Daily Blog #552: Forensic Lunch Test Kitchen 11/28/18 - Discussion on Lznt1 libraries, YARP, and Win7 Amcache

Discussion on  Lznt1 libraries, YARP, and Win7 Amcache with Maxim Suhanov by David Cowen - Hacking Exposed Computer Forensics Blog

Hello Reader,
       Tonight we had a test kitchen with ups and downs as some things worked and others didn't. Here's what we learned:

  • All of the lznt1 libraries we tried to decompress the system binary registry entries Maxim Suhanov found failed
  • YARP has support for the lznt1 format used in the registry, I've downloaded it and we will use it tomorrow
  • The Windows 7 Amcache can be manually updated by running the scheduled task, but otherwise will not be updated until the scheduled task runs
  • The last write date of the key in the Amcache in Windows 7 has nothing to do with execution time, its just when the scheduled task ran
  • Like Windows 10 the Windows 7 Amcache will scan any executable on the desktop and insert it into the Amcache even if it wasn't executed
More tomorrow night!

Here is the video:

Also Read: Daily Blog #551

Post a Comment