Friday, April 3, 2026

Unicode Regex Expressions Cheat Sheet 2026


Unicode Regex Expressions Cheat Sheet


Regex cheat sheets don't address Unicode; this specifically summarizes the most useful parts. The Notes section links to the actual characters represented by the 'Property' named alias. 


Unicode Regex Syntax

\p{xx}
a character with the Unicode property alias, see below
\P{xx} as capital \P
a character without Unicode property alias, see below
\x as "hex"
Hexadecimal Escape. Used to match a specific character by its hex code. Usually followed by two digits (\xHH) or braces in some engines (\x{HHHH}). 
\x41 matches the letter A.
\X as "eXtended"
Unicode Grapheme Cluster. Matches a "user-perceived character," which includes a base character plus any combining marks (like accents).

Why \X is different

In the Unicode world, some "characters" are actually multiple code points combined. For example, the emoji 👨‍👩‍👧 is one "human-perceived character" but is made of several individual code points.

  • . (the dot) might only match the first part of that emoji.

  • \X will match the entire sequence as one unit.


The property names represented by xx above are limited to the Unicode general category properties. Each character has exactly one such property, specified by a two-letter abbreviation. For compatibility with Perl, negation can be specified by including a circumflex between the opening brace and the property name. For example, \p{^Lu} is the same as \P{Lu}.

If only one letter is specified with \p or \P, it includes all the properties that start with that letter. In this case, in the absence of negation, the curly brackets in the escape sequence are optional; these two examples have the same effect:

\p{L}
\pL
Supported character property codes
PropertyMatchesNotes
COtherIncludes the following properties: CcCf, Cn, Co and Cs.

CcControlUnicode Characters in the Control Category (unicodeplus.com)
CfFormatUnicode Characters in the Format Category (unicodeplus.com)
CnUnassigned none
CoPrivate use none
CsSurrogate none
LLetterIncludes the following properties: LlLmLoLt and Lu. Get it.

LlLower case letterUnicode Characters in the Lowercase Letter Category (unicodeplus.com)
LmModifier letterUnicode Characters in the Modifier Letter Category (unicodeplus.com) 
LoOther letterUnicode Characters in the Other Letter Category (unicodeplus.com) 
LtTitle case letterUnicode Characters in the Titlecase Letter Category (unicodeplus.com) 
LuUpper case letterUnicode Characters in the Uppercase Letter Category (unicodeplus.com)
MMark 

McSpacing markUnicode Characters in the Spacing Mark Category (unicodeplus.com) 
MeEnclosing markUnicode Characters in the Enclosing Mark Category (unicodeplus.com) 
MnNon-spacing markUnicode Characters in the Nonspacing Mark Category (unicodeplus.com)
NNumber 

NdDecimal numberUnicode Characters in the Decimal Number Category (unicodeplus.com) 
NlLetter numberUnicode Characters in the Letter Number Category (unicodeplus.com)
NoOther numberUnicode Characters in the Other Number Category (unicodeplus.com) 
PPunctuation 

PcConnector punctuationUnicode Characters in the Connector Punctuation Category (unicodeplus.com) 
PdDash punctuationUnicode Characters in the Dash Punctuation Category (unicodeplus.com) 
PeClose punctuationUnicode Characters in the Close Punctuation Category (unicodeplus.com)
PfFinal punctuationUnicode Characters in the Final Punctuation Category (unicodeplus.com) 
PiInitial punctuationUnicode Characters in the Initial Punctuation Category (unicodeplus.com) 
PoOther punctuationUnicode Characters in the Open Punctuation Category (unicodeplus.com)
PsOpen punctuationUnicode Characters in the Open Punctuation Category (unicodeplus.com) 
SSymbol 

ScCurrency symbolUnicode Characters in the Currency Symbol Category (unicodeplus.com) 
SkModifier symbolUnicode Characters in the Modifier Symbol Category (unicodeplus.com) 
SmMathematical symbolUnicode Characters in the Math Symbol Category (unicodeplus.com) 
SoOther symbolUnicode Characters in the Other Symbol Category (unicodeplus.com) - Includes emojis
ZSeparator

