I was analyzing a piece of malware and noticed it created this registry key. hkey_local_machine\software\microsoft\ esent\process{malware file name}\debug

Some googling told me that esent is just a database applications can use whenever they want. If the malware is using the esent database, how can I locate the data it's stored inside? If I cannot, what should I do with this information? Sorry for bad English.

  • Did you do static analysis of the malware or does it create the key when started? In the latter case it's possible the malware does not create this key directly but the OS or shell does it. books.google.lt/… – Vladislav Ivanov Jul 17 '17 at 17:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.