(imported topic written by Yungkie_Gunawan91)
Dear all,
Is it possible to make join result from this relevance statement :
((“HKEY_USERS” & it & “\Identities”) of (substrings separated by “” whose (it contains “S-1-5-21”) of (names of values of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist” of registry) whose (it contains “S-1-5-21” and it does not contain “Classes”)))
Which will return :
HKEY_USERS\S-1-5-21-466040969-3019942160-365623475-1521224\Identities\
HKEY_USERS\S-1-5-21-466040969-3019942160-365623475-34606650\Identities\
And another query, is like this :
((value “Default User ID” of it) of keys ((“HKEY_USERS” & it & “\Identities”) of (substrings separated by “” whose (it contains “S-1-5-21”) of (names of values of key “HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\hivelist” of registry) whose (it contains “S-1-5-21” and it does not contain “Classes”))) of registry as string)
Which will return :
{5583FBDB-F8FB-42FB-AA1A-50B7CC6B9612}
{F215AD6F-567C-49A9-AC4D-5F8FECB11B3E}
The expected result is :
HKEY_USERS\S-1-5-21-466040969-3019942160-365623475-1521224\Identities{5583FBDB-F8FB-42FB-AA1A-50B7CC6B9612}\Software\Microsoft\Outlook Express\5.0 in the key Store Root
Regards,
Yungkie