88 88
88 88
88 88
8b d8 8b, ,d8 88 88 8b,dPPYba, ,adPPYb,88 ,adPPYba, 8b,dPPYba, ,adPPYb,d8 8b,dPPYba, ,adPPYba, 88 88 8b,dPPYba, ,adPPYb,88
`8b d8' `Y8, ,8P' aaaaaaaa 88 88 88P' `"8a a8" `Y88 a8P_____88 88P' "Y8 a8" `Y88 88P' "Y8 a8" "8a 88 88 88P' `"8a a8" `Y88
`8b d8' )888( """""""" 88 88 88 88 8b 88 8PP""""""" 88 8b 88 88 8b d8 88 88 88 88 8b 88
`8b,d8' ,d8" "8b, "8a, ,a88 88 88 "8a, ,d88 "8b, ,aa 88 "8a, ,d88 88 "8a, ,a8" "8a, ,a88 88 88 "8a, ,d88
"8" 8P' `Y8 `"YbbdP'Y8 88 88 `"8bbdP"Y8 `"Ybbd8"' 88 `"YbbdP"Y8 88 `"YbbdP"' `"YbbdP'Y8 88 88 `"8bbdP"Y8
aa, ,88
"Y8bbdP"
..........................'''''''''',,,,,,,,,;;;;;;;;;;;;;;::::::::::::cccccccccccccccccccllcclcccclllllccccccccccccccccccccccccccccccccccccccccccccccccccc:cccc:::::c:::::;;;;;;;;;;;;;,,,,,,,,,,,,''''
......................'..'''...''''',,,,,,,;;;;;;;;;;;;;;;;:::::::::::ccccccccccccccccllccccccllllllllllcccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc::::::;;;;;;;;;;;;;,,,,,,,,,,,''
......................''''''''''''',,,;,,;;;;;;;;:::::;;;::::::::::::cccccccccccccccccclcccllllllllllllllcccccllcccccccclclllllccccccccccllcclccccccccccccccccccccccccccc:::::::::::;;;;;;;;;;;,,,,,,,,'
........................'''''''''',,,,;;;;;;;;;;;::::::::::::::::::::ccccccccccclllllcclllllclllllllllllllllllllcccccclllllllllllcccccllcllcclcccccccccccccccccccccccccccccc:::::::::;;;;;;;;;;,,,,,,,,'
.........................''''''''',,,;;;;;;;;;;;::::;::::::c:::::::cccllcccllllllcclllllcllllllllllllllllllllllllllllllllllllllccccccccllllllllllcccccccccccccccccccccccccccc::::::::;;;;;;;;;;;;;,,,,,,
......................''''''''''',,,;;;;;;;;::::::::::::::cccc:ccccccccclccllllllllllllllcllllllllllllollllllllllllllllllllllllccccccclllllllllllllcccccccccclcccccccccccccccc::::::::::::;;;;;;;;;;,,,,
....................'''''''''',,,,,,;;;;;;;:;;:::::::::::cccccccccccccclccclllllllllllllllllcllllllloollllllllllllllllllllllllllllllllllllllllllllllllllllcclllccclllcclllcccccc::::::::::::;;;;;;;;;;,,
...................''''''''',,,,,,,;;;;;;;;;;;:::::::c:::::ccccccccccclllllllllllllllllllllllllllllllllllllllllllllollllllllllllllllllllllllllllllclllllccccllllccclllllcccllcccc::::::::::::::::;;;;;;;
................'''''''''''''',,,,;;;;;;;;;;;::::::ccc:::::cccccclccclllllllllllllllllllllllllllllllllllllllllllllllllllllollloolllllllllllllllllllllllllccclllllcclllllccccccccccccc::::::::::::;;;;;;;
..............'''''''''''''''',,,,;;;;;:;:::::::::::::::::ccccccclcccllcllllllllllllllllloollllllllllllooooolllllooloollllllllollllllooolllllllllllllllllllllllllcclccccccllcccccccccccc:::::::::::;;;;;
.............'''''''',,,,'',,,,,,,;;;;:::::::::::::::::::cccccccclllcccclllllllllllllllllllllllllloooooooooollllloooooolllllloooolllllooooollllllllllllllllllllllcclcccccccccccccccccccccc::::::::::;;;;
............'''''',,,,,,'',,,,,,,;;;;;;::::::::::::::::::::ccccccclllclllllllllllllloolllllllll::;;;,,,,,,,,,,;;;;:::::ccccllloooollllllloolllllllllllllllllllllllllllllcccccclccccccccccc::::::::::::;;
............''''',,,,,,,,,,,,,,,,;;;;;;;:::::::::::::::cccccccccccllllllllllllllllllllllllllc;'..........................'',,;;::cccllllloollllllllllllllllllllllllllllllccclllcccccccccccccc::::::::::;