ZlLine separatorUnicode Characters in the Line Separator Category (unicodeplus.com) - only 1 character
ZpParagraph separatorUnicode Characters in the Paragraph Separator Category (unicodeplus.com) - only 1 character
ZsSpace separatorUnicode Characters in the Space Separator Category (unicodeplus.com) 



























MS .NET Regex Cheat Sheet

For detailed information and examples, see http://aka.ms/regex
Test at
http://regexlib.com/RETester.aspx


Or test  using 💻 Launch Netspresso Lite

Netspresso Lite is the 1st tool to highlight matches and substitutions!



Single characters

Use         

To match any character 

[set] 

In that set

[^set] 

Not in that set

[a-z] 

In the a-z range

[a-z] 

Not in the a-z range

. 

Any except \n (new line)

[a-z] 

Escaped special character

 

Control characters 

Use         

To match 

Unicode 

\t 

Horizontal tab 

\u0009 

\v 

Vertical tab 

\u000B 

\b 

Backspace 

\u0008 

\e 

Escape 

\u001B 

\r 

Carriage return 

\u000D 

\f 

Form feed 

\u000C 

\n 

New line 

\u000A 

\a 

Bell (alarm) 

\u0007 

\c char

ASCII control character 


Non-ASCII codes
 

Use                     

To match  character = with

\octal                           

2-3 digit octal character code

\x hex  

2-digit hex character code

\u hex  

4-digit hex character code


Character classes 
 

Use                     

To match character 

\p{category}

In that Unicode category or block

\P{category}

Not in that Unicode category or block

\w 

Word character

\W 

Non-word character

\d 

Decimal digit

\D 

Not a decimal digit

\s 

White-space character

\S 

Non-white-space char

 

Quantifiers  

Greedy        

Lazy             

Matches 

* 

*? 

0 or more times

+ 

+? 

1 or more times

? 

?? 

0 or 1 time

{n} 

{n}?=  

Exactly n times

{n,} 

{n,}? 

At least n times

{n,m} 

{n,m}?

From n to m times

 

Anchors 

Use 

To specify position 

^           

At start of string or line

\A 

At start of string

\z 

At end of string

\Z 

At end (or before \n at end) of string

$ 

At end (or before \n at end) of string or line

\G 

Where previous match ended

\b 

On word boundary

\B 

Not on word boundary


Groups 

Use                                   

To define 

(exp)=  

Indexed group

(?<name>exp)

Named group

(?<name1-name2>exp)                                           

Balancing group

(?:exp)=  

Non-capturing group  

(?=exp)=  

Zero-width positive look-ahead 

(?!exp)=  

Zero-width negative look-ahead 

(?<=exp)=  

Zero-width positive look-behind 

(?<!exp)=  

Zero-width negative look-behind 

(?>exp)=  

Non-backtracking (greedy)

 

Inline options 

Option 

Effect on match 

i  

Case-insensitive

m 

Multiline mode

n 

Explicit (named)

s 

Single-line mode

x 

Ignore white space

Inline options .NET special instruction

Use                               

To 

(?imnsx-imnsx) 

Set or disable the specified options

(?imnsx-imnsx:exp)

Set or disable the specified options within the expression


Back References
 

Use                    

To match 

\n  

Indexed group

\k<name> 

Named group


Alternation
 

Use                                

To match 

a |b  

Either a or b 

(?(exp) yes | no)

yes if exp is matched
no if exp isn't matched

(?(name) yes | no)

yes if name is matched
no if name isn't matched

 

Substitution  

Use                

To substitute 

$n 

Substring matched by group number n 

${name}

Substring matched by group name 

$$ 

Literal $ character

$& 

Copy of whole match

$` 

Text before the match

$' 

Text after the match

$+ 

Last captured group

$_ 

Entire input string

 

Comments  

Use                        

To 

(?# comment) 

Add inline comment

# 

Add x-mode comment

 

