Solving practical problems with AI – Part 1 – Jpeg files renaming using EXIF...
I don’t write about AI much, because everyone else does. I use it though, more and more, despite being a dedicated late adopter of new technologies, by choice. I thought it would be interesting to post...
View ArticleThe boring state of stalled timelines…
The subject of timelines & supertimelines used to dominate many discussions in the digital forensic world… 10-15 years ago. At that time the concept of temporal proximity was super hot and for a...
View ArticleEtwCheckCoverage API
This is a relatively new API (EtwCheckCoverage) that may be of interest. It is being used by a couple of DLLs and executables in Windows 11 and here’s a list of known parameters it takes:...
View Article1 little known secret of aidd.dll
When you run (from admin account): rundll32 aidd.dll, AiddRunTask a lot of interesting things are happening. There are at least 2 files of interest being created:...
View Article1 little known secret of WinCsFlags.exe
The WinCsFlags.exe program accepts an undocumented command line argument “-w”. When you invoke it like this: WinCsFlags.exe -w it will go into a never-ending loop waiting for the debugger to be attached.
View Articlelittle secret of msconfig.exe
This post doesn’t include anything ground breaking, but is just yet another attempt to describe/document less-known command line arguments of many known, often native to the platform, Windows programs....
View Article1 little known secret of forfiles.exe, part 2
In this old post I have demonstrated how to abuse forfiles.exe to run your ‘cmd.exe’ of choice. There is one more trick we can do with this tool. When forfiles.exe enumerates the files it executes a...
View ArticleSome unintelligent fun with ms-notepad protocol
In my previous post I have provided a list of ‘new’ protocols I noticed in the latest Windows 11 build. One that immediately caught my attention was “ms-notepad://”. You can use it to launch Notepad...
View ArticleA few more protocol handlers :), Part 2
In 2018 I published this post. In 2022 I published this post and this post. @Radkeyboard7984 and I continue chatting about the new Windows 11 protocols and I just did a quick comparison between the...
View ArticleWerReportCreate API
The API I want to talk about today is called WerReportCreate. It takes a few arguments, but the most interesting is the first one, which is the Event Name. Looking at Windows OS binaries, we can see...
View ArticleShimBad the Sailor, Part 3
Windows 11 brings us a lot of new Shim-related goodies and it makes sense to cover at least some of them. In the second part of this series I listed a number of process names that are treated in a …...
View Article1 little known secret of sti_ci.dll
In 2017 I posted about sideloading of sti_ci.dll. And it’s that DLL itself that executes the InstallWiaDevice installation command mentioned in that post… How? Via its export function called…...
View ArticleBeyond good ol’ Run key, Part 153
This Registry entry: HKLM\Software\Microsoft\Windows\CurrentVersion\Group Policy\Test\AdmParseLibrary=<DLL> is of interest as it relates to TestHooks library that is loaded when *.admx template...
View ArticleChina Domain Name Scammers target Hexacorn
A few days ago, I have received the following note from mike.zhang@domainregistrar [.] net [.] cn: Without thinking too much, I replied that I don’t know that company. Darn, that was the hook. Scammer...
View Article1 little known secret of help.exe
When you run help.exe it prints out a lot commands that it supports. The below is a snapshot from Windows 11: For more information on a specific command, type HELP command-name ASSOC Displays or...
View Article1 little known secret of nslookup.exe, part 2
This is a little lolbin trick you can do with a nslookup.exe program. One of the less-known nslookup.exe commands is view <filename>. When executed, it reads a content of a given file and sorts...
View Article1 little known secret of wsreset.exe
The wsreset.exe program is a known lolbin, but it has a lot more to offer than is currently known. When it is invoked with a command line argument /refreshlicenses it loads a licensemanagerapi.dll...
View ArticleForensics of the past
Few days ago my buddy and I had a chat about so-called old-school forensics. The one where you often used Encase, and – if you were inclined enough – EnScript scripting. This convo led me to my old...
View Articlentprint.exe lolbin
You can copy c:\WINDOWS\system32\ntprint.exe to a folder of your liking f.ex. c:\test, and then launch it with command line arguments like this: ntprint.exe PSetupElevatedLegacyPrintDriverInstallW {}...
View ArticleUsing .LNK files as lolbins
I am not sure if I or anyone else pointed it out before. Highly possible. I kinda lost track of it at this stage… So, anyway… this is a pretty dumb lolbin functionality that is exhibited by many native...
View Article
![[TVRIP] FX Senshi Kurumi-chan [FX戦士くるみちゃん] 第01-02話](http://animerss.com/img/TVRIP-FX-Senshi-Kurumi-chan.jpg)
