Windows Memory & Processes

Walkthrough summary

Windows Memory & Processes TryHackMe walkthrough with 12 answered prompts and lab methodology notes.

Sample prompts covered

• What field is used to keep track of all the active processes? Only enter the fields' name.
  Open the walkthrough page to inspect the full answer and command flow.
• What field is used to store the PID of a process? Only enter the fields' name.
  Open the walkthrough page to inspect the full answer and command flow.
• What is the PID of the csrss.exe process that has 12 threads? You can use the pslist.txt file to find the answer.
  Open the walkthrough page to inspect the full answer and command flow.
• What is the (memory) Offset(V) of the process with PID 5672? You can use the pslist.txt file to find the answer.
  Open the walkthrough page to inspect the full answer and command flow.
• What is the parentID (PPID) of the services.exe (PID 664) process? Use the processtree.txt file to answer the question.
  Open the walkthrough page to inspect the full answer and command flow.