Please enable JavaScript.

Coggle requires JavaScript to display documents.

Registry - Coggle Diagram

- - - - Microsoft
        
        WBEM\CIMOM
        
        Tracing
        
        _RASMANCS32
        
        These registry keys get created the first time an application interacts with the Remote Access API, "rasapi32.dll", and the Remote Access Connection Manager, "rasman.dll". Since these Dynamic-Link Libraries (DLLs) are related to RAS, it indicates that applications that have "RASAPI32" and "RASMANCS" registry keys attempted network connections.
        
        _RASAPI32
  - - - Hardware Profiles
        
        Current < HKEY_CURRENT_CONFIG
        
        Software
        
        System
        
        You may notice that there are multiple registry keys inside HKLM\SYSTEM\CurrentControlSet\Hardware Profiles. That's because that registry key is used to hold all the hardware profiles for the whole computer. The reason you only see one hardware profile in the HKEY_CURRENT_CONFIG key is that it's only pointing to one of those hardware profiles - specifically, to the one that pertains to the user that's currently logged on.
  - - - Catalogs
      - Deployments
    - - Components
      - VersionedIndex
  - - - subkey refers to information about Security Accounts Manager (SAM) databases for domains. Within each database are group aliases, users, guest accounts, and administrator accounts, plus the name used to log in to the domain, cryptographic hashes of each user's password, and more.
    - - subkey is used to store the security policy of the current user. It's linked to the security database of the domain where the user is logged in, or to the registry hive on the local computer if the user is logged in to the local system domain.
- - - - HKEY_USERS.DEFAULT subkey is the exact same as the HKEY_USERS\S-1-5-18 subkey. Any changes made to one are automatically and instantly reflected in the other,
        in the exact same way that the currently logged on user's SID subkey in HKEY_USERS is identical to the values found in HKEY_CURRENT_USER.
        
        Software
        
        Classes
        
        Local Settings
        
        MuiCache
    - - HKEY_USERS\S-1-5-19
        
        for the LocalService account
      - HKEY_USERS\S-1-5-20
        
        used by the NetworkService account.
    - - Software
        
        Microsoft
        
        Windows
        
        Run
        
        firefox.exe (AUTOSTART)
        
        Shell
        
        BagMRU
        
        CurrentVersion
        
        Explorer
        
        ComDlg32
        
        Internet Settings
        
        5.0
        
        1 more item...
        
        For each zone, users can control how Internet Explorer handles higher-risk items such as ActiveX controls, downloads, and scripts. Internet Explorer security zones settings are stored under the following registry subkeys > Internet Settings
        
        ZoneMap
        
        3 more items...
        
        Windows Script Host > Settings
        
        Classes
        
        Local Settings
        
        Software
        
        Microsoft
        
        Windows
        
        3 more items...
        
        MultiCache
        
        52C64B7E\LanguageList
        
        Policies
        
        Sysinternals
        
        Wow6432Node
    - - Local Settings
        
        Software
        
        Microsoft\Windows\Shell\Bags
      - VirtualStore
        
        MACHINE
        
        SOFTWARE
        
        Wow6432Node