Windows > MOD D08: System Enumeration > Flashcards

MOD D08: System Enumeration Flashcards

(23 cards)

Study These Flashcards
1
Q

Graphical User interface tool on windows that enables authorized users to make changes to the registry

A

regedit

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which is not a forensically relevant key in the windows registry?

  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run
  • HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
  • HKLM\S0FTWARE\Google
  • HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR
A

HKLM\S0FTWARE\Google

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

This hive contains the general configuration for hardware

  • HKEY_LOCAL_MACHINE\HARDWARE
  • HKLM
  • HKEY_CLASSES_ROOT\DeviceDisplayObject\HardwareId
  • HKCR
A

HKLM (? - I got this one wrong)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

If I wanted to find information about USBs that were plugged into a windows machine; what registry would I begin with?

A

HKEY_LOCAL_MACHINE\SYSTEM\CURRENTCONTROLSET\ENUM\USBSTOR

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

This registry key focuses on services that run on the Windows system.

A

HKLM\SYSTEM\CurrentControlSet\Services

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

This key contains special information that includes user passwords thats on windows machine

  • HKLM\SAM
  • /etc/shadow
  • HKU
  • C:\Windows\System32
A

HKLM\SAM

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

When referencing this registry “HKEY_CURRENT_USER\Software\AppDataLow\Software\Microsoft\Internet Explorer”; Software is a _____ to AppDataLow

A

Subkey

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

This hive contains specific configuration and information on users within the machine. Each user is stored contextually as a SID.

  • HKLM
  • HKCU
  • HKCR
  • HKCC
  • HKU
  • HKUR
  • HKLU
A

HKU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

This hive contains the configuration for the user who is currently logged on.

  • HKLM
  • HKCU
  • HKCR
  • HKCC
  • HKU
  • HKUR
  • HKLU
A

HKCU

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

This hive contains a list of extensions and their object class registration

  • HKLM
  • HKCU
  • HKCR
  • HKCC
  • HKU
  • HKUR
  • HKLU
A

HKCR

(HKEY_CLASSES_ROOT)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

This hive contains information about the current hardware profile of the local computer system.

  • HKLM
  • HKCU
  • HKCR
  • HKCC
  • HKU
  • HKUR
  • HKLU
A

HKCC

(HKEY_CURRENT_CONFIG)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

The capture of a system in a known good state for reference as to what normal/typical behavior, structure and attributes at a given point in time.

A

Baseline

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

A system administrator is collecting a massive amount of information on a single system to compare it to a known good state. The process the administrator is doing is called what?

A

enumeration

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

When on the windows command line, what command will list processes with the particular name of: Explorer.exe

A

tasklist /fi “IMAGENAME eq explorer.exe”

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

This Command line command will list all running processes (Excluding WMIC)

A

tasklist

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

This standard command line command will display connections on the system.

  • net
  • net /?
  • net statistics
  • netstat
  • netcat
  • netscan
  • netview
17
Q

These external tools are technical resources and utilities to manage, diagnose, troubleshoot, and monitor a Microsoft Windows environment.

18
Q

On command line, this command will map sysinternals tools to a shared drive to access for later use.

Study These Flashcards
A

net use * \live.sysinternals.com/tools

19
Q

Which of the following is not a sysinternals tool available?

  • disk2vhd.exe
  • du64.exe
  • junction.exe
  • notmyfault.exe
  • ported.exe
  • pslist.exe
  • pssuspend.exe
  • ZoomIt.exe
  • movefile.exe
20
Q

Which of the following is not a sysinternals tool available?

  • Dbgview.exe
  • accesschk.exe
  • graftable.exe
  • sdelete.exe
  • psfile.exe
  • livekd.exe
  • ctrl2cap.exe
  • ADExplorer.exe
  • Bginfo.exe
Study These Flashcards
A

graftable.exe

21
Q

I want to observe a process starting and stopping and follow the child processes created. Which of the following sysinternals tool will most easily provide me with what I want?

  • tasklist.exe
  • procexp.exe
  • proctree.exe
  • livekd.exe
  • psgetsid.exe
22
Q

Sysinternals command that will show detailed listing of all TCP and UDP endpoints on your system.

23
Q

Most sysinternals tools when initially ran on command line will display a banner/user agreement to the gui. If you want to bypass it you need to include what?

Windows
flashcards
Decks in class (15)
# Cards
Brainscape helps you reach your goals faster, through stronger study habits.
© 2026 Bold Learning Solutions. Terms and Conditions