Windows User Activity Analysis

Walkthrough summary

Windows User Activity Analysis TryHackMe walkthrough with 15 answered prompts and lab methodology notes.

Sample prompts covered

• Connect with the Lab. How many tools / folders are in the EZ tools folder on the Desktop?
  Open the walkthrough page to inspect the full answer and command flow.
• Which Hive stores information about installed software?
  Open the walkthrough page to inspect the full answer and command flow.
• What is the current size of the SAM Hive in the attached lab? (In KB)
  Open the walkthrough page to inspect the full answer and command flow.
• The suspect typed a suspicious path in the Windows Explorer, that points to a tmp directory in C drive. What is the full path?
  Open the walkthrough page to inspect the full answer and command flow.
• In the WordWheelQuery search, what was the latest term searched by the user?
  Open the walkthrough page to inspect the full answer and command flow.