m8urnett

/*
   Copyright (c) Microsoft Corporation

   SYNOPSIS

     Declares the management portion of the FWP API.
*/
#include <winapifamily.h>

#pragma region Desktop Family or AppRuntime Package

m8urnett

				<item>
					<filterKey>{96809035-6827-4d6f-a6b8-980ac33511ac}</filterKey>
					<displayData>
						<name>Query User</name>
						<description>Prompt the User for a decision corresponding this Inbound Traffic</description>
					</displayData>
					<flags/>
					<providerKey>{decc16ca-3f33-4346-be1e-8fb4ae0f3d62}</providerKey>
					<providerData>
						<data>1e27010000000000</data>

m8urnett

applocker
bitlocker
cacls
code integrity
credential guard
dacl
device guard
dotnet
group policy
icacls

m8urnett

Placeholder

m8urnett

PACKET HDQ-7309217392

----

Code: AB-aKd&Egh281Q
282-18-2983821-28172391u721
DISTRESS.
CHECK-IN 00:00+[37209-a271927]-[381937821]
ROUTE T

m8urnett

(site:docs.microsoft.com OR site:download.microsoft.com OR site:msdn.microsoft.com OR site:research.microsoft.com OR site:support.microsoft.com OR site:technet.microsoft.com OR site:techcommunity.microsoft.com) AND (accesschk OR applocker OR autoruns OR certutil OR "credential guard" OR cryptography OR CurrentControlSet OR dacl OR "device guard" OR encrypt OR "event log" OR "group policy" OR lsass OR mimikatz OR netsh OR "new registry" OR "new tool" OR "new utility") -social


(site:docs.microsoft.com OR site:download.microsoft.com OR site:msdn.microsoft.com OR site:research.microsoft.com OR site:support.microsoft.com OR site:technet.microsoft.com OR site:techcommunity.microsoft.com) AND (openssl OR sacl OR schannel OR security OR shellexec OR Sigcheck OR smb OR sysinternals OR sysmon OR vulnerable OR wmi OR wmic) -social

m8urnett

#####################################################################
# FPSEInfo.pl v1.0
# Returns information from the FrontPage server extensions
#
# by Mark Burnett ([email protected])
# Copyright (C)2002 Mark Burnett, All Rights Reservered
#
# This script and accompanying documentation are provided "as is",     
# without warranty of any kind, express or implied, including       
# but not limited to the implied warranties of merchantability and     

m8urnett

AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Core-Heap-Obsolete-L1-1-0.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Core-Kernel32-Private-L1-1-0.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Core-Kernel32-Private-L1-1-1.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-EventLog-Legacy-L1-1-0.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Eventing-ClassicProvider-L1-1-0.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Eventing-Controller-L1-1-0.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Eventing-Legacy-L1-1-0.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Eventing-Provider-L1-1-0.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Security-Lsalookup-L2-1-0.dll
AppData\Local\Temp\506646C4-9121-47D9-9691-C6D78E47002F\API-MS-Win-Security-Lsalookup-L2-1-1.dll

m8urnett

cmder
D:PAI(A;OICI;FA;;;SY)(A;OICI;0x1200a9;;;AU)(A;OICI;FA;;;BA)S:AI(ML;OICI;NW;;;ME)
cmder\config\.history
D:AI(A;;0x1200af;;;AU)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;AU)(A;ID;FA;;;BA)S:AI(ML;;NW;;;ME)
cmder\config\ConEmu.xml
D:AI(A;ID;FA;;;SY)(A;ID;0x1200a9;;;AU)(A;ID;FA;;;BA)S:AI(ML;ID;NW;;;HI)
cmder\config\settings
D:AI(A;;FA;;;AU)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;AU)(A;ID;FA;;;BA)S:AI(ML;ID;NW;;;HI)
cmder\config\user-ConEmu.xml
D:AI(A;;FA;;;S-1-5-21-3296739879-1852959184-2879946361-1107)(A;ID;FA;;;SY)(A;ID;0x1200a9;;;AU)(A;ID;FA;;;BA)S:AI(ML;;NW;;;ME)

m8urnett

Microsoft.Windows.Dwm.DwmCore.Frames
{
	"ver": "3.0",
	"name": "Microsoft.Windows.Dwm.DwmCore.Frames",
	"time": "2018-02-23T04:11:21.6471620Z",
	"iKey": "o:0a89d516ae714e01ae89c96d185e9ae3",
	"flags": 257,
	"ext": {
		"utc": {
			"epoch": "1500436",