............'''''',,,,,,,,,;;,,,;;;;;;;;::::::::::::::::::cccccccccclllllllllllllllllllllllc'. ...................''',;;;;;;:cccllllcccclllllllllllllllollllllllcccclllllccccccccccccccccc::::::
.............'''''',,,,,,,,,,,,,;;;;;;::::;;;;:::::::::ccccccccccccccccccccllllllllllllllll; .........','',;;::ccllcccccllllllllllllllloollllllcllcccllllllcccccccccc:ccccc:::::
...........''''''''''',,,,,,,,,,;;;;;;:::;;;;;;::::::::::ccccccccccccccccclllllllllllllllll:. . ..........................',,;:cloddddoolllllllllooollllllclllccllllllllccccccccccccc::::::
...........''''''''''''',,,,,,,,,,;;;;;;;;;;;;:::::::::::cccccccccccccccccclllllllllllllllll:. ........................',,,,;;,'.....',;clodxxdddooolllllllllllllcllcllllllllccccccccccccc::::::
...........''''..'''',,,'',,,,,,,,;;;;;;;;;;;;:::::::::::::cccc::::ccccccccllclllccccclllllll:. .....................',,,,,;;::ccccccc:;,''''',;:cclloddooollc::clccllllllllllllcccccccccccc::::::
..........'.......''',,,,,,,,,,,,,,,;;;;;;;;;;;;;;:::::::;:::::::::cccccccccccclllcccccclllllc' ......................'',;;;;;:cccllllloooolc:;;;,,,''',;:looddl;;:::cclllccccllllccccccc:cccc:::::
.........''.....'''''',,,,,,,,,,,,,,,,,;;;;;;;;;;;;;;;::;;::::::::::::cccccccccclcccccccclllll;. ......................''',,;:::ccccllooooooodddoolcc::;;,'.',:odl:;;;;;::ccccllccllcccclcccccccc::::
..........'........'''',,,''''',,,,,,,,,;;,;;;;;;;;;;;;::;:::;::::::::::c:ccccccccccccccccllcl:. .................''''',,;;::clllllooodddddddddddollccccc:;'',::,'.'''',;;;:clllcllcccccllccccccc:::
...................'''''''''''''''''',,',,,,,,,,,,,,;;;;;;;;;;;;;::::::::::cccccccccccccccllccc. ................'',,,;;;::cloloddddxxxkkkkkxxddoollccclll:;,,'........''',;:cllllcccccccccccccc:::
.....................'''''''''''''''''''''',,,,,,,,,,,;;,,;;;;;;;;::::::::ccccccccccccccccccclc. ................''',,;;::cclloodxxkkkkOOOOkkkxddooolclllll:;'.............'';clllllcccccccccccc:::
.............'''......''.............''''''''',,,,,,,,,,,,,,,,;;;;;;;;;;::::cccccccccccccccccc:. ......'',,''''''''',,,;::ccllooddxxkkOOOkkkkkxxxddoooooodo:,.................;llllllccccccccccc:::
,:;'''....':looooolc;;,'...............'''''.'''''''''',,,,,,,,,;;;;;;;;;::::c::::::cccccccccc,. ......''''''''...'',,;;:ccloodddxxkkkkkkkkkkxxxxxxxxxxxxdl,'................':llcllllcclcllccccccc
col,,:'. ;dkdl:cdxdodkxlclc;,'..................''''''''''''',',,,,,,,;;;;;:::::::::::::cccc:'.. .........'..''...'''',,;:clldxkkkkO000000OOOkkxxxxxxxxkkkd:'.........'.....';clllllllllllllllcccccc
ldd:.;:.. :xocodxkkodkxdkKK0Ol.............................''.........''''',,,,;;;;;;;::::::;........................'''',;;:clodxOOOO00KKKXXKKKKK0Okkxxxxxkxl,...........'..',:llllllllolllllllccccccc
;ldl.':,. ;dlcdxdodllkOko:;;;'............................... ..........''''........................''',,;:clodxkOOOO0KKXXXXXXXXXXXK00Oxdooo:,'''..'.....'',:cllllllllloolllcllccccccc
.,llc,',..;ooclddllo;.','..................................... .........''''''''......'.''',,;cldxkO0000KKXXXXNNXXXXXXKK0kdoollc:,'.''.....',:lllllllllllllllccclccccccc
