Kristal-g 
							
						 
					 
					
						
						
							
						
						fd01a9151a 
					 
					
						
						
							
							Added desktopimgdownldr.exe  
						
						 
						
						
						
						
					 
					
						2020-07-02 20:46:05 +03:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						9f110bce07 
					 
					
						
						
							
							Fixed missing octet in command  
						
						 
						
						
						
						
					 
					
						2020-03-25 11:24:54 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						6ac04d73d7 
					 
					
						
						
							
							Added examples to bash.exe  
						
						 
						
						
						
						
					 
					
						2020-03-25 11:08:13 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Chris "Lopi" Spehn 
							
						 
					 
					
						
						
							
						
						d67c8f5c11 
					 
					
						
						
							
							Update RegAsm to the correct permissions  
						
						 
						
						
						
						
					 
					
						2020-03-20 11:51:21 -06:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						cce7c5ce3a 
					 
					
						
						
							
							Adjusted error in atbroker as per issue  #47  
						
						 
						
						
						
						
					 
					
						2020-03-17 11:08:47 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						94d10799d3 
					 
					
						
						
							
							Adjusted ilasm  
						
						 
						
						
						
						
					 
					
						2020-03-17 11:05:14 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								LuxNoBu!!shit 
							
						 
					 
					
						
						
							
						
						7a2ff4c250 
					 
					
						
						
							
							Create ilasm.yml  
						
						 
						
						
						
						
					 
					
						2020-03-17 03:04:20 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						80295ef865 
					 
					
						
						
							
							Merge pull request  #54  from ForensicITGuy/ntdsutil  
						
						 
						
						... 
						
						
						
						Ntdsutil & Rasautou addition 
						
						
					 
					
						2020-03-16 20:06:54 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						81c363ac8a 
					 
					
						
						
							
							Adjustment to vbc.yml contribution  
						
						 
						
						
						
						
					 
					
						2020-03-16 19:55:27 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								leo1-1 
							
						 
					 
					
						
						
							
						
						c7c93e9f95 
					 
					
						
						
							
							Create vbc.yml  
						
						 
						
						
						
						
					 
					
						2020-02-27 17:13:07 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						acecdcf3df 
					 
					
						
						
							
							Netsh contribution from Freddie Bar-Smith - Thank you  
						
						 
						
						
						
						
					 
					
						2020-01-23 09:07:40 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						94708ac5d6 
					 
					
						
						
							
							Added links to obfuscation technique from Sailay(valen) on rundll32  
						
						 
						
						
						
						
					 
					
						2020-01-23 08:57:43 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Tony M Lambert 
							
						 
					 
					
						
						
							
						
						99b87fdc13 
					 
					
						
						
							
							Rasautou addition  
						
						 
						
						
						
						
					 
					
						2020-01-10 22:52:15 -06:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						ecc94c2d09 
					 
					
						
						
							
							Adjusted GfxDownloadWrapper  
						
						 
						
						
						
						
					 
					
						2020-01-07 09:08:13 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						71aec7465b 
					 
					
						
						
							
							Minor adjustments to GfxDownloadWrapper.yml  
						
						 
						
						
						
						
					 
					
						2020-01-07 09:03:42 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								jesgal 
							
						 
					 
					
						
						
							
						
						c9e608ce0f 
					 
					
						
						
							
							Update GfxDownloadWrapper.yml  
						
						 
						
						
						
						
					 
					
						2019-12-27 17:11:30 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								jesgal 
							
						 
					 
					
						
						
							
						
						a057cf2420 
					 
					
						
						
							
							Create GfxDownloadWrapper.yml  
						
						 
						
						... 
						
						
						
						GfxDownloadWrapper.exe downloads the content that returns <URL> and writes it to the file <DESTINATION FILE PATH>. The binary is signed by "Microsoft Windows Hardware", "Compatibility Publisher", "Microsoft Windows Third Party Component CA 2012", "Microsoft Time-Stamp PCA 2010", "Microsoft Time-Stamp Service". 
						
						
					 
					
						2019-12-27 17:02:34 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						94a295213e 
					 
					
						
						
							
							Added Dump example to TTTracer.exe  
						
						 
						
						
						
						
					 
					
						2019-11-18 12:50:49 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						e0db5721ff 
					 
					
						
						
							
							Added Dump Example to TTTracer.exe  
						
						 
						
						
						
						
					 
					
						2019-11-18 12:47:51 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						4663c13324 
					 
					
						
						
							
							Adjustment  
						
						 
						
						
						
						
					 
					
						2019-11-05 15:47:20 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						8d74b3062f 
					 
					
						
						
							
							Adjustment  
						
						 
						
						
						
						
					 
					
						2019-11-05 14:36:53 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						f9a7c42a85 
					 
					
						
						
							
							Added TTTracer.exe - Thanks Onur Ulusoy  
						
						 
						
						
						
						
					 
					
						2019-11-05 12:12:46 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						13093c879e 
					 
					
						
						
							
							Updated odbcconf.exe with discovery from @Hexacorn <3  
						
						 
						
						
						
						
					 
					
						2019-10-24 10:01:44 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						8eb582de42 
					 
					
						
						
							
							Update At.yml  
						
						 
						
						
						
						
					 
					
						2019-10-07 23:51:26 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								freddie 
							
						 
					 
					
						
						
							
						
						9f47e26f16 
					 
					
						
						
							
							Adding At.exe, for submission to LOLbas list, with proof of malware using it in wild :O  
						
						 
						
						
						
						
					 
