Collaborate Disseminate
Here I have a malware sample that calls RegQueryValueEx quite frequently, without any time interruption. And as we can see, the result is quite often "BUFFER OVERFLOW". In another topic I read that this means that the allocated b… Continue reading Very frequent calls to same Windows API function by malware
There is a homebrew registry patch going around which adds a 1600×900 display setting to the new ROG Ally Handheld PC.
The registry edit:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d3… Continue reading Win 11 Registry Edit – Verification/Translators? [migrated]
This guide shows you how to fix the Error deleting Values, Unable to delete all specified values error message while deleting a key using Registry Editor. Why can’t I delete a key from Registry Editor? If you cannot delete a key in Registry Edito… Continue reading Unable to delete all specified values in REGEDIT
This post will show you how to enable or disable AutoEndTasks in Windows 11/10. If the AutoEndTasks is turned on or enabled, Windows automatically closes an unresponsive program or app while shutting down, restarting, or signing out without waiting for… Continue reading How to Enable or Disable AutoEndTasks in Windows 11/10
I have a disk image divided in 4 files, image.E01, image.E02, image.E03 and image.E04. I created a case in autopsy and I’m trying to recover the Product ID and the Product Key.
The product ID I already found it in the Operating System Info… Continue reading How can I get the Product Key with Autopsy or FTK viewer? [closed]
Imagine a country ruled by a non-democratic government with an explicit disregard to local and international laws. The national registry for local domains (Country code top-level domains) falls under their area of influence. We know that t… Continue reading Country code top-level domain (ccTLD) hijacking?
Device Guard and Secured-core PC configurations are mostly located in this registry location:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceGuard
so, all in HKEY_LOCAL_MACHINE\SYSTEM
Now I’m trying to find the registry keys of… Continue reading Why is this Device Guard setting located in a different location from the rest? [migrated]
After reading some of the various open reports regarding how malware or threat actors were “using” the Registry, manipulating it to meet their needs, I wanted to take a look and see what the effects or impacts of these actions might “look like” from a … Continue reading Testing Registry Modification Scenarios
If Local Group Policy Editor is not creating or updating Registry keys or values in Windows 11 or Windows 10 computers, you can follow these suggestions to troubleshoot this issue. Although Group Policy updates the key and value automatically in the Re… Continue reading Fix Group Policy is not creating or updating Registry keys
I tried to dump the Windows password hashes from the SAM file decrypted using the key contained in the SYSTEM file (both located under C:\Windows\System32\config) or obtained from the HKEY_LOCAL_MACHINE registry entry, using samdump2.
In b… Continue reading Modern Windows password hash location – ex SAM and SYSTEM files [duplicate]