decrypting…# Windows Registry Keys #CS #logs #edr ### System info and accounts | Registry keys | Description | | -------------------- | -------------------- | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\ComputerName | contains information about the computer name and domain membership | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\TimeZoneInformation | contains information about the time zone settings on the system | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management | contains information about memory management settings on the system | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment | contains environment variables that are set on the system | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList | contains information about the user profiles that are configured on the system | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows | contains information about the system's graphical user interface (GUI) settings, including the desktop background and screen saver | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes | contains information about font substitutions on the system | | SAM\Domains\Account\Users | SAM hive and user information | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System | contains information about system policies that are enforced on the system | ### Software, services and program's | Registry keys | Description | | -------------------- | -------------------- | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services | contains information about the services that are installed on the system | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run | contains a list of programs that are automatically started when the system boots up | | USER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist\{GUID}\Count | - information about the programs launched <br> - the time of their launch, and the number of times they were executed <br> - programs that were run using the command line can't be found in the User Assist keys <br> - amount of time a process is in focus | | SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache | stores file name, file size, and last modified time of the executables | | + SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID} <br> + SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID} | saves the full path of the executed programs | | C:\Windows\AppCompat\Programs\Amcache.hve | - Amcache Hive : save information on programs that were recently run <br> - This data includes execution path, installation, execution and deletion times, and SHA1 hashes of the executed programs | | NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run <br> NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce <br> SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce <br> SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run <br> SOFTWARE\Microsoft\Windows\CurrentVersion\Run | Autostart Programs (Autoruns) | | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU | Run command history | ### Network, Share and Backups | Registry keys | Description | | -------------------- | -------------------- | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters | contains information about the system's TCP/IP settings, such as the IP address and subnet mask | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings | contains information about the system's Internet settings, including the browser history and cookies | | HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces | settings for IP Address | | - SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged <br> - SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed | Past Networks | | SYSTEM\CurrentControlSet\Services\LanmanServer\Shares | Windows shares | | \Software\Microsoft\Windows NT\CurrentVersion\NetworkList | VPN Connection | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters | contains information about the system's Winsock settings, which are used for network communication | | - C:\Windows\System32\Config\RegBack <br> - directory every ten days. registry keys might have been deleted/modified recently | Backups - RegBack | ### Hardware, printers and External/USB device | Registry keys | Description | | -------------------- | -------------------- | | HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum | contains information about hardware devices that are installed on the system | | _LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR | This key contains information about the external devices that have been connected to the system, including the manufacturer, model, and serial number | | _LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB | This key contains information about the USB controllers and hubs on the system, as well as the devices connected to them | | _LOCAL_MACHINE\SYSTEM\MountedDevices | This key contains information about the mounted volumes on the system, including external USB devices | It can be used to determine the drive letter assigned to a particular device | | _CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 | This key contains information about the mounted volumes on the system, including external USB devices | It can be used to determine the drive letter assigned to a particular device | | _CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU | This key contains information about the most recently accessed files and folders on external USB devices | It can be used to determine what files were accessed and when | | _CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\USBStor | This key contains information about external USB devices that have been connected to the system, including the device ID, the drive letter, and the last time the device was connected | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 | contains information about audio drivers on the system | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers | contains information about installed printers on the system | ### Files and Folders | Registry keys | Description | | -------------------- | -------------------- | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders | contains information about the locations of various system folders, such as the desktop and the Start menu | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs | contains information about recently opened documents | | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer | contains information about Explorer policies that are enforced on the system | | - NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths <br> - NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery | Windows Explorer Address/Search Bars | | -NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU <br> - NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU | Open/Save and LastVisited Dialog MRUs | | - NTUSER.DAT\Software\Microsoft\Office\VERSION <br> - NTUSER.DAT\Software\Microsoft\Office\VERSION\UserMRU\LiveID_####\FileMRU | Office Recent Files |