So now the voting machine has rebooted and restarted.
So you can give a user name if you want
and click on next.
And I'm going to leave the password blank.
And yes, you keep your product key and then check this one will not activate and then click next,
if you don't have the product, you can just skip and do it later.
So in this case here, we just skip me just now and just click.
Skip and hear, click on Ask me later.
And here you can set your time zone if you want and click on next.
And anything we do here.
Just the whole.
Now you can install your gas addition CD, so go up to the device here and he said Desolations CD.
Next, open your computer, go to your computer and your gas CDs here, so double click on this to install.
And select the proper one for your system, which is X eighty six, so that will clean this one.
Yes, to run it.
Next, a Kleenex.
So the puppies over here program Philco.
A picnic's.
And check on this inbox and clicking on.
And then click on reboot, now they finish.
So you really put your machine.
Now you can go to full screen, you click on The View full screen.
If your washing machine cannot go to full screen, then shut it down and then come down here selected
click on settings.
And then over here, Saturday display and increases to one to eight.
The maximum and then here and you will see the acceleration and he OK.
And then typing in.
Now you can go to full screen mode.
There you have it, if you want to restore back to Windows, we don't just move your closer to the bottom
of the screen and holy day and this bar will pop up and just click on this icon.
Next thing you want to do is set up the shareholder, so to create a check for the first, you go to
your seed, right?
And then create a new home to renegotiate our Emmy or any other name you prefer, and then you here.
So like the witch machine and then clean settings and the and the chef for this one here at New SHEFFLER.
And if the to select their.
And going to see Father, which you created a photo which you created this one click on Select for the.
So Halterman and click on Make Permanent.
OK.
OK, again, and now go back here.
Click on the file explorer and you should be able to see for the map as a zip drive.
So this is where you can share files between your house and your guest operating system.
So whatever you put in here will also be available in your host and vice versa.
So now the next item is to disable windows.
Disable windows have the.
So to disable the Windows update.
Search for Abdeh and click on the results of the.
And here, let me choose my settings.
So that option, never check for this and then, OK.
Because of this, who detect new viruses and so on, so you're doing your windows to detect the virus
when you doing analysis.
So the next item will be disable windows defender, so to disable Windows Defender, who here?
You search for services that masc click on services, witness, defender, Windows Antivirus.
If you don't disable it, he will prevent you from analyzing malware.
So scroll down and look for Windows Defender.
He's going right, click on it and select properties.
And a woman is set to automatic, so we change it to disable, click, stop, stop the service and apply.
OK, so now you check with the defender disable.
The next thing you want is to disable the extension's.
So open your file, explorer, open any directory and they're here.
Organizers have all the options so they can view and then down here, schoolgoing.
And check this box extension for nonvolatile.
So this one is disabled tension, sure, he didn't file for.
So look for changes to anybody.
They showed it in the file folder.
So now you these two settings, you'll be able to see the file extensions basically apply.
OK, so now if you go to any folder, the file extension will be visible.
You can see how visible this is important because sometimes a mask is too tight.
It could be a foul and you could see and because then you thought a -- is a common trick and
also hidden, false and not invisible.
You want to see hidden files because somehow they put themself make a copy of his having some hidden
file location.
And if it's not disabled, you baby, he won't be able to see the hidden files.
Next is to disable SLR, which stands for address space layout randomisation is a security feature that
randomisation memory addresses used by executable code, including details so that NBC had to analyze
binary files.
So you want to disable that.
So it makes it easy for us to analyze the binary files of the malware.
So to do that, to disable it, we open a program called Registry EDIT.
And then we go to this location.
Hish go and look a machine, so the registry's where Venus gives all these configurations, so just
open this and look for.
Corine.
The system.
And then look for current control set, current control set.
And they look for control.
Noufal session manager.
And then two for memory management, memory management, click on it and you say here we must add a
new key.
So just right click here and I knew and the Kemistry to be fairly.
You and give you the name of more images, the default is zero.
So that is why we want to this tells me there was not two more images and we start to move the process
when it's loaded into memory.
Let me give you Sarteano specify entry point when the programmer loyalty program.
So I see.
So this disable.
So now you need to restart, reboot your computer to have this take effect.
The next thing is disable Windows firewall.
So right.
Click here.
Such for Windows firewall or just like firewall.
And so, like this one, we know the firewall.
The reason is because if you want to analyze malware, malware typically will call a control and command
center and try to connect to a server on the Internet.
And we want to know where it goes.
So you disable Duniya then?
We know Steve King of Iowa of.
And here, select enough for both, OK?
Can you confirm that, Istana?
Next thing you want is snapshot, so to create a snapshot, you can go down to the bottom of your mouth
here and go to your kitchen.
So just hold your mouse.
Head the bottom here, select a machine, take a snapshot.
And here you can see the if you want to go to one, for example, and mount.
And the D and C fresh.
And you hear some description
configured click, OK, and you create a snapshot of the state of the machine.
If you want to restore, you have to shut this down first.
Shut down.
So after shutting down, you can see over here there is a list of all these snapshots, so clearly this
is a snapshot, fresh install, and he changed.
If you want to revert back to freshly histologies selected and he restore and make sure you can check
this and clean restore.
And he goes back to the previous state, as you can see from my earlier machines, some of my machines
has multiple snapshots.
And if I wanted to go back to an earlier snapshot, all I have to do is select the earliest snapshot,
clean restore.
So this is useful form of analysis, because every time you run a mile away, it will corrupt your files
and redistricting and other things, and you always want to restore back to the previous state before
the game was executed.
And this is the workflow for every malware analysis section.
And remember to take a snapshot before you execute any malware and restore it back when you had finished.
That's all for us.
And thank you for watching.