Supported Unicode Categories 

Category          

Description

Lu 

Letter, uppercase

LI 

Letter, lowercase  

Lt 

Letter, title case  

Lm 

Letter, modifier 

Lo 

Letter, other 

L 

Letter, all  

Mn

Mark, non-spacing combining

Mc  

Mark, spacing combining 

Me 

Mark, enclosing combining 

M  

Mark, all diacritic  

Nd

Number, decimal digit 

Nl

Number, letter-like

No 

Number, other 

N  

Number, all 

Pc  

Punctuation, connector 

Pd  

Punctuation, dash 

Ps 

Punctuation, opening mark 

Pe  =

Punctuation, closing mark 

Pi  

Punctuation, initial quote mark 

Pf 

Punctuation, final quote mark

Po 

Punctuation, other 

P 

Punctuation, all 

Sm 

Symbol, math 

Sc 

Symbol, currency 

Sk

Symbol, modifier 

So 

Symbol, other 

S 

Symbol, all 

Zs  

Separator, space 

Zl

Separator, line 

Zp

Separator, paragraph 

Z 

Separator, all 

Cc  

Control code 

Cf

Format control character 

Cs 

Surrogate code point 

Co 

Private-use character 

Cn 

Unassigned 

C 

Control characters, all

For named character set blocks (e.= g., Cyrillic), search for "supported named blocks" in the MSDN  Library

Thursday, April 2, 2026

Turning off Windows spy on your applications and clipboard - Windows TimeLine & Activity History


What Windows Timeline / Activity History? 

Its primary purpose is to store a chronological record of a user's activities on a device, allowing you to "pick up where you left off" across different sessions or even different devices synced to the same Microsoft account. The database tracks "Activities," which Windows defines as specific interactions with applications or content. This includes:

  • Application Usage: Which apps were opened and for how long.
  • File Access: Specific documents, images, or folders you interacted with.
  • Web Browsing: Pages visited (primarily via Microsoft Edge).
  • Cross-Device Syncing: If enabled, it stores data from other Windows devices signed into the same account.

This file lives under:

%LOCALAPPDATA%\ConnectedDevicesPlatform\{GUID}\ActivitiesCache.db

It is the SQLite database used by Windows Timeline & Activity History. You can view the db file using this free tool DB Browser for SQLite (sqlitebrowser.org). It's not encrypted. See below for meaningful query. Windows writes to it whenever:

  • Activity History is enabled

  • Cloud sync is enabled

  • Certain shell events occur (app launches, document usage, etc.)

Even if you never use Timeline, Windows 10/11 still tries to write to it unless the feature is fully disabled. It's hard to turn off.


How to Stop Windows from Writing to ActivitiesCache.db

Here’s the important part: There is no supported registry key that directly disables the database itself. But you can disable every subsystem that feeds it, which effectively stops writes.

Below is the forensically correct way to shut it down.


✅1. Disable Activity History (User Setting)

Go to:

Settings → Privacy → Activity history

Turn off:

  • Store my activity history on this device

  • Send my activity history to Microsoft

Then click Clear activity history.

This stops the user-mode Activity History pipeline.


✅ 2. Disable Activity History via Group Policy (Stronger)

For Windows 10/11 Pro/Enterprise:

gpedit.msc

Navigate to:

Computer Configuration → Administrative Templates → System → OS Policies

Enable:

  • Allow publishing of User ActivitiesDisabled

  • Allow upload of User ActivitiesDisabled

This blocks the Activity Feed service from writing new rows.



✅ 3. Disable Connected Devices Platform (CDP) Services

These services feed the ActivitiesCache pipeline:

  • Connected Devices Platform Service (CDPSvc)

  • Connected Devices Platform User Service_XXXX

  • Clipboard User Service_XXXX

Clipboard User Service Core Functions
  1. Clipboard History: It allows you to store multiple items in your clipboard (accessed via Win + V) instead of just the most recent one.
  2. Cloud Synchronization: It enables the "Sync across devices" feature, allowing you to copy text or images on one PC and paste them onto another linked device.
  3. Data Formatting: It handles the background processing required to ensure that different types of data (plain text, HTML, images) are correctly formatted when pasted into different applications. NOTE: I have test this copying a HTML file to Word document using a Clipboard Spy and all formats appear.
You can disable them:

services.msc

Set both to:

  • Startup type: Disabled

  • Stop the service

⚠️ Note: Some Bluetooth and cross-device features depend on CDP. But for forensic lockdown, this is the most effective method.



