Office spawn trees I am willing to live with

This belongs in the first-hour ritual. The load-bearing line: WINWORD → splwow64 is life. Join on PID plus create-time plus image when clocks disagree. If anyone DMs me a zip I will not open it. Hash in-thread.

@paulflex

This belongs in the first-hour ritual. The load-bearing line: WINWORD → splwow64 is life. Join on PID plus create-time plus image when clock

Not fully convinced yet. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I wrote a 12-line script and then threw it away. The listing was enough.

@cryptc

I will argue the opposite and then probably agree. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. Join on PID plus cre

That is a vibe. I asked for a listing offset. I would have written the opposite conclusion a year ago. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. Join on PID plus create-time plus image when clocks disagree. After you did that, did the decompiler pick it up or did you dump? Took me 11 hours the first time.

@zulu

Bookmarking this for the lab wiki. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Join on PID plu

I am reporting the sample-drop hint. Hash and corpus tag only. Please keep the hashes and drop the mystery zips. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. First-seen is first-seen-by-us. Name the column that way. Pinned a comment at 0x140000e30 in the listing.

@pwned

Not fully convinced yet. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. A 10-day baseline is a report. A 10-

You keep moving the goalposts. First it was the decoder, now it is the dump. Did this on ARM64 last week — same shape, different pain. The load-bearing line: WINWORD → splwow64 is life. Lead with image/path/signer, not SHA256. Humans cannot read hashes. I wrote a 12-line script and then threw it away. The listing was enough.

Same wall I hit last quarter. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Same class as the June thread, different binary.

Same wall I hit last quarter. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Same class as the June thread, different binary.

@darknet

I would have written the opposite conclusion a year ago. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. Join

I want the listing, not the decompiler story. The load-bearing line: WINWORD → splwow64 is life. If the dashboard has 40 lines, it has zero lines. I reproduced it on lab build 1225.

@block

Agreed on the class, not on the tool. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. A 10-day baseline is a report. A

Stop flexing an IDA license. The question was the unwind info. Came back to this after a coffee. Still hold. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Store why-the-event-is-here. Empty reason is a collector bug. I wrote a 12-line script and then threw it away. The listing was enough.

I tried the naive path first and wasted a morning. The load-bearing line: WINWORD → splwow64 is life. Key on process GUID, not PID. Reuse will lie to you. I wrote a 12-line script and then threw it away. The listing was enough.

This matches a public n-day class from last patch Tuesday. The load-bearing line: WINWORD → splwow64 is life. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Same class as the June thread, different binary.

Also: Parent to child is the detection. Image name is a label.

@bashirhub

This matches a public n-day class from last patch Tuesday. The load-bearing line: WINWORD → splwow64 is life. A 10-day baseline is a report.

Agreed on the class, not on the tool. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Did you force-create the function or did auto-analysis luck into it? I reproduced it on lab build 1305.

Please keep the hashes and drop the mystery zips. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Key on process GUID, not PID. Reuse will lie to you. My note id for this: a9-27.

I will argue the opposite and then probably agree. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. Join on PID plus create-time plus image when clocks disagree. My note id for this: a9-17.

Did this on ARM64 last week — same shape, different pain. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Did you snapshot before, or is this a restore-from-memory story? Pinned a comment at 0x140004168 in the listing.

@chinedu_m

Same wall I hit last quarter. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. A 10-day baseline is a report.

I failed this exact class in January. The load-bearing line: WINWORD → splwow64 is life. Lead with image/path/signer, not SHA256. Humans cannot read hashes. I reproduced it on lab build 1076.

I failed this exact class in January. The load-bearing line: WINWORD → splwow64 is life. Parent to child is the detection. Image name is a label. I wrote a 12-line script and then threw it away. The listing was enough.

Also: A 10-day baseline is a report. A 10-minute window is a detection. Say which.

I disagree with the tone, not the bytes. The load-bearing line: WINWORD → splwow64 is life. Parent to child is the detection. Image name is a label. Did you snapshot before, or is this a restore-from-memory story? I still have the snapshot named anal-169-pre.

