diff --git a/volatility/framework/plugins/windows/registry/printkey.py b/volatility/framework/plugins/windows/registry/printkey.py index 52c3f2214..63347ac53 100644 --- a/volatility/framework/plugins/windows/registry/printkey.py +++ b/volatility/framework/plugins/windows/registry/printkey.py @@ -139,7 +139,7 @@ class PrintKey(interfaces.plugins.PluginInterface): vollog.debug(excp) else: vollog.debug("Invalid address identified in Hive: {}".format(hex(excp.invalid_address))) - result = (0, (renderers.UnreadableValue(), format_hints.Hex(hive_offset), "Key", key or 'ROOT', + result = (0, (renderers.UnreadableValue(), format_hints.Hex(hive_offset), "Key", '?\\' + (key or ''), renderers.UnreadableValue(), renderers.UnreadableValue(), renderers.UnreadableValue())) yield result