You must delete the service in Registry, but it gets recreated under a new random number. Using command line or Task Scheduler gives the "Incorrect Parameter error."


Can You Disable CDPUserSvc via Registry?

Yes — but with caveats. Open WinKey+R -> Regedit

You can disable the template service:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CDPUserSvc
  Start = 4   (Disabled)

However:

  • Windows may still create the per‑user instance key

  • The instance will inherit Start=4 and will not run

  • This is functionally equivalent to disabling it in services.msc

This aligns with guidance that CDPSvc/CDPUserSvc can be disabled if not needed.

NOTE! If you disable the template (Start=4):
  • Windows still creates CDPUserSvc_<RANDOM>

  • But the instance never starts

  • No CDP activity is generated

  • ActivitiesCache.db stops receiving CDP‑originated events

  • The DB may still be created as a placeholder, but remains static

This matches your goal of stopping writes to ActivitiesCache.db.

✅ 4. Block the Scheduled Tasks That Feed It

Disable these tasks:

Task Scheduler → Microsoft → Windows → Shell
  • FamilySafetyMonitor

  • FamilySafetyRefresh

  • ShellExperienceHost

  • Windows Error Reporting → QueueReporting

These tasks generate Activity History events.

✅ 5. Forensic Verification

Since you’re a Windows internals forensic specialist, here’s the deterministic check:

After disabling everything:

  1. Delete or rename the existing DB:

    ActivitiesCache.db → ActivitiesCache.db.disabled
  2. Reboot.

  3. Observe whether a new DB is created.

If all policies + services are disabled, Windows will not recreate the DB. If it does reappear, something is still feeding the pipeline.

What Doesn’t Work

These myths float around, but they do not stop writes:

MethodWhy it fails
Setting file ACL to deny writesWindows retries endlessly; CDP logs errors; DB may be recreated elsewhere
Deleting the DB onlyWindows recreates it immediately
Disabling “Let Windows collect my activities” aloneCDP still writes local events
Registry hacks from old blogsMost are ignored in Win10 1809+


Querying ActivitiesCache.db

You can view the db file using this free tool DB Browser for SQLite (sqlitebrowser.org). It's not encrypted.
SELECT
    Id,
    AppId,
    AppActivityId,
    CASE
        WHEN AppId LIKE 'win32_%' THEN SUBSTR(AppId, 7)
        WHEN AppId LIKE 'Microsoft.Windows.%' THEN 'Windows Store App'
        WHEN AppId LIKE '%exe%' THEN REPLACE(AppId, 'win32_', '')
        ELSE AppId
    END as ApplicationName,
    ActivityType,
    CASE ActivityType
        WHEN 1 THEN 'Application Launch'
        WHEN 2 THEN 'Application Focus'
        WHEN 3 THEN 'Application Close'
        WHEN 4 THEN 'File Open'
        WHEN 5 THEN 'Web Browse'
        ELSE 'Unknown'
    END as ActivityTypeName,
    datetime(StartTime / 10000000 - 62135596800, 'unixepoch', 'localtime') as StartDateTime,
    datetime(EndTime / 10000000 - 62135596800, 'unixepoch', 'localtime') as EndDateTime,
    datetime(LastModifiedTime / 10000000 - 62135596800, 'unixepoch', 'localtime') as LastModified,
    CAST((EndTime - StartTime) / 10000000.0 AS REAL) as DurationSeconds,
    Payload,
    json_extract(Payload, '$.DisplayText') as DisplayName,
    json_extract(Payload, '$.Description') as WindowTitle,
    json_extract(Payload, '$.ContentUri') as FilePath,
    json_extract(Payload, '$.AppInfo.DisplayName') as AppDisplayName,
    "Group",
    MatchId,
    CASE
        WHEN ActivityStatus = 0 THEN 'Active'
        WHEN ActivityStatus = 1 THEN 'Inactive'
        ELSE 'Unknown'
    END as ActivityStatus,
    PlatformDeviceId,
    CreatedInCloud,
    Priority,
    IsLocalOnly,
    UserActionState,
    IsRead
FROM Activity
WHERE ActivityType IN (1, 2, 3, 4, 5)  -- Application related activities
    AND AppId IS NOT NULL
ORDER BY StartTime DESC;