					
						2019-09-21 03:19:25 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						b284e46763 
					 
					
						
						
							
							Added example to wscript  
						
						 
						
						
						
						
					 
					
						2019-06-27 17:27:31 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						da3b619651 
					 
					
						
						
							
							Adjusted new contributions  
						
						 
						
						
						
						
					 
					
						2019-06-27 13:42:06 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						285e4d78d8 
					 
					
						
						
							
							Adjusted new contributions  
						
						 
						
						
						
						
					 
					
						2019-06-27 13:40:03 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								r0lan 
							
						 
					 
					
						
						
							
						
						fb5f164827 
					 
					
						
						
							
							Cmd.exe ADS  
						
						 
						
						
						
						
					 
					
						2019-06-26 18:33:11 +08:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						f7748a08cc 
					 
					
						
						
							
							added Jsc.exe - Thanks @DissectMalware  
						
						 
						
						
						
						
					 
					
						2019-05-31 13:56:55 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						106c359687 
					 
					
						
						
							
							added Jsc.exe - Thanks @DissectMalware  
						
						 
						
						
						
						
					 
					
						2019-05-31 13:53:43 +02:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						17e541f8c0 
					 
					
						
						
							
							Added wsreset.exe - uac bypass  
						
						 
						
						
						
						
					 
					
						2019-03-18 08:44:53 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								bohops 
							
						 
					 
					
						
						
							
						
						8806a9e0ee 
					 
					
						
						
							
							Added VSS use case  
						
						 
						
						
						
						
					 
					
						2019-02-12 08:15:55 -05:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						69795dca7e 
					 
					
						
						
							
							Added fixes from  https://github.com/sagishahar , typos in wmic and extexport  
						
						 
						
						
						
						
					 
					
						2019-02-01 18:38:35 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Santiago Bruno 
							
						 
					 
					
						
						
							
						
						cc8288c7d5 
					 
					
						
						
							
							Fixing some typos  
						
						 
						
						
						
						
					 
					
						2019-01-28 13:39:23 -03:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						a0136a78cd 
					 
					
						
						
							
							Typo in command - fixed  
						
						 
						
						
						
						
					 
					
						2019-01-24 11:52:25 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						92bcd8cfd8 
					 
					
						
						
							
							added new example to certutil from egre55  
						
						 
						
						
						
						
					 
					
						2019-01-24 10:40:45 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Santiago Bruno 
							
						 
					 
					
						
						
							
						
						64623edd6e 
					 
					
						
						
							
							Renaming Ie4unit.yml as Ie4uinit.yml since this is the correct binary name  
						
						 
						
						
						
						
					 
					
						2019-01-23 20:06:16 -03:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Santiago Bruno 
							
						 
					 
					
						
						
							
						
						7252652920 
					 
					
						
						
							
							replacing ie4unit occurrences with ie4uinit  
						
						 
						
						
						
						
					 
					
						2019-01-23 20:04:12 -03:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						aba9538581 
					 
					
						
						
							
							minor changes to Eventvwr  
						
						 
						
						
						
						
					 
					
						2018-12-12 12:50:27 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						d827dfba1f 
					 
					
						
						
							
							Merge pull request  #22  from eSentire/master  
						
						 
						
						... 
						
						
						
						Eventvwr.exe UAC bypass 
						
						
					 
					
						2018-12-12 12:45:35 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						7addc14d7f 
					 
					
						
						
							
							Update Eventvwr.yml  
						
						 
						
						... 
						
						
						
						Category change 
						
						
					 
					
						2018-12-12 12:45:05 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Maverick 
							
						 
					 
					
						
						
							
						
						99d1eed476 
					 
					
						
						
							
							Correct wrongly attributed twitter handle  
						
						 
						
						... 
						
						
						
						- it should be *Moriarty_Meng* instead of *moriarty2016* 
						
						
					 
					
						2018-12-10 21:26:33 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						1af009d707 
					 
					
						
						
							
							Added example to DFSVC - Thanks to PolarBearGod  
						
						 
						
						
						
						
					 
					
						2018-12-10 18:45:41 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						c9b4b244fa 
					 
					
						
						
							
							Added ftp.exe  
						
						 
						
						
						
						
					 
					
						2018-12-10 15:03:30 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						04d193ccfa 
					 
					
						
						
							
							Minor typo in Runscripthelper.exe  
						
						 
						
						
						
						
					 
					
						2018-12-10 14:38:48 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								Oddvar Moe 
							
						 
					 
					
						
						
							
						
						94368c1e69 
					 
					
						
						
							
							Major changes to Web portal - Small fixes to source files to adjust  
						
						 
						
						
						
						
					 
					
						2018-12-10 14:28:12 +01:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								bohops 
							
						 
					 
					
						
						
							
						
						2b77add5b4 
					 
					
						
						
							
							Update Mmc.yml  
						
						 
						
						
						
						
					 
					
						2018-12-04 19:38:17 -05:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								bohops 
							
						 
					 
					
						
						
							
						
						931ea67ce4 
					 
					
						
						
							
							Update Mmc.yml  
						
						 
						
						
						
						
					 
					
						2018-12-04 19:35:52 -05:00  
					
					
						 
						
						
							
							
							 
							
							
							
							
							 
						
					 
				 
			
				
					
						
							
							
								 
								bohops 
							
						 
					 
					
						
						
							
						
						838f2c9a49 
					 
					
						
						
							
							Create Mmc.yml  
						
						 
						
						
						
						
					 
					
						2018-12-04 19:35:26 -05:00