Especialización Seguridad Informatica – 2021

Análisis del Registro de Windows

Definir cada línea del registro de Windows de su máquina que significa y para
qué sirve;
Table Registry Paths and Corresponding Files

Registry Path File Path

HKEY_LOCAL_MACHINE\System %WINDIR%\system32\config\System
HKEY_LOCAL_MACHINE\SAM %WINDIR%\system32\config\Sam
HKEY_LOCAL_MACHINE\Security %WINDIR%\system32\config\Security
HKEY_LOCAL_MACHINE\Software %WINDIR%\system32\config\
Software
HKEY_LOCAL_MACHINE\Hardware Volatile hive
HKEY_LOCAL_MACHINE\System\ Volatile hive
Clone
HKEY_USERS\User SID User profile (NTUSER.DAT);
“Documents and Settings\User(changed to “Users\User” on Vista)
HKEY_USERS\.Default %WINDIR%\system32\config\default

SYSTEM\CurrentControlSet\Control\ComputerName\ActiveComputerName

SYSTEM\ControlSet00x\Control\Windows

SOFTWARE\Microsoft\Windows NT\CurrentVersion

SYSTEM\CurrentControlSet\Control\TimeZoneInformation

SYSTEM\CurrentControlSet\Services\lanmanserver\Shares

$$$PROTO.HIV\ControlSet001\Services\lanmanserver\Shares
LastWrite time: Fri Aug 20 15:19:35 2004 (UTC)

SYSTEM\CurrentControlSet\Services\lanmanserver\parameters

SECURITY\Policy\PolAdtEv

SOFTWARE\Microsoft\WZCSVC\Parameters\Interfaces\{GUID}

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services
Especialización Seguridad Informatica – 2021

HKLM\ Software \Microsoft\Windows\CurrentVersion\Runonce

HKLM\ Software\Microsoft\Windows\CurrentVersion\
Policies\Explorer\Run HKLM\ Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\WindowsNT\CurrentVersion\Windows\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce

HKEY_LOCAL_MACHINE\Software\Classes\Exefile\Shell\Open\command

HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun25.

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs26

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\27.

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution

Options

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USBSTOR

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\DeviceClasses

HKEY_LOCAL_MACHINE\System\MountedDevices

Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

SAM\SAM\Domains\Account\Users\{RID}

Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\{GUID}\Count

\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs

Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU

Software\Microsoft\Internet Explorer\TypedURLs

Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU41

Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts

Software\Microsoft\Search Assistant\ACMru

Software\Microsoft\Internet Explorer\Explorer Bars\

Software\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU

Especialización Seguridad Informatica – 2021

Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2

Software\Microsoft\Windows\CurrentVersion\Explorer\ComputerDescriptions

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
SystemRestore

HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Player\RecentFileList