Fruit flies aren't exactly famous for their brainpower; you've probably drowned more than one in a wine glass left too long on the patio table. And yet, working with roughly 140,000 neurons—a brain smaller than a poppy seed—Drosophila can sort through a huge range of smells in a fraction of a second, and then retain the memory of that scent for a long time.
In this, they do much better than current "electronic noses." Even the most advanced ones on the market tend to be expensive, painfully narrow in what they can detect, and quick to forget an odor the moment they learn a new one.
So why not just copy the fly? That's the question a growing number of researchers have been asking—including Kevin Max and Yang Shen at the Okinawa Institute of Science and Technology, whose new algorithm, Spi-Fly, is described in a paper recently published in the journal Neuromorphic Computing and Engineering.
It's that time of year again, when we learn which lucky scientists are among the winners of the Ig Nobel Prizes. This year, the prizes honor research on designing the perfect splash-free urinal; using mosquito proboscises to "necroprint" tiny nozzles; studying composition rates of buried cotton underwear; and the aerodynamics of a healthy nose-blow, among other highlights.
Established in 1991, the Ig Nobels are a good-natured parody of the Nobel Prizes; they honor “achievements that first make people laugh and then make them think.” The unapologetically campy awards ceremony features miniature operas, scientific demos, and "24/7 lectures," whereby experts must explain their work twice: once in 24 seconds and the second in just seven words.
Acceptance speeches are limited to 60 seconds. And as the motto implies, the research being honored might seem ridiculous at first glance, but that doesn’t mean it’s devoid of scientific merit. In the weeks following the ceremony, the winners will also give free public talks, which will be posted on the Improbable Research website.
For some, making FEVS an agency-specific survey is a welcome change. But questions remain about a tight timeline, limited resources and lack of experience.
A piano’s internal mechanism for translating a key press into sound is surprisingly complicated. It has to do a lot of things simultaneously and quickly: provide precise control over velocity, ensure the hammer doesn’t press itself against the strings, ensure the hammer rebounds without accidentally hitting the strings, allow for quick, continued strikes of the strings, and dampen the string after the key is released. Not only is that a mouthful to say, it’s a tall order for a mechanical device and took (arguably) around 150 years for the idea to be refined into what most of us would recognize as a piano. But could [dovetail] do it with a 3D printer in a few weeks?
[dovetail]’s design relies on compliant mechanisms, which are solid parts that flex in specific and controlled ways to provide movement. The action took many iterations to make sure that all of the feelings of all the parts of a real piano action were accounted for in this model. Pianos have more than one key, though, so [dovetail] also had to design a modular system to piece all the keys together. The modularity extends to the piano’s electronics as well, with a set of PCBs daisy-chained together, each of which supports a set of keys. This is a hybrid piano, a style with a real action but digital sound production. Using infrared sensors allows the instrument to behave as a MIDI keyboard, but one with the goal of feeling somewhere between a digital piano and a fully analog one.
The piano was first demonstrated at Open Sauce, where a number of musicians were able to try it out. As a prototype device it still has a few rough edges that [dovetail] plans to improve upon, like changing the sensors from IR to hall effect, improving the action and using a different filament. There are some other things he has planned as well which we look forward to seeing in future videos. And, although a completely different instrument, it has a number of similarities to this action built to strike a bass drum instead.
Logitech is facing a proposed class action lawsuit for not giving customers tariff refunds.
In April 2025, Logitech raised the prices on 51 percent of its portfolio, with some prices increasing by as much as 25 percent.
The complaint seeks to “recover monies that Logitech extracted from American consumers as offset for import tariffs that the United States Supreme Court has since declared unlawful, tariffs for which Logitech now stands to be reimbursed by the federal government. This is all while Logitech retained every dollar of the corresponding price increases it charged its customers due to the illegal tariffs.”
The article on DeadMatter was really popular and relevant for many of you. DeadMatter works with LSASS and finds artifacts related to active or recently active sessions. But sometimes you need SAM hashes during a pentest.
Today we’re using 7z to find and pull the hives. It’s very common to find and it has raw disk access to fetch what we need without triggering the EDR. You can basically call it a living off the land technique due to its widespread presence. There are other ways to extract hashes, but most of them are well known and monitored. Some hackers rely on VSS and it works fine in some environments, but detecting VSS abuse isn’t hard. It’s a beginner level of complexity. VSS leaves very specific traces in the logs when you use it. Native Windows binaries get blocked outright and finding forensic tools already sitting on an endpoint is uncommon.
Credit where it’s due, Jonas Lyk shared this approach.
Extracting Hives
To make it work, you need to start 7z as Administrator, otherwise it just fails. Then you type \\.\ in the path bar and it’ll show you the drives.
Here we need PhysicalDrive0. You can’t copy it off the C:\ drive, because it’s locked by the system.
Inside you’ll see the partitions on the physical drive. Usually 1.ntfs has the structure of your C:\. 0.ntfs has $MFT, $J and the other files you want for a deeper dive.
System hives live in Windows\System32\config
Select the hives you need and copy them to a folder. We’re only pulling SAM and SYSTEM here, but you can get SOFTWARE, $MFT, $J, and NTUSER.DAT if you’re doing behavioral analysis. We covered that in our article showing how much you can find out about a user after a compromise. Behavioral analysis is also useful in pentesting. NTUSER.DAT shows a lot about how the sysadmins use their machines.
File size shows the hives aren’t empty. Now we can move them to Kali and extract the hashes.
kali > impacket-secretsdump -sam SAM -system SYSTEM LOCAL
We got all the local user hashes. If LAPS isn’t enabled (in a lot of environments it isn’t), there’s a good chance the admin hash is identical across many machines. Some admins don’t even know LAPS exists, others are scared to turn it on because they’re not in control of the password rotation. Either way, SAM alone can be enough to compromise the whole domain.