.:lo:.::,clcoxl;'............................................. .......''',,,,,'''',,;:cloodxkO0KKXXXXXXXKKKK0xoooollo:..''..'.',cloollllllllloollccccccccccc
.;llc',cc:ldc;'................................................... ......'',,;;;::;;;:ccloodxkO0000K0Oxddooclo:.....'..,cllooollllollllolllcclccccccc
' .:loc.,oc;,.......................................................... .....',,;:::cc::::ccclodooooolldl'....''',:llllloolllllllloollllcccccccc
;..cdo:.':'................................................................. ....',;:cccc:::;;;,;ll,....'',,;clllolllllllllllooolcccccccccc
' .:dkd,.c:........................................................................ ...,;;:cccc::,'''.'',,:lllollllllllllllloollcclcccccc
;..,oxxl,;:.............................................................................. ........... ...',,;;;;;;;:cllllllllllllllllllllllcclccccc
;'..;col;'.............................................................................. .....',,,,,''''.... ...',;:coooolllllllllllllloolcccccccc
....,coc'.............................................................................. ..... .........';:clllccccc,'c:. ...';;:cllllllllllcllllccccccc
....,coo;............................................................................. .... ..:;',;clllooddxxdc;:;;. .... ...';:clllcclllccccccc
....':odc......................................... ...................................''.. .... .;olokkkxdxxkkkOd:ldc,. .. ......... ...,;:cllllccccc
.....,cdd;........................................ .............................':::;'',,'.. ... 'dxdOkkkkOOOOOOOdlc;...'...''...... ... .. ..,;cccccc
......:ldl'... . ............................... .. ........................';;lxxd::cooc'. .'. .,odoxkkO000000K0Oxc...,'..,,''''........ ...... ..,:cc
......,cod:. . ... ............................ ....................':ccc;;:lxxxxkOkd;. ... .,cllxk0KKKKKKKKKOd'..,;. ';;,,,,,...''. ..''...... ,cc
.......;ldo'.. ... .................. ...... .................';;cdxxocloddoodddxdl'. .... ..';;:cdk0KKKKKKKK0x,..;;,..,:;;;,,'.',,,...',,'.....'''....... ..':cc
.. ..,codc. . ... . ...... ............;cllc;,;looooooollccccccc:'. .............'',;coxO00KKKKXKk,..;;;' .;;;;;,'..,;;...',;;,'''.,lollollccc::;;;,,,'''',,,,,,,,,;:ccc:c
. .';ldo,. .. . . ... ........';:::lddollllcccccccc:::;;;;;;;'.. ............';codxkO0KKKKk;..,;;;..';;;;;,..,;;'..',;;;,,'',clllllolllllllllclcccccclllllcccccccccc
..,coxc. .. ....... .... ........ .....,colc,';cllcccc:::::::cc:::;,,'''',,'..............';:cldxkO00KKk;..,,;:;..,;;,,,..,,;,'.'',;;,,,,,cllllllllllllllllllcccccccllcccccccccccc
..;ldo,. .......... . ....,;;;:lolcclocc:::;;;;:::::::::;;;,,'''',,;;;;,,,,,;,,;:cllodxkkO0KO;..,,',;,',;;,,,..,,;;,''',,;,,,,;:llllllllolllllllclllcccccccccccccccccccc
..,codl. ...... ...,;::;,,;cllc::::;;;;;;;;::::::::::::;;;;,,,,,;;;;;;;;::cccllodddxkO00O:..,;,.',,,;;,,,'.,,,,,,,,,,,;,,,,:lllllcllllllollllclcccccccccccccccccccccc
..;ldd;. .... ...',;;;:cccloolc:;;;,,,,,,;;;;;::::::::::::;;;;;;,,,,,,,;;::cccoodxxxxO00Oc..';;'..',;,,,,..',,,,,,,,,,,,,,,;clllllllllllllllllllcccccccccccccccccccccc
