Attributed metadata history
Up to 100 retained publisher events per page for bf61e5def835d0a7faa0a571d76a794a4ace598a3907d55631b31c6edf7f90f0. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_6df1fb5096a2991dbd
observed · 2026-10-13 17:53:03 UTC
available
Fingerprint: 460dbc36e8eeea4c8056749ae7b3c4427a8ed765b994b55571c25ea91055512d
intelligence_src_6df1fb5096a2991dbd
observed · 2026-10-13 17:53:03 UTC
Max Groot & Erik Schamper TL;DR Windows Defender (the antivirus shipped with standard installations of Windows) places malicious files into quarantine upon detection. Reverse engineering mpengine.dll resulted in finding previously undocumented metadata in the Windows Defender quarantine folder that can be used for digital forensics and incident response. Existing scripts that extract quarantined files do … Continue reading Reverse, Reveal, Recover: Windows Defender Quarantine Forensics →
Fingerprint: a56d762e53d3359475d7a025210ddf45a39b80330b8ea318324cc8aacaccf166