Investigation Continues - InCTF Internationals 2020 stuxn3t 2020-08-04 Forensics / Memory tl;dr Extract Invalid Login timestamp from the windows registry. Extract the timestamp of when a JPEG was opened. Extract Google Chrome’s last run time which was pinned to taskbar from windows registry. Read More InCTFi Volatility Windows Memory Analysis Windows Registry
Investigation - InCTF Internationals 2020 stuxn3t 2020-08-04 Forensics / Memory tl;dr Extract process last run time from the windows registry. Extract process run count from the windows registry. Read More InCTFi Volatility Windows Memory Analysis Windows Registry