Hello.
In this lecture, we're going to do the registry analysis with the previously infected Windows image
virtual memory here.
So information, information about every user setting program and the Windows operating system itself
can be found within the registry.
Even hashed passwords can be found in the registry, in the Windows Registry analysis.
And we're going to use the two two plugins for using this HIVE scan in in next lectures.
We're going to do more detailed and like advanced registry analysis here.
But it's just an this is not this is just an intermediate level of registry analysis.
The first plugin we're going to use the hive scan and second is the hive list.
So let's start with hive scan here, Enter.
And yeah, also I want to notify that you have to.
Specify the profile of nowhere.
No, no, no, no, no, no.
Here.
I've scan.
Okay.
So this is the output and the numbers are presented here.
Location of hives on the hard disk so we can find more information on the register, more information
about registry in Wikipedia here.
Let's look look at details here.
Windows Registry.
Wikipedia here and yeah, it can tell us some examples here.
Yeah.
As you can see, this is the list of standard standard register values and here are the valid registries.
Belongs to what and what is inside them.
For example, in our local machine we have aggregated local machine store settings that are specific
to the local computer.
We have users contains sub keys correspond to the for each user profile actively loaded on the machine
thought users.
Hives are usually only loaded for currently logged in users.
So now I'm going to open the windows here and change the windows while we're going to.
We are searching about this information in registry here.
So let's open open the windows here.
Yeah.
While Windows is opening, I'm going to are we going to read more here?
We also have performance data.
Current user, as the name suggests, is stores, the settings that are specific to the currently logged
in users.
There are more examples here.
Register is just a big file that contains windows.
Settings and other information about the system.
So let's change our change here.
Let's make yeah.
Windows here.
Yeah.
Create.
And.
Yeah.
That's for sure.
It's gonna work.
Okay, Perfect.
Let's make the screen bigger here.
Yeah.
Can you see it?
Yeah, you can see it.
Okay, let's open our windows here.
And here this is the our Windows machine for our learning purposes.
Now we can open the registry and just then look at the registry, what these files are, what those
parameters are in order to open the registry.
You just enter the regedit here.
If you if you are using older Windows versions or if you write here rec here and it doesn't show anything,
you can regedit.exe here or MSI here you can.
It's the same actually.
Yeah.
And click yes.
And here, as you can see, this is our registry editor program in Windows.
So let's improve.
Let's increase the font size a bit.
And that's, you know, it's too much here even for the lecture.
Yes.
Uh, 14 is okay.
And as you can see here, there we have the.
Here information settings parameters.
Here, for example, shows the what AVI files opens by default.
For example.
Here.
As you can see here.
Here.
So.
Now we're going to learn more in.
Learn more about registry in next lectures.
But for now, we're going to just analyze it and look the plugins that we're going to use with the.
Uh, volatility framework.
So.
This is the Hives hive list of hive scan of registries here and print it out so I can later I can share
it with you on the attachments section of this lecture.
And last we have hive list.
So for more, this is the this is for more detailed information on registry hives and location within
the RAM.
So the hive list plugin can be used here.
The Hive list plugin here command shows the details of virtual and physical address with more easily
readable plaintext.
So as its name suggests, you can't read anything from it.
Like you, you can't get details from it if you are not advanced forensics and analytics here.
But with this here, you can get the directories of the registry files here as here.
Mhm.
Okay.
So more information on the registry can be found in the official Microsoft registry here named Docs.microsoft.com.
Uh, and us Windows win 32.
Sysinfo and registry.
Has.
Highs.
And as you can see, there is a more information about the registry hives.
And as you can see in in previously we we see.
We serve the we serve the here.
Okay, let's.
Okay.
So do you use explains what is like folder like icons means.
So for example, the current config means the system files and supported files.
Local machine samsam dot save.
This is the local machine security here and other information can be found here and the Microsoft's
official.
Website.