读: 10 | 收藏 | Hexacorn - www.hexacorn.com dexray quarantined humbled perl security

Beyond the good ol’ .bashrc entry… Part 1 I really don’t know if this is the first post in the series, or just a one-off that is also, the... 2023-9-30 07:18:54 | 阅读: 14 | 收藏 | Hexacorn - www.hexacorn.com dconf windows footprint cousin

ZydisInfo – the disassembler that breaks the code, twice The moment I heard of machine code and its opcodes… I fell in love. Being able to understand mac... 2023-9-28 06:38:17 | 阅读: 22 | 收藏 | Hexacorn - www.hexacorn.com opcodes zydisinfo machine joel surprise

The hidden side of 24/7/365 – The dreadful APAC shift It’s easy to say ‘we follow the Sun’ or ‘we deliver that 24/7/365 service’. The story doesn’t en... 2023-9-24 06:58:16 | 阅读: 18 | 收藏 | Hexacorn - www.hexacorn.com apac night emea regional norm

Using OSINT skills for your own protection… This is probably the most unusual blog post I have ever written here… Oh, well…—TL;DR; M... 2023-9-23 06:48:48 | 阅读: 17 | 收藏 | Hexacorn - www.hexacorn.com hotel booking bypass booked refund

Documenting the undocumented – Excel’s SaveAs method… A few days ago kernelv0id asked about an undocumented Excel format that he observed being u... 2023-9-22 06:37:46 | 阅读: 14 | 收藏 | Hexacorn - www.hexacorn.com saveas malicious fileformat surprise

Analysing NSRL data set for fun and because… curious, Part 3 Nearly two years ago I published a quick summary of my analysis of NSRL data. I believe I was th... 2023-9-17 06:11:55 | 阅读: 16 | 收藏 | Hexacorn - www.hexacorn.com dwarf nsrl crc32 rds file2

Lolbins for connoisseurs… Part 2 It may sound a bit counterintuitive, but some very known lolbins often make it to places th... 2023-9-9 08:9:28 | 阅读: 15 | 收藏 | Hexacorn - www.hexacorn.com instmsiw ffmpeg instmsia jre runxx

The secret of 961c151d2e87f2686a955a9be24d316f1362bf21 A recently came across a sample that included the following, mysterious string:961c151d... 2023-9-4 02:0:4 | 阅读: 32 | 收藏 | Hexacorn - www.hexacorn.com digit hashed lessons niels revealing

Writing better Yara rules in 2023… In my previous post I mused about an impossible task – how to consolidate a large, unorganized y... 2023-8-26 08:15:33 | 阅读: 19 | 收藏 | Hexacorn - www.hexacorn.com imports mz windows 0x3c mscoree

Lolbins for connoisseurs… We are all quite fixated on a purity of lolbins. Best if it is a hidden/undocumented/unexpe... 2023-8-26 07:5:18 | 阅读: 11 | 收藏 | Hexacorn - www.hexacorn.com 7z 7za updater aunsoft software