From d44d3facfe8b2f0e81a7744a09f6797161d4923f Mon Sep 17 00:00:00 2001 From: "Mariusz B. / mgeeky" Date: Wed, 29 Sep 2021 16:15:24 +0200 Subject: [PATCH] readme --- README.md | 2 +- images/{pe-sieve0.png => pe-sieve1.png} | Bin 2 files changed, 1 insertion(+), 1 deletion(-) rename images/{pe-sieve0.png => pe-sieve1.png} (100%) diff --git a/README.md b/README.md index 64a3d01..ea5105c 100644 --- a/README.md +++ b/README.md @@ -117,7 +117,7 @@ However, no `Abnormal private executable memory` IOC this time. Our fluctuation And for the record, `pe-sieve` has no issues with our fluctuating shellcode as well: -![pe-sieve](images/pe-sieve0.png) +![pe-sieve](images/pe-sieve1.png) So we're able to see already that there are no clear references pointing back to our shellcode, at least memory IOC-wise. But what about that modified `kernel32` IOC? diff --git a/images/pe-sieve0.png b/images/pe-sieve1.png similarity index 100% rename from images/pe-sieve0.png rename to images/pe-sieve1.png