Terminal
This approach hits a wall in the terminal. 7z can only parse physical disks and NTFS partitions through the File Manager GUI. The CLI version still can’t open nested partitions and throws an error every time. So the GUI is the only way you can pull it off.
There are forensics tools that do it in the terminal (AxiomSecret, RawCopy, etc.) but that’s a story for another day.
Summary
Many successful attacks use LOL techniques or signed tools. This approach is creative and 7z is already sitting on plenty of machines. Even if it’s not, bringing it over isn’t suspicious.
It won’t get you LSASS hashes, but the SAM hashes alone can be enough to compromise a company’s entire infrastructure. We showed that in our SCADA article, where the SCADA machine stored cleartext passwords in memory and password reuse helped us with the rest of the infrastructure during the pentest. LAPS isn’t hard to set up and it can close this door, so spend some time learning it.
If you like what we’re doing here and want to get started in Digital Forensics or advance your skills, we recommend our training for both beginners and more experienced students.
During pentests, we often run into EDRs and antiviruses protecting endpoints. These mainly stop you from dumping hashes and running malware on the hosts. Although they’re often good at what they do, they still have flaws that make them vulnerable to chokers and killers that can terminate their process.
If you’ve ever tried dumping LSASS or extracting SAM and SYSTEM hives, you’ve seen the EDR block your attempts. There are legit ways to do it, for instance with reg.exe or Task Manager, but these have been abused for so long that they can’t be relied on anymore. Despite all that, dumping hashes is really easy if you do a complete memory dump with forensics tools and pull the hashes from the dump. These tools don’t just target LSASS, they do a full memory dump that includes everything. That’s what’s supposed to happen during incident response procedures, so nothing gets flagged and it won’t, because that would interfere with security work.
Today we want to show you how to use FTK Imager with DeadMatter to extract different credentials. FTK Imager needs a GUI, so if you don’t have it try running DumpIt from CLI instead. It’s available on GitHub.
What is DeadMatter
DeadMatter is written in C# and its whole job is to extract sensitive information from memory dumps. It scans raw data to find patterns associated with credentials, that way you can recover them even when the memory dump is incomplete or the format isn’t predictable. The tool is also lightweight and isn’t flagged by AV/EDR, so you can extract hashes on the victim machine directly without transferring these huge files around. The results include NTLM hashes, DPAPI keys, and other artifacts tied to logon sessions. The tool was first presented at Black Hat USA 2025.
Compiling DeadMatter
The repository for DeadMatter doesn’t include a precompiled binary and you will need to build it yourself. You can do it with Visual Studio or using the .NET Framework.
If you choose to compile it manually, you can clone the repository and execute the build process from PowerShell.
PS > dotnet build -c release
Once it completes, Deadmatter.exe will be in the bin\Release directory. The build process usually completes without issues, if you have the required .NET components installed correctly.
If you prefer not to compile the tool yourself or run into problems during the process, you can use our compiled version to save time. We uploaded the compiled executable to our GitHub.
Capturing RAM
Before moving forward, it is important to understand that this technique relies on the ability to extract credentials from memory, which is significantly affected by the state of Credential Guard. If Credential Guard is enabled, credentials are isolated and you won’t be able to access them.
But in many environments with Windows 10 Pro or Windows Server versions prior to 2025, Credential Guard is often disabled. These systems are still widely used across corporate infrastructures. Newer deployments usually have it enabled by default now. To avoid unnecessary effort you can check the status of Credential Guard before proceeding.
If it shows that it’s disabled {0}, you can proceed with memory acquisition.
We used FTK Imager to capture RAM. You just need open the app and click “Capture Memory”
Then you specify the name and the destination path. The default settings are enough.
Our next step is exfiltration. Modern systems often have large amounts of RAM. Servers commonly have 16-32GB as a baseline, and systems that have Microsoft Exchange may have significantly more. A raw memory dump of this size can be quite large, but you can compress it with 7z. It’s possible to reduce it from 32GB down to 12 GB, if you don’t want to run DeadMatter directly on the compromised system.
Extracting Credentials
Once the dump is transferred, you can extract creds. To process a full memory dump in raw format using structured parsing and carving, run this:
PS > .\Deadmatter.exe -f memory_dump.raw
The output is quite detailed. As you scroll through the results, you will find different credentials associated with active or recently active sessions on the system.
If you want to rely purely on carving methods, you can ignore structured parsing and search the raw data directly:
PS > .\Deadmatter.exe -f memory_dump.raw -m carve
When you work with a minidump file and want to use a specific parsing method, you can define the technique and the Windows version:
There are also more advanced options available. For instance, you can extract both credentials and DPAPI keys with additional brute-forcing to find initialization vectors within the data:
PS > .\Deadmatter.exe -f memory_dump.raw -b -d
Try different methods and see if you can find more information.
Defense
To protect yourself from these attacks, make sure Credential Guard is on. It’ll make the credentials inaccessible. It’s also a good idea to monitor which forensic tools are being used. Ideally, keep a whitelist of approved tools that way you can spot someone trying to do a dump without authorization.
Summary
While defenders should have a red team mindset, hackers should have a blue team mindset to know how things work on the other side. Digital forensics is a great field and applies to both sides. Extracting credentials from systems is just one of its uses, more advanced knowledge can help you with behavior analysis and evasion.
If you want to learn more about Digital Forensics, we have training for beginners and for those who want to advance their skills in it.
China-linked UNK_MassTraction targets US and Canadian universities through Roundcube flaws, stealing sessions and opening access to research mail servers.
Login
