Regexplore is a Volatility plugin designed to mimic the functionality of the Registry Explorer plugins in EZsuite and regripper plugins in volatility. It allows users to list different types of registry information in memory, such as runkeys, connected devices, and more.
-
Place the plugin folder in Volatility
volatility3/volatility3/framework/plugins/windows/registry
. -
Run the plugin using the command
python vol.py windows.registry.regexplore -h
to display the available options and commands.
run_all
: export all information in csv files to be feed to splunk, or TimeLineExplorerMountedDevices
: Displays mounted devices including GUIDs and device informationAmcacheInventoryApplication
: Amcache-InventoryApplicationAmcacheInventoryApplicationFile
: Amcache-InventoryApplicationFileAmcacheInventoryApplicationShortcut
: Amcache-InventoryApplicationShortcutAmcacheInventoryDeviceContainer
: Amcache-InventoryApplicationDeviceContainerAmcacheInventoryDevicePnp
: Amcache-InventoryApplicationDevicePnpAmcacheInventoryDriverBinary
: Amcache-InventoryApplicationDriverBinaryAppCompatCache
: Tracks application compatibility. The cache data tracks file path, size, and last modified time. In some cases, an executed flag is also available.AppPaths
: AppPaths InformationBamDam
: Extracts program information and last run times from bam and dam keysservices
: Lists the services that are automatically started when the system boots up (to-do)devices
: Lists the connected devices on the system (to-do)userassist
: Lists the programs that have been run by the user (to-do)mru
: Lists the most recently used files and applications (to-do)uninstall
: Lists the programs that have been uninstalled on the system (to-do)network
: Lists the network information and connections on the system (to-do)html
: html output (to-do)
SYSTEM
: run all plugins related to SYSTEM hive and extract information in respective csv files.SOFTWARE
: run all plugins related to SOFTWARE hive and extract information in respective csv files.Amcache
: run all plugins related to Amcache hive and extract information in respective csv files.NTUSER
: run all plugins related to NTUSER.dat hive and extract information in respective csv files.
If you find any issues or have suggestions for new features, please feel free to create an issue or submit a pull request. We appreciate your contributions and recommendations to improve the Regexplore plugin!