TryHackMe : After Hours Writeup
Summary The provided archive contains a raw dump of a Windows CIM repository - the backing store for WMI (INDEX.BTR, MAPPING1.MAP, MAPPING2.MAP, MAPPING3.MAP, OBJECTS.DATA, normally found at C:\Window
#tryhackme#cim-repository#wmi-forensics#fileless-persistence#powershell#wmi-persistence#commandlineeventconsumer#reflection-assembly#net#threat-hunting#digital-forensics#windows-forensics#malware-analysis#incident-response#tryhackme-walkthrough
Responses
Markdown supported · ⌘↵ to post
No responses yet.