.':oxl. . . ... . ..,::;,',;::::::;;,,,'',,,,,;;;:::::::::cc::::::::;;;;;,,,;;;;;;:ccodxxxkO00l..';;,'..',,,','..,,,'''''''...,,,:llccllllllllloooolllcccccccc:ccc:ccc::cccc
.,cdx:. .. ..',,,;::::::;;,,,,'''''',,;;;:::cc;,;ccccc;,;cc:cc;;::::::ccc:::::cldxxkkO0K0o..';;,'..'',,'''..'','..'''......';clllllllllllllooooolllllccccc:cccccc:::::::
.':lxo. . ....''',;;;;,,,,''',;;;;;;::;;:;:ccc:,';:ccc:,',:ccc:,';clllol::cldxkOkk00KKKKOc..',,;,'..'','''..',,''','.. .....;cllllllllllllllloollllcccccc::cccc::::::::
..,cdd:. ...'''...','''',,,;;;::::c::c::;;:::ccllllllooooooooddoooolccccc::cclxOKxlk00KKOo,..',,,,''..'''''..',,'',,'. .....:lllllllllllllllllllllcccccc::ccccc:::::::
.':oxo' .',''''..'',,;:c::cccccc;,::;cc:::::::::;,,,,,,,,,,;:cllooodxxxxxxxddddddoclx0KKo..',,,,,,,'...''...'''',,,'..... ...:llcclclllllclllllllllccc:ccc:::::::::::::
..,cdxc. . ....'..',,;:llol;;ll:::;;,,,,'''..... ......',,;;:clloolcc:::;;...'...''''........''',,,,'''....... ...;clccclllllllccclcccccccccccccc::::::::::::
..;lxo' ......',:c;,:::ccc:;,,''...... ..... .......... ............ ..................'',,,''',,,'''.......;llllllllllccccccclcclcccccccc:cc:::::;;::::
.,codc. ......',;clc,,::;,,'..... ......................... ..........'..''....',,''''''''':lllllcccclllcclllllclllccccc::::::::::::::::
..;ldd, ........',,:;;,'........ ................................ ........',,''',,,,,,,,;;,,,;::ccllcccllolllllllccclllcccc::::::::::::::;
.,codc. ..'.......''''..... ........................................ .. ... .......'''',,,,,,,,;;;;;;;;:::ccllllllllllllcccllllcccc::ccc:::::::::
..;lod; .'',,............ ................................'',,'. .. . .................''',,,;;:cclccllcccllllllllllccc::::::cc:::;;::
.':ldl. .';'','........ .... .........................'''',,,'... .... ... ...... . ..........',;:ccllcccccccllcllcccc:::::::::::::::
..;cdd;. ..';,..... ........................'''''',,,,,,,' ................. .......',:ccccccccccccccccc:::::::::::::;;;
.':ldl. ..... ....................'''''''''',,,,,,,,. .. ... .....................................',;ccccccccccccccc::::::::::::;;;;
..;cod:. ...................''''''',,,,,,'''.. ... ..........'....',,''''.'''''...........,;ccccc:::cccc:::::::;;;;;;;;;;
.':ldo' . ....................''........ . ......... ..............';;,,,,',,,,,,,,,''''''''';:ccc:::::cc::::::;;;;;;;;;;;
.;codc. ....................... .. ........................',,,,'.........'......''''''';::::::::::::::::;;;;;;;;;;;
.';cdo' ............... ... .....................''...................''''''...',,;:::::::::::;;;;;;;;;;;
.':ldc. ..... .. ........''''''''''''''''',,,,,,,'''''''''..'''''.''',,;;:::::;;;;;;;;;;;;
..;coo' .... ... ............'''''''''''''''',,,,''''''''''.'''''',,;;:;;;;;;;;;;;,
.':loc. . ..'. ... ................'',,,,,,,'''''''''''''''''.''',,,;;;;;;;;;,
..,clo, ............ .''..... ....... ...........................'',,,,,,,,,,,,''''''''''''''''''''''',,,,;;;,,,
.';coc. ................ ..'.. .....................'..........''''..'''''',,,,,,,,,,,,''''''''''',,,'''''''''''''''',,,,,,
