How to extract registry values from memory

volatility -f /path/to/memory/dump.001 --profile=<profile> printkey -K "<key name>" > printkey-keyname-results.txt

This will print out the value of that particular registry key.

The key name is just that, only the key name, not the full path. That means the levels in regedit that are in all uppercase don’t need to be written here. So if you wanted to view Computer\HKEY_LOCAL_MACHINE\SOFTWARE\7-Zip\Path64 you’d only need to write 7-Zip\Path64