FeedDiscussion
TryHackMe : After Hours Writeup
Summary The provided archive contains a raw dump of a Windows CIM repository - the backing store for WMI (INDEX.BTR, MAPPING1.MAP, MAPPING2.MAP, MAPPING3.MAP, OBJECTS.DATA, normally found at C:\Window
exploitnotes.hashnode.dev9 min read
#tryhackme#cim-repository#wmi-forensics#fileless-persistence#powershell#wmi-persistence#commandlineeventconsumer#reflection-assembly#net#threat-hunting#digital-forensics#windows-forensics#malware-analysis#incident-response#tryhackme-walkthrough#ctf
Responses
No responses yet.