{"html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fsoji256.hatenablog.jp%2Fentry%2F2019%2F06%2F25%2F065200\" title=\" \u30da\u30fc\u30b8\u30d5\u30a1\u30a4\u30eb\uff08pagefile.sys\uff09 \u306e\u89e3\u6790 - setodaNote\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","type":"rich","version":"1.0","url":"https://soji256.hatenablog.jp/entry/2019/06/25/065200","blog_title":"setodaNote","published":"2019-06-25 06:52:00","categories":["\ud83e\udd89\u30d5\u30a9\u30ec\u30f3\u30b8\u30c3\u30af","\ud83e\uddf0Volatility"],"author_url":"https://blog.hatena.ne.jp/soji256/","blog_url":"https://soji256.hatenablog.jp/","description":"pagefile.sys \u306b\u3064\u3044\u3066 pagefile.sys \u306f\u30b7\u30fc\u30b1\u30f3\u30b7\u30e3\u30eb\u3067\u306a\u304f 4KB \u4ee5\u4e0b\u306e\u30c7\u30fc\u30bf\u306e\u65ad\u7247\u306e\u96c6\u5408\u306a\u306e\u3067\u3001Volatility \u3067\u306f\u89e3\u6790\u3067\u304d\u305a\u3001 Yara \u3084 Strings \u3067\u6709\u7528\u306a\u30c7\u30fc\u30bf\u304c\u6b8b\u3055\u308c\u3066\u3044\u306a\u3044\u304b\u3092\u78ba\u304b\u3081\u308b\u306e\u304c\u3088\u3044\u3068\u3044\u3046\u3053\u3068\u306e\u3088\u3046\u3002 \u89e3\u6790\u4f8b \u7121\u95a2\u4fc2\u306e\u6587\u5b57\u5217\u3082\u542b\u307e\u308c\u308b\u306e\u3067\u7cbe\u67fb\u306f\u5fc5\u8981\u3002\u7279\u306b\u300c\u74b0\u5883\u5909\u6570\u300d\u306e\u5f0f\u306f\u30ce\u30a4\u30ba\u304c\u591a\u3044\u3002 \u30d5\u30a1\u30a4\u30eb\u30d1\u30b9 $ strings pagefile.sys | grep -i \"^[a-z]:\\\\\\\\\" | sort | uniq \u74b0\u5883\u5909\u6570 $ strings pagefile.sys | grep -i \"^[a-zA-Z09_]*=.*\"\u2026","provider_name":"Hatena Blog","provider_url":"https://hatena.blog","width":"100%","title":" \u30da\u30fc\u30b8\u30d5\u30a1\u30a4\u30eb\uff08pagefile.sys\uff09 \u306e\u89e3\u6790","height":"190","image_url":"https://cdn.user.blog.st-hatena.com/default_entry_og_image/142804665/1534635173988912","author_name":"soji256"}