[Autogenerated] let's start with minimal processes.
So we know there's a memory compression process which is a minimal process.
Let's find it.
We know that task manager doesn't show the minimum
the memory compression process.
If you try to find it, you won't find it.
And this is hidden um on purpose to make sure that people don't
complain about the memory compression process consuming memory because
it's really although it is consuming memory,
this is compressed memory.
So essentially it's saving memory.
However, other tools are not going to hide the memory compression process.
We can see it right here.
We don't see any deal else here.
And the one reason for that is is the fact that memory compression
process and all other minimal processes are are always protected with
the highest protection of wind system.
So a process Explorer can't really _________ those processes but
really we don't expect any dll to be here,
but maybe some memory is used in the process and of course
it has to because that's the purpose of minimal process to
have some address space.
You can see the working set here and the private
bytes there are some values here.
It is using memory.
If we double click to look at the command line,
we see absolutely nothing because these processes are created by
the kernel directly without any backing image.
The code is provided by the kernel because any user mode code will
not be able to run in such a process anyway,
but we can see the list of threats here.
In fact, if we look at the list of threats,
we can see that they're all based on something within anti os kernel,
which means these are kernel threats and you can see also the
function names here all starting with S M,
which is short for store manager,
the store manager being the short name for the components that are
responsible for memory compression in Windows.
In fact,
you can see some of these function are actually C++ functions using even
templates and and and that's kind of perhaps unexpected.
Again,
trying to use the call stack button here would not work
because the process is not able to open a powerful enough
handle to view the call stack,
but it is something we can look at using other tools
that do have access to the process,
such as my system Explorer tool because I have a kernel driver.
So if I look at memory compression here we can look at the DLS perhaps,
maybe maybe there's something there but there's nothing there,
which is what we expect but we do expect to have some memory there.
So if we go back and go to look at the memory map of the process,
we can see that there is data there.
So obviously there's data there that is being used by the process.
This is the actually the actual compressed memory gives us
some some kind of basic information saying that there some
committed memory in these chunks.
We don't see the actual memory itself,
but it wouldn't be very difficult to show the actual content of of
memory because once you have access to the address space,
if you if you get that,
if you have a kernel driver then you can have any kind of access to the process.
So it's actually there looking at the second one.
The registry process.
The registry process by the way,
is not hidden by a task manager because not consuming that much memory.
You can see the registry process right here.
Again, you see,
there is no particular executable here but it does consume some
memory which of course we expect but you can see the description says
anti kernel and system which is essentially saying there is no
specific executable for this process.
The kernel is the one providing the code going back to Explorer.
We can look at the registry process here and again,
we see nothing in terms of modules and and that's again expected.
You can see the threats here, have these names starting with c m p,
which is short for configuration manager.
Private configuration manager is the name used by the executive for
managed for the management of registered in the name of the component
internally managing the windows registry,
that's why we see this particular name and again,
we can look at uh,
at the system Explorer here and locate the registry process here.
It is again, we can look at the modules in this case.
There are some modules that being mapped.
These are not using more DLS.
These are just data modules for example.
You might recognize things like you use our class dot dot which is the file used
to store the HP classes root Hive For the particular user.
And there are other modules here which are being mapped using section objects
which we'll discuss in a in the future course to memory.
You can see here the mapping for the software hive, which is saved in the file.
That HP Machine software,
I mean that is saved in a file which has exactly the name software.
Without any extension.
You can go ahead and open the system 32 directory
and you'll find this file there.
Let's let's see.
So we have config here and well we require administrative access
to tap into this directory which which we can get because I am a
true administrator on this machine.
You can see the software Hive right here.
So this is how the registry is actually being stored on disk
in terms of h key local machine software and the other stuff
here such as security sam.
These are all hives onto themselves in connection to the registry so
they might also be mapped here by the registry process.
Obviously something is here and we can again go to
look at the actual memory map.
We can see there's the mapping here,
shown for these various files and the mapping type is also shown
whether that it's read or or something else.
And and the Colonel is just using that for manipulating and
storing information about the registry.
You can see that here Some parts of real rights or some
things could be are mapped with write access,
which of course makes sense.
So instead of storing all these cash data in in the page pool,
in the kernel,
it's being stored in user mode in a protected process
because it is a minimum process.
And all minimal processes are protected by definition,
so they're not accessible to use the mode directly,
but they're perfectly accessible to the Colonel.