..':ll,. ................ ...,'. .................'''''''''''''''''''''',,,,,,,,,,,,''''''''''',,,,,,,,,''''''''''''''''''
..,clc. ......................... ..............'''''''''',,,',,,,,,,,,,;;;;;,,,,'''''..''',,,,,,,,,,,,,,,''''''''''''''
.';cl,. ..................... .. ................'''''''',,,,,,,,,,,,,,,,,,,,,''''...',,,;;,,,,,,,,,,,,,,,,,,'''''''''
..':lc. ........................ ..................''''',,,,,,,,,,,,,,,,,,,'''....',,;;,,,,,,,;;,,,,,,,,,,,,,,,''''''
..;cl;. .......................... ................'''',,,,,,,,,,,,,,,,,''.....'',;;,,,,''',,,,,,,,,,,,,,,,,,,,'''''
.';lc. .......................... .. ................'''',,,,,,,,,,,,,,,'''....',,,,,,,,'''''',,,,,,,,,,,,,,,,,,,,,''.
..,cl;. ............................ .. ................'',,,,,,,,,,,,,,,,''......',,;;,,''''..''''',,,,,,,,,,,,,,,,,,'''.
.';cc. ............................. ........ ...........''',,,,,,,,,,,,,,,'......'',,,,,,''''....''''',''',''',,,'',,,'''..
.,:c;. ................................. ........ ............'''''''''''',''''.....''',,,,,,,''......'''''''''''''','''''''''..
..;cc' ........................................... ............''''''''','',,''....''',,,,,,,,''.......'''''''''''''''''''''.....
.';c;. .................................................. .......'''''',''''''....'',,,,,,,,,''.........'..''''''''.'''''''......
..,::' ................................................... .........''''''''''.....'',,,,,,,,''..................'''...''''.......
.';:;. ..............................................................'''''''''....'',,,,,,,,''..........................''........
..';:' .......................................... ....................''''''''''''',,,,,,,,,'.....................................
..,:;. ...............................................................''',,'''''',,,,,,,,,,''.................................. ..
..';:' .......................................... ......................''',''''''',,'''',,,''.....................................
VirusSign Collection/2026.01/Virussign.2026.01.20.7z
VirusSign Collection/2026.01/Virussign.2026.01.22.7z
VirusSign Collection/2026.01/Virussign.2026.01.18.7z
VirusSign Collection/2026.01/Virussign.2026.01.21.7z
InTheWild Collection/Release File Listings/InTheWild.0290.7z.txt
InTheWild Collection/Release File Listings/InTheWild.0289.7z.txt
VirusSign Collection/2026.01/Virussign.2026.01.19.7z
InTheWild Collection/Downloadable Releases/InTheWild.0290.7z
VirusSign Collection/2026.01/Virussign.2026.01.23.7z
VirusSign Collection/2026.01/Virussign.2026.01.24.7z
VirusSign Collection/2026.01/Virussign.2026.01.25.7z
VirusSign Collection/2026.01/Virussign.2026.01.26.7z
VirusSign Collection/2026.01/Virussign.2026.01.27.7z
VirusSign Collection/2026.01/Virussign.2026.01.30.7z
VirusSign Collection/2026.01/Virussign.2026.01.28.7z
VirusSign Collection/2026.01/Virussign.2026.01.29.7z
VirusSign Collection/2026.02/Virussign.2026.02.01.7z
VirusSign Collection/2026.02/Virussign.2026.02.02.7z
VirusSign Collection/2026.01/Virussign.2026.01.31.7z
VirusSign Collection/2026.02/Virussign.2026.02.06.7z
VirusSign Collection/2026.02/Virussign.2026.02.03.7z
