Week 26 - 2026 #DFIR
https://thisweekin4n6.com/2026/06/28/week-26-2026/
Remote
Phillmoore
@Phillmoore@infosec.exchange
mastodon 4.8.0-alpha.3+glitch284 Followers
51 Following
26 Posts
Joined November 04, 2022
While doing some digging at my old job we found that sometimes Amcache might present data that isn't reflected in the PE it relates to.
We didn't figure out why this happens, but Velociraptor is the perfect tool for digging in deeper
https://thinkdfir.com/2026/04/25/trust-but-verify-amcaches-originalfilename-field-isnt-always-accurate/ #DFIR