[Instructor] Let's grab the tools we will need in order to analyze this worm by going to the Windows ADK download site. ADK stands for the Windows Assessment and Deployment Kit, and in this kit are two tools which we will need.

The first of these two tools is the Windows Performance Recorder, which logs system events and generates an event tracing log file, which is then opened and analyzed using the second tool, the Windows Performance Analyzer. The klub 17 models pack. These tools are commonly referred to as WPR and WPA respectively.

With that said, let's click on the blue download button and save the ADK setup executable. Once the setup file is saved, locate it and double click to start the installation menu. Click Run on the prompt that comes up, and the installation process is your typical one, where we click on Next and accept End User License agreements. Click No to send anonymous usage data, and then click Next. This is the End User License Agreement, so let's accept this, and once we get to the components list, we want to uncheck everything except the Windows Performance Toolkit, so let's uncheck all these, and let's make sure we only check Windows Performance Toolkit. Once checked, click Install.

Follow us on Facebook and Twitter! Elave nothing to hide model.

Click yes on any prompts that come up. Once the installation process is done, let's click on Close, and now let's locate the Windows Performance Toolkit, which has the Windows Performance Recorder and the Windows Performance Analyzer. It's in our Program Files, Windows Kits, and here you will see different folders labeled eight, 8.1, and 10 in your Windows Kits folder. I'm going to click on 10, for Windows 10. Click on the folder for your operating system, and in that, there is the Windows Performance Toolkit folder. If we scroll to the bottom, we can see this WPRUI executable file, let's right click on this, and select Create shortcut to create a desktop shortcut.

We create a desktop shortcut for the Windows Performance Recorder so we don't have to navigate to this folder every time we want to collect system events. Let's do the same for the WPA executable, and create a shortcut for easier access. WPA is the Windows Performance Analyzer. Now we need to configure our system to point to the Microsoft symbol server. This step is so we can see the function names that are being called by applications, like the worm. Now we need to configure our system to point to the Microsoft symbol server. This step is so we can see the function names that are being called by applications, like the virus.

To do this, let's go to our Control Panel, and for the View By, click on Small icons, then click on System, then Advanced system settings, then Environment Variables, and under the System variables section, click on New, and for the Variable name, we're going to put _NT_SYMBOL_PATH, and for the value, we're going to put this. (keyboard clicking) What this does is it will grab from the Microsoft symbol server, and save it to our local folder, C drive, slash Symbols. Once you've entered this value, click Okay. Then, under the System variables section again, let's click on New, and for the Variable name, let's put _NT_SYMCACHE_PATH, and then for the Variable value, put C drive, slash, SymCache. This C drive, slash SymCache folder will be generated for us automatically. Once done, click Okay, then let's click Okay, and Okay one more time, and that's the Windows Performance Toolkit, installed and set up.