VirusSign Collection/2026.02/Virussign.2026.02.04.7z
VirusSign Collection/2026.02/Virussign.2026.02.05.7z
VirusSign Collection/2026.02/Virussign.2026.02.07.7z
InTheWild Collection/Downloadable Releases/InTheWild.0289.7z
VirusSign Collection/2026.02/Virussign.2026.02.11.7z
VirusSign Collection/2026.02/Virussign.2026.02.13.7z
VirusSign Collection/2026.02/Virussign.2026.02.08.7z
VirusSign Collection/2026.02/Virussign.2026.02.09.7z
VirusSign Collection/2026.02/Virussign.2026.02.14.7z
VirusSign Collection/2026.02/Virussign.2026.02.10.7z
VirusSign Collection/2026.02/Virussign.2026.02.12.7z
Windows/Evasion/2026-02-08 - The Service Run Failed Successfully.pdf
Windows/Internals and Analysis/2020-04-30 - The Birth of a Process Part-2.pdf
Windows/Networking/2021-09-01 - From RpcView to PetitPotam.pdf
Windows/Initial Access/2026-02-12 - Trust Me Im a Shortcut.7z
Other/2026-02-02 - How the KGB Discovered Computer Viruses.pdf
Making an EDR/05 - Windows Driver IRQL and acquiring a Driver Mutex.pdf
Making an EDR/02 - Configuring a Rust Windows driver.pdf
Making an EDR/03 - Building the Driver Object.pdf
Making an EDR/01 - Creating a Windows Driver in Rust.pdf
Making an EDR/07 - Theory EDR Syscall hooking and Ghost Hunting my approach to detection.pdf
Making an EDR/04 - Error logging.pdf
Making an EDR/11 - Hooking VirtualAllocEx.pdf
Making an EDR/12 - Mitigating broadcast spoofs with Ghost Hunting.pdf
Making an EDR/09 - Communicating from the hooked syscall.pdf
Making an EDR/10 - Ghost hunting OpenProcess.pdf
Making an EDR/13 - Creating a Protected Process Light in Rust for Sanctum EDR.pdf
Making an EDR/14 - Reading Event Tracing for Windows Threat Intelligence.pdf
Making an EDR/15 - Improving the Ghost Hunting implementation for flexibility and speed.pdf
Making an EDR/20 - Making improvements to the EDR DLL injection.pdf
Making an EDR/16 - Monitoring NTDLL for in memory patching.pdf
Making an EDR/08 - Implementing syscall hooks in Rust.pdf
Making an EDR/19 - Real-time Ransomware Detection Strategy.pdf
Making an EDR/23 - Improving consistency with EDR DLL Injection via APCs.pdf
Making an EDR/25 - Starting point for simple ransomware detection.pdf
Making an EDR/24 - Detecting Vectored Exception Handling Squared in an EDR.pdf
Windows/Kernel Mode/2026-02-14 - STProcessMonitor BYOVD.zip
Making an EDR/00 - Intro and plan for the Sanctum EDR.pdf
Windows/System Components and Abuse/2026-02-12 - Bypassing Administrator Protection by Abusing UI Access.pdf
Making an EDR/22 - Alt Syscalls for Windows 11.pdf
Windows/Evasion/2026-02-06 - PhantomFS.zip
Making an EDR/21 - Strategy for Early Bird APC Queue Injection and improving Ghost Hunting.pdf
Making an EDR/17 - Reverse engineering undocumented Windows Kernel features to work with the EDR.pdf
Making an EDR/18 - Full spectrum Event Tracing for Windows detection in the kernel against rootkits.pdf
Making an EDR/06 - wdk-mutex An idiomatic mutex for Rust Windows Kernel Drivers.pdf
Windows/Process Injection/2026-02-17 - Process Preluding Child Process Injection Before The Story Begins.pdf
Windows/Evasion/2025-10-29 - Escaping Loader Locks with PostProcessInitRoutine.pdf