Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [registry]

The Microsoft Windows Registry is a database for storing settings and data for the Microsoft Windows operating system and Windows applications.

1
vote
1answer
111 views

How are malware able to start on boot on windows without administrator rights? [closed]

I know that a malware could create a new Run registry key to make itself start at boot, but an user could simply remove the registry key and reboot and that would stop the virus, but this is usually ...
0
votes
0answers
14 views

Windows registry subkey creation not generating logs (Windows event ID 4657) [migrated]

I am experiencing an issue where I am trying to audit a specific registry key via Windows Event ID 4657. TL; DR: I have tried to setup auditing on a registry key when a new subkey is created under it,...
1
vote
0answers
50 views

Is there any key in HKEY_CURRENT_USER which sad when user was login on pc?

Try to find information about user login time. Has no any events for searched time saved in windows security events. Thing that maybe registry can help me for that. Is there any key in ...
0
votes
1answer
80 views

What tools can recover or do forensic analysis on deleted registry entry?

I'm reading this article, in the Deleted Recovery Example it has the following picture, Figure 8 shows an example of a data recovery error by a popular registry forensics tool I have two questions ...
0
votes
1answer
868 views

How can I remove Sticky Keys Exploit via cmd? [closed]

Recently, on my Windows 8.1 VM, I added a "Sticky Keys" exploit because I forgot my password. Now, I wish to remove it via cmd. This is what I imputed: REG DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\...
-1
votes
1answer
312 views

How to read command line argument for potential issue

I have a IOC that has a command line argument that looks like this below. Wanted to see if someone could help me parse it out a little bit to understand what is happening. C:\Windows\System32\mshta....
0
votes
1answer
62 views

Windows registry debug

is there any way to monitor, debug changes made by a installation to the OS registry ? I'm aware of Process Monitor but I look for something that I can enable and that will run in the background. ...
1
vote
1answer
906 views

Help with viewing hidden registry entries

Like the title says, I need help with viewing hidden registry entries that are not normally accessible through the default windows regedit. To start off, my friends son tried downloading a free game ...