Questions tagged [registry]
The Microsoft Windows Registry is a database for storing settings and data for the Microsoft Windows operating system and Windows applications.
20
questions
1
vote
2
answers
126
views
Country code top-level domain (ccTLD) hijacking?
Imagine a country ruled by a non-democratic government with an explicit disregard to local and international laws. The national registry for local domains (Country code top-level domains) falls under ...
- 11
0
votes
1
answer
888
views
Is there a way to get Windows login password hint from SAM hive with volatility?
We know that every user in Windows has a password hint. This password hint is stored in the SAM hive, more specifically in the SAM\Domains\Account\Users path. Is there a way to extract this password ...
- 23
0
votes
0
answers
1k
views
Strange Chinese Characters in Registry [duplicate]
I was just taking a look at my registry editor when I noticed some strange folders in the bottom of the HKEY_CLASSES_ROOT section. These folders are named 칞ꊟጀ耀 (No translation), 縀䆁 (No Translation, ...
user274528
1
vote
4
answers
299
views
Is doc file really modifying registry in Windows?
Been given a .docx file to check whether it has a virus or something, ran McAfee and SuperAntiSpyware on it and results came back negative so I though it was good and proceeded to open it, just a file ...
- 11
0
votes
0
answers
114
views
Secure Registry Keys
Is it possible to restrict access to the registry keys, just like Microsoft does on some of the keys(ex. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend)?
I was able to get a similar ...
0
votes
1
answer
390
views
How do I stop local users from bypassing the UAC on Windows 10?
I'm the admin for a Windows 10 machine with a few local users. While I understand there are other ways to bypass security with access to the physical machine, I'd like to protect against hacks that ...
- 304
1
vote
0
answers
111
views
Is the ability to export HKEY_LOCAL_MACHINE\SAM and HKEY_LOCAL_MACHINE\SYSTEM as .reg files a security concern?
I am concerned that if it is possible to copy these as .reg files (without privs) and then (on another machine) reverse the .hiv files from them... this would probably be bad, which makes me think it'...
- 93
4
votes
2
answers
2k
views
Does this registry entry for implementing custom protocol handlers in Windows present a security risk?
Background
Some features are not yet available on the web platform and thus require cooperation with a native application in order to provide them. One method for a web application and a native ...
- 432
4
votes
0
answers
726
views
Korean/Chinese glyphs in registry key
I'm seeing a strange key HKEY_CLASSES_ROOT\핵樦Ḁ耀 in my registry.
I've seen a few issues like this (here and here) that relate to a UTF-16 <-> ASCII encoding bug, and I've tried translating ...
- 141
1
vote
1
answer
2k
views
How to disable/block Microsoft Store on Windows 10 Pro by firewall?
I want to block Microsoft Store on Windows 10 pro in a corporate environment. Having read relevant articles about this matter and tested on my machine, I see that Windows 10 Pro does not support this ...
- 123
0
votes
0
answers
726
views
Powershell (WinRM) and cmd.exe: reg query output deviation
during a CTF I encountered the following anomaly regarding PS & cmd.exe:
I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
- 11
0
votes
0
answers
342
views
Interpreting a Registry value of hashed password
I have been given a forensics challenge that contains a SYSTEM and SAM registry files as well as a wordlist.
When using hivexsh (a registry analysis tool) I need to find the password (which I belive ...
1
vote
1
answer
190
views
What does "windows_view" attribute of registry object in OVAL?
I've seen somewhere that in 32-bit and 64-bit Windows registry structure is different so you need to use flag windows_view="32_bit" in registry object behaviors tag. But i forgot about it and tested ...
- 139
1
vote
1
answer
371
views
How are malware able to start on boot on windows without administrator rights? [closed]
I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
- 55
1
vote
0
answers
111
views
Is there any key in HKEY_CURRENT_USER which sad when user was login on pc?
Try to find information about user login time. Has no any events for searched time saved in windows security events. Thing that maybe registry can help me for that.
Is there any key in ...
- 121
1
vote
1
answer
549
views
What tools can recover or do forensic analysis on deleted registry entry?
I'm reading this article, in the Deleted Recovery Example it has the following picture, Figure 8 shows an example of a data recovery error by a popular registry forensics tool
I have two questions
...
- 2,057
0
votes
1
answer
3k
views
How can I remove Sticky Keys Exploit via cmd? [closed]
Recently, on my Windows 8.1 VM, I added a "Sticky Keys" exploit because I forgot my password. Now, I wish to remove it via cmd. This is what I imputed:
REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\...
-1
votes
1
answer
487
views
How to read command line argument for potential issue
I have a IOC that has a command line argument that looks like this below. Wanted to see if someone could help me parse it out a little bit to understand what is happening.
C:\Windows\System32\mshta....
0
votes
1
answer
204
views
Windows registry debug
Is there any way to monitor/debug changes made by an installation to the OS registry? I'm aware of Process Monitor but I look for something that I can
run in the background.
- 1,558
1
vote
1
answer
2k
views
Help with viewing hidden registry entries
Like the title says, I need help with viewing hidden registry entries that are not normally accessible through the default windows regedit.
To start off, my friends son tried downloading a free game ...
- 21