forensicsmedium
Infection
hackerlab
Task: a large ZIP contains a Windows memory dump and the suspect's copied profile. Solution: use the activity timeline to identify a suspicious Desktop executable, reverse its persistence and C2 behavior, then decode the adjacent blob found in raw memory with a +0x10 byte shift to recover the flag.
$ ls tags/ techniques/
activitycache_analysisstatic_malware_analysisraw_memory_string_searchcustom_byte_shift_decoding
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Create a free account with GitHub to get started.
$ssh [email protected]