Brendan Dolan-Gavitt Georgia Institute of Technology - SANS
Brendan Dolan-Gavitt Georgia Institute of Technology - SANS
Brendan Dolan-Gavitt Georgia Institute of Technology - SANS
You also want an ePaper? Increase the reach of your titles
YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.
Combining Registry and<br />
Memory Analysis<br />
• Windows keeps registry data in<br />
memory<br />
• By figuring out the internals <strong>of</strong> the<br />
Windows Configuration Manager...<br />
• We can combine these two fields!