So now in the Putin machine has reboot it and restarted.
So you can gain a user name if you want
and click on next.
And I'm going to leave the bus with some blank.
And yes, A, you keep your product key in there.
And check this one.
No, not active.
And then click next.
If you don't have any Perrucci, you can skip and do it later.
So in this case here, we just skip this now and just click.
Skip and then here click on Ask Me later.
And here you can set your time zone if you want.
You can click on the next.
And musically, anything we do here.
Just the whole neighborhood.
Now you can install your guests issue CD to go up to the device here, and he said, guess Hadysh and
CD.
Next, open your computer and go to your computer and you get radiation CDs here.
So double click on this to install.
And select the proper one for your system, which is actually eighty six.
So double click this one, click yes to run it next and click next.
So Buffy's over here program Followill.
A Kleenex.
And check on these inbox and click install.
And then click on reboot, now they finish, so you reboot the machine.
Now you can go to full screen, you click on The View for screen.
If your voting machine cannot go the full screen, then shut it down and then come down here.
Selected click on settings.
And then over here, salay display and increases to one, two, eight.
OK, yeah, maximum.
And then here, any 3D acceleration and hit, OK?
Yeah.
And then started again.
Now you can go to full screen mode.
And there you have it, if you want to restore back to windows, not just move your closer to the bottom
of the screen and who day.
And this bar will pop up and just click on this icon.
Next to you and do we set up the shared folder so you can create a share for the first you go to your
S.J.
And then create a new fuda who we negotiate, our eimi or any other name you prefer.
And then in here.
Selling The Witcher Machine and Epling settings.
And and the check for this one here at New Qet Fuda.
And if only to select other.
And going to see far, which you created a folder which you created this one click on select folder.
So like Automan and click on Make Permanent.
Click, OK, click OK again.
And now go back here.
Click on the file Explorer and you should be able to see or share for the memories as you drive.
So this is where you can share files between your house and your guest operating system.
So whatever you put in here will also be a in your host and vice versa.
So now the next item is to disable windows.
You say, well, we know Sandy.
So to disable Windows beat.
Search for Hamdy and click on the results.
We got.
And here, let me choose my settings.
Select option, never find it and then click OK.
Because those who detect new viruses and so on, so you don't want your windows to detect the virus
or any idea analysis.
So the next item will be disable Windows Defender, so to disable the just defender over here.
You search for services, a mercy, click on services.
We to defend these Windows antivirus.
If you don't discipline, he will prevent you from analyzing Malaby.
So scroll down and look for what we know so finger.
Yeah, so I Reichling Union and select properties.
At the moment, if is set to automatic, so we change it to December, please stop this.
Stop the service and play.
OK, so now you can be the defender disable.
The next thing you want is to disable the Hynix extensions.
So open your flight explorer, open any directory and that here.
Said all options, said I can view and then downhere school going.
And check these folks out, an extension for nonfat ice.
So this one is disable hypertension.
Sure, he didn't find food.
So look for changes to any bill they show you didn't find food.
So now you these two settings, you'll be able to see the file extensions click apply.
OK, so now if you go to any folder.
Yeah, file extension, you'll be visible.
You can see the ICR invisible.
This is important because Malaby sometimes muskies true time.
It could be a file and even put PDF dicy.
And because there is hidden you thought you said a --.
He said commentary and also hidden files and not invisible.
You only see hidden files because some malware Putin himself may a copy of examine some hidden file
location.
And if he's not to disable you, Beeble, he won't be able to see the Naheed in files.
Next is to disable ESR, which stands for address space layout.
Randomisation is a security feature that randomisation Mimmi addresses used by executable code, including
Dal's, so that NBC had enough to analyze binary files.
So you want to disable that.
So it makes it easy for us to analyze binary files of the email.
So to do that, to disable the open program called Registry Edit.
And then we go to this location.
Hishe, key and looking machine, so there are industries where Windows gives all these configurations.
So, yes, open this and look for.
Karen?
The system.
And then look for current control set, current controls set.
And you look for control.
Look for a session manager.
And then the for memory management, memory management take on it and you say here we must act in new
key.
So just right click here and I knew and the key name is that it would be value.
And give it a name of more immediacy.
A default is zero.
So that is why we won.
So this tells me he not to move images.
It means not to move the process.
I mean, it's loaded into memory by men.
Give his origin no specified entry point.
And many programmer wrote he program.
So that's it.
So this this will disable.
So now you need to restart, reboot your computer to have this take effect.
The next thing is disable Windows Firewall.
So right click here.
Search for Windows Firewall or just type firewall.
And so, like this one window is even the firewall.
The reason is because if you want to analyze malware, malware typically will call the controller and
command center code and try to connect to a server on the Internet.
And you want to know where it goes.
So you say do not turn Windows Defender firewall an off.
And here, select enough from both click OK.
He confirmed at least enough.
Next on News Courier Snapshot.
So to create a snapshot, you can go down to the bottom, hold your mouse here and go to a machine.
So just hold a mouse head in bottom here.
Select machine, take snapshot.
And here you can see to if you want to do one, for example, in the month.
And the day and see fresh install in the hear some description
configured, click OK, and even create a snapshot of the state of the machine.
If you want to restore, you have to be shaadi start first.
Shut down.
So after shutting down, you can see over here there is a list of all of these snapshots.
So currently this is the official fresh install and he notices has changed.
If you want to revert back to fresh, you start to select it and restore any issue.
You uncheck this anklet and restore any respect to the previous state.
As you can see from my earlier machines, so my machines has got multiple snapshots.
And if I wanted to go back to an earlier snapshot, all I have to do is select the earlier snapshot,
clean restore.
So this is useful for analysts because every time you run the malware evil, corrupt your and registry
and and other things, and you always want to restore back to the previous state and before the game
was executed.
And this is a workflow for every email that analyzes session and his remember to take a snapshot before
you execute any m.v and restore it back when you had finished.
That's awful.
And just saying thank you for watching.