Results

=H��VJZ JY8` [{"application":"{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\VideoLAN\\VLC\\vlc.exe","platform":"windows_win32"},{"application":"{6D809377-6AF0-444B-8957-A3773F02200E}\\VideoLAN\\VLC\\vlc.exe","platform":"windows_win32"},{"application":"{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\VideoLAN\\VLC\\vlc.exe","platform":"packageId"},{"application":"","platform":"alternateId"}] ECB32AF3-1440-4086-94E3-5311F97F89C4 [{"application":"{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\VideoLAN\\VLC\\vlc.exe","platform":"windows_win32"},{"application":"{6D809377-6AF0-444B-8957-A3773F02200E}\\VideoLAN\\VLC\\vlc.exe","platform":"windows_win32"},{"application":"{7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\\VideoLAN\\VLC\\vlc.exe","platform":"packageId"},{"application":"","platform":"alternateId"}] 5 Web Browse 0000-12-31 19:02:57 0000-12-31 19:00:00 0000-12-31 19:02:57 -177.4757047 {"displayText":"VLC media player","activationUri":"ms-shellactivity:","appDisplayName":"VLC media player","backgroundColor":"black"} Unknown tdHHca9QssN0pKMtrZhm/e99sW2pw/4ggLkB7aOlFFE= 0 3 0 0 0





Wednesday, April 1, 2026

Google Cloud Phishing Email with subject RE: Your cloud storage is full. Act now or lose everything


For the record, this is a Google Cloud 
phishing email attempt that is recently going around, with subject RE: Your cloud storage is full. Act now or lose everything

What to do?  
Report them, goto bottom of page. 


From: Cloud Account deletion notification <atamaria.ibwza@manageeye1234.tigergeneratorth.com>

Subject: RE: Your cloud storage is full. Act now or lose everything



Google Cloud Notification Center

Dear User,

We have detected that your Google Cloud Storage service requires action to prevent the permanent loss of your digital content.

Risk of Personal Content Deletion Your storage plan expires today. Renew it to keep your data safe.

Google Cloud Storage automatically syncs photos, videos, personal files, and work documents across all devices linked to your Google account.

ACCOUNT DETAILS

Account Number3333334444
Active PlanGoogle Cloud Storage
Valid UntilTODAY

Without renewal, synchronization will be automatically disabled, and recovery of your stored content will no longer be possible.

[Upgrade Google Cloud Storage] (blue button)

Automated Message: This notification was generated by the system. Replies to this address are not possible.







PHISHING LINKs;

1. http://xn--h2t5rh2t5rh2t5r-hqb4x77c.mozinfo.com/xxx...


How to tell this is a Phishing email?

  1. Check email address in full, if it's not from originating company then it's phishing.
  2. Hover over all links in email, if it's not from the company's website then forget it.
  3. The best way is to 

How to examine Email Message Source?

Now let's look at message source
  1. Outlook.com->Actions->View Message Source. 
  2. Gmail.com->More (down arrow to top right)->Show original.
Check for suspicious links, anything that does not originate from source domain, like apple.com.


Report Phishing Email (not as Spam)

  1. Outlook.com->Junk (at Top)->Phishing Scam
  2. Gmail.com->More (down-arrow to top right)->Report Phishing 

Report Phishing to Google

If you have received this email, take further action by

  1. https://www.google.com/safebrowsing/report_phish/

Report phishing at Microsoft and government agencies

  1. http://www.microsoft.com/security/online-privacy/phishing-faq.aspx