aguytech

format for audacity

Export / Export Audio / (external program)

ffmpeg -i - -codec:a libopus -b:a 64k -vbr on -compression_level 10 "%f" # whithout space in path file

aguytech

start

log mimikatz.log

lsadump

cd $path_hive

aguytech

hivexget hivefile PATH [NAME]

Get subkey from a Windows Registry binary "hive" file

example

hivexget ${path_hive}/SAM "SAM\Domains\Account\Users\000003E9" V

aguytech

https://helpmanual.io/man8/chntpw/

chntpw [options] <samfile> [systemfile] [securityfile] [otherreghive] [...]

Utility to overwrite passwords of Windows systems

usage

chntpw -i $hive

aguytech

#!/bin/bash

_PATH_SCRIPT=${0%/*}

file=${_PATH_SCRIPT}/foralyse-inc.sh
! [ -f ${file} ] && echo "Unable to find file: ${file}" && exit 1
! . ${file} && echo -e "Errors encountered. \nSee log files in /var/lkog/foralyse" && exit 1

_call foralyse-host.sh "HOST"

aguytech

#!/bin/bash

python3 -m pip install -U pip
python3 -m pip install -U volatility3
cd /usr/local/bin && sudo ln -sv vol vol3

aguytech

sqlitebrowser

file=/vol6/Users/Angela/AppData/Local/Microsoft/Windows/Notifications/wpndatabase.db
sqlitebrowser ${file}

query

SELECT datetime((ArrivalTime/10000000)-11644473600, 'unixepoch') AS ArrivalTime,

aguytech

See foralyse

aguytech

ubuntu

sudo apt install reglookup

aguytech

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SecurityHealthService]
"Start"=dword:00000004

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc]
"Start"=dword:00000004

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender]
"DisableAntiSpyware"=dword:00000001