@flexjay

I still keep a paper notebook for this kind of note. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. Parent t

You keep moving the goalposts. First it was the decoder, now it is the dump. Same wall I hit last quarter. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Normalize command lines, then match. Raw matching is a bypass factory. If anyone DMs me a zip I will not open it. Hash in-thread.

@heapz

Came back to this after a coffee. Still hold. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. Rare-on-Tuesday is patch

Bookmarking this for the lab wiki. The load-bearing line: WINWORD → splwow64 is life. Normalize command lines, then match. Raw matching is a bypass factory. If anyone DMs me a zip I will not open it. Hash in-thread.

I still keep a paper notebook for this kind of note. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. Parent to child is the detection. Image name is a label. Version in my shot: current lab snapshot, not last year's blog.

@ibukunjay

Bookmarking this for the lab wiki. The load-bearing line: WINWORD → splwow64 is life. Normalize command lines, then match. Raw matching is a

This is getting personal and it does not need to. Not fully convinced yet. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. Key on process GUID, not PID. Reuse will lie to you. I still have the snapshot named anal-169-pre.

Came back to this after a coffee. Still hold. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. Rare-on-Tuesday is patch Tuesday. Exclude the window. I will +rep a listing and −rep a vibe. That is the deal.

@lock

This is the writeup I wanted when I was stuck. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. First-seen is

I am reporting the sample-drop hint. Hash and corpus tag only. I reproduced it twice before I believed you. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. I wrote a 12-line script and then threw it away. The listing was enough.

I tried the naive path first and wasted a morning. The load-bearing line: WINWORD → splwow64 is life. First-seen is first-seen-by-us. Name the column that way. Is the hang the incomplete patch, or a second bug? Pinned a comment at 0x140002e58 in the listing.

@kennyblaze

Please keep the hashes and drop the mystery zips. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life.

Came back to this after a coffee. Still hold. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Key on process GUID, not PID. Reuse will lie to you. After you did that, did the decompiler pick it up or did you dump? If anyone DMs me a zip I will not open it. Hash in-thread.

@secmod

I disagree with the tone, not the bytes. The load-bearing line: WINWORD → splwow64 is life. Parent to child is the detection. Image name is

I tried the naive path first and wasted a morning. The load-bearing line: WINWORD → splwow64 is life. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Same class as the January thread, different binary.

This is the writeup I wanted when I was stuck. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. First-seen is first-seen-by-us. Name the column that way. I still have the snapshot named anal-169-pre.

@michaelson

I reproduced it twice before I believed you. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. Normalize command lines, t

I ran this on a licensed corpus binary. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. First-seen is first-seen-by-us. Name the column that way. Same class as the March thread, different binary.

I disagree with the tone, not the bytes. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Lead with image/path/signer, not SHA256. Humans cannot read hashes. Took me 10 hours the first time.

@stagx

I disagree with the tone, not the bytes. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Lead with

This is getting personal and it does not need to. Same wall I hit last quarter. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. Key on process GUID, not PID. Reuse will lie to you. I still have the snapshot named anal-169-pre.

@threxz

Same wall I hit last quarter. On «Office spawn trees I am willing to live with»: WINWORD → splwow64 is life. Key on process GUID, not PID. R

I failed this exact class in January. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. First-seen is first-seen-by-us. Name the column that way. I wrote a 12-line script and then threw it away. The listing was enough.

Did this on ARM64 last week — same shape, different pain. You wrote «WINWORD → splwow64 is life». That is the sentence I keep. First-seen is first-seen-by-us. Name the column that way. What did you key the join on — PID or process GUID? I will +rep a listing and −rep a vibe. That is the deal.

Bookmarking this for the lab wiki. «Office spawn trees I am willing to live with» — specifically WINWORD → splwow64 is life. Join on PID plus create-time plus image when clocks disagree. Took me 10 hours the first time.