urhggh

added a ms account to win 10

now every boot it asks for hte password

...that's pretty normal

Wait, at boot, or at the login screen?

NEW HACKING CHALLENGE: hackchal.cf

/me sneezles

@Rahul2001 The example proxy invocation doesn't work :(

@BenN obv

Backfired last time

@Rahul2001 remind me in about 6 hours, I'm gonna sleep

Hm, I now have another "Pass" box after going through one login form

@Bob :D

@BenN yep

Notice the change in the title

The form POSTs to #

@BenN yeah

Yep, just notebooking

Probably shouldn't share my findings with others, though :)

@DavidPostill Grrr...

> Cool! You reached here! Come back tomorrow!

Winner winner chicken dinner

@Rahul2001 I did not previously know that setting a form's action to # would make it go to the same page. I had to look that up, so I learned something :)

Soon...

@BenN :D

@allq, @BenN, and anyone else interested: This is the envelope for a letter that seems to be trying to scam us by offering a "Current Property Deed and Property Assessment Profile" for $83, with a deadline of June 16 to make the document appear urgent and other features to make this look like an official document. Is this in violation of USPS DMM 601.9.2.2?

@bwDraco One could argue that it is a violation, because it does not have this exact text:

> THIS IS NOT A GOVERNMENT DOCUMENT

> Matter that contains a solicitation for products, services, information, or funds that implies any federal government connection, approval, or endorsement through the use of a [...] citation to a federal statute [...] or any other term or symbol [...] is nonmailable unless it conforms to 9.2.3.

The text as written, "U.S. MAIL TTT.18.CODE", reads like a citation to a federal statute but it isn't a real citation. Notice the TTT. It reads as if the sender is purposely exploiting a loophole in our postal law.

(For reference, 18 USC is the federal penal code.)

The catchall "any other term or symbol" would probably cover this case.

So, is there an easy way to bring this up to a Postal Inspector, aside from physically taking the mailpiece to the local Post Office?

I'm not aware of any other method :/

@bwDraco @BenN Mail Fraud Complaint

Oh, neat

People living in the UK know how to Google :)

I'm having a random cmd window pop up for a split second and then disappear multiple times a day, for a couple days now. Any ideas how I might figure out what it is?

I thought I could use one of the sysinternal tools just capture a process tree over time but it seems neither process explorer nor process monitor do that.

You could probably do it with procmon

@BenN I tried, but I couldn't seem to find the right settings.

Might the Linux subsystem be it?

@BenN nope, not running 10.

It's 8.1

Ah. You can set Process Monitor to just capture process events. I'm not sure if there's a tree thingy, let me check

There is a thing under Tools called Process Tree

@BenN yeah there is, but it didn't look helpful in this case

wait

is that a process tree over time of a capture? That would be useful.

I think it is, yes

I'll start a capture and just wait then.

thanks!

I suggest setting your filter to process events only, and Drop Filtered Events, otherwise your machine will get amazingly slow

You're welcome :)

@BenN I can't remember how to do that -.-

been a while since I've had to use these tools

Use the toggle buttons in the right of the toolbar to only enable process events (the Windows flag icon). Drop Filtered Events is under Filter

Ah, thanks. However when I test it by opening up a new application nothing shows up :/

Does the bottom-left say "No events (capture disabled)"?

Also make sure that there aren't any Include filters (Filter | Filter...)

@BenN No. It says "The current filter excludes all 21 events"

I didn't set any filters myself though

if I enable registry events they show up

yep that's what mine is set to

I even hit "reset" just to make sure

Hmm, does it work if Procmon is running as admin?

Oh never mind, Procmon always prompts to elevate

yeah

oh I'm an idiot

I thought the magnifying glass with the red cross meant it was capturing, however apparently that actually pauses it...

now it's working properly. sorry.

No problem :) Glad you got it working

Apparently it doesn't say "(capture disabled)" when there are events, which is a bit unintuitive