Questions tagged [registry]

The Microsoft Windows Registry is a database for storing settings and data for the Microsoft Windows operating system and Windows applications.

Filter by
Sorted by
Tagged with
0 votes
0 answers
106 views

Strange Chinese Characters in Registry [duplicate]

I was just taking a look at my registry editor when I noticed some strange folders in the bottom of the HKEY_CLASSES_ROOT section. These folders are named 칞ꊟጀ耀 (No translation), 縀䆁 (No Translation, ...
user avatar
1 vote
4 answers
131 views

Is doc file really modifying registry in Windows?

Been given a .docx file to check whether it has a virus or something, ran McAfee and SuperAntiSpyware on it and results came back negative so I though it was good and proceeded to open it, just a file ...
user avatar
0 votes
0 answers
99 views

Secure Registry Keys

Is it possible to restrict access to the registry keys, just like Microsoft does on some of the keys(ex. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WinDefend)? I was able to get a similar ...
user avatar
0 votes
1 answer
174 views

How do I stop local users from bypassing the UAC on Windows 10?

I'm the admin for a Windows 10 machine with a few local users. While I understand there are other ways to bypass security with access to the physical machine, I'd like to protect against hacks that ...
user avatar
  • 305
0 votes
0 answers
53 views

AppCertDLLs does not work in GUI apps, why?

I was trying to automatically inject a dll to every process (including GUI) whenever it is started by a user . My DLL hooks DoDragDrop method of winapi and communicates with server to decide allow or ...
user avatar
1 vote
0 answers
88 views

Is the ability to export HKEY_LOCAL_MACHINE\SAM and HKEY_LOCAL_MACHINE\SYSTEM as .reg files a security concern?

I am concerned that if it is possible to copy these as .reg files (without privs) and then (on another machine) reverse the .hiv files from them... this would probably be bad, which makes me think it'...
user avatar
4 votes
2 answers
1k views

Does this registry entry for implementing custom protocol handlers in Windows present a security risk?

Background Some features are not yet available on the web platform and thus require cooperation with a native application in order to provide them. One method for a web application and a native ...
user avatar
3 votes
0 answers
392 views

Korean/Chinese glyphs in registry key

I'm seeing a strange key HKEY_CLASSES_ROOT\핵樦Ḁ耀 in my registry. I've seen a few issues like this (here and here) that relate to a UTF-16 <-> ASCII encoding bug, and I've tried translating ...
user avatar
  • 131
1 vote
1 answer
1k views

How to disable/block Microsoft Store on Windows 10 Pro by firewall?

I want to block Microsoft Store on Windows 10 pro in a corporate environment. Having read relevant articles about this matter and tested on my machine, I see that Windows 10 Pro does not support this ...
user avatar
  • 103
0 votes
0 answers
605 views

Powershell (WinRM) and cmd.exe: reg query output deviation

during a CTF I encountered the following anomaly regarding PS & cmd.exe: I got access to a Windows x86 server through WinRM Port 5985 using evil-winrm. (https://github.com/Hackplayers/evil-winrm) ...
user avatar
0 votes
0 answers
270 views

Interpreting a Registry value of hashed password

I have been given a forensics challenge that contains a SYSTEM and SAM registry files as well as a wordlist. When using hivexsh (a registry analysis tool) I need to find the password (which I belive ...
user avatar
1 vote
1 answer
137 views

What does "windows_view" attribute of registry object in OVAL?

I've seen somewhere that in 32-bit and 64-bit Windows registry structure is different so you need to use flag windows_view="32_bit" in registry object behaviors tag. But i forgot about it and tested ...
user avatar
1 vote
1 answer
330 views

How are malware able to start on boot on windows without administrator rights? [closed]

I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
user avatar
  • 55
1 vote
0 answers
94 views

Is there any key in HKEY_CURRENT_USER which sad when user was login on pc?

Try to find information about user login time. Has no any events for searched time saved in windows security events. Thing that maybe registry can help me for that. Is there any key in ...
user avatar
  • 121
1 vote
1 answer
383 views

What tools can recover or do forensic analysis on deleted registry entry?

I'm reading this article, in the Deleted Recovery Example it has the following picture, Figure 8 shows an example of a data recovery error by a popular registry forensics tool I have two questions ...
user avatar
  • 1,695
0 votes
1 answer
2k views

How can I remove Sticky Keys Exploit via cmd? [closed]

Recently, on my Windows 8.1 VM, I added a "Sticky Keys" exploit because I forgot my password. Now, I wish to remove it via cmd. This is what I imputed: REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\...
user avatar
-1 votes
1 answer
465 views

How to read command line argument for potential issue

I have a IOC that has a command line argument that looks like this below. Wanted to see if someone could help me parse it out a little bit to understand what is happening. C:\Windows\System32\mshta....
user avatar
0 votes
1 answer
169 views

Windows registry debug

Is there any way to monitor/debug changes made by an installation to the OS registry? I'm aware of Process Monitor but I look for something that I can run in the background.
user avatar
  • 1,498
1 vote
1 answer
2k views

Help with viewing hidden registry entries

Like the title says, I need help with viewing hidden registry entries that are not normally accessible through the default windows regedit. To start off, my friends son tried downloading a free game ...
user avatar