Forensics

Walkthrough summary

Forensics TryHackMe walkthrough with 12 answered prompts and lab methodology notes.

Sample prompts covered

• What is the Operating System of this Dump file? (OS name)
  Open the walkthrough page to inspect the full answer and command flow.
• What is the PID of SearchIndexer?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the last directory accessed by the user?
  Open the walkthrough page to inspect the full answer and command flow.
• There are many suspicious open ports; which one is it? (ANSWER format: protocol:port)
  Open the walkthrough page to inspect the full answer and command flow.
• Vads tag and execute protection are strong indicators of malicious processes; can you find which they are? (ANSWER format: Pid1;Pid2;Pid3)
  Open the walkthrough page to inspect the full answer and command flow.