Core Windows Processes

Walkthrough summary

Core Windows Processes TryHackMe walkthrough with 9 answered prompts and lab methodology notes.

Sample prompts covered

• What PID should System always be?
  Open the walkthrough page to inspect the full answer and command flow.
• Aside from csrss.exe, what process does smss.exe spawn in Session 1?
  Open the walkthrough page to inspect the full answer and command flow.
• What was the process which had PID 384 and PID 488?
  Open the walkthrough page to inspect the full answer and command flow.
• Which process might you not see running if Credential Guard is not enabled?
  Open the walkthrough page to inspect the full answer and command flow.
• How many instances of services.exe should be running on a Windows system?
  Open the walkthrough page to inspect the full answer and command flow.