# Introduction Welcome to my GitBook, an evolving guide in the dynamic and ever-changing field of Incident Response (IR), with a special emphasis on Windows Digital Forensics and Incident Response (DFIR) and malware analysis. My journey in cybersecurity spans an enriching five years, filled with continuous learning, challenging encounters, and a deep-rooted passion for deciphering the intricacies of malware. My foray into IR was driven by a blend of curiosity and intrigue for the constantly shifting landscape of cyber threats. This journey has honed my expertise in Windows DFIR, where technical acumen meets creative problem-solving. With extensive experience under my belt, I've come to appreciate the necessity of staying abreast with the rapid developments in our field. This GitBook is a work in progress, a reflection of my ongoing journey in the cybersecurity realm. It's born from a commitment to share knowledge and insights in a field that's as challenging as it is rewarding. My goal is to provide a living, growing resource for responders at varying levels of their career – from beginners seeking foundational knowledge to veterans aiming to deepen their specialization in DFIR and malware analysis. Here, you'll find a mixture of theoretical concepts, practical applications, real-world case studies, and detailed guides tailored to guide you through the complexities of Windows DFIR. Whether your aim is to enhance your skills, seek advice on specific challenges, or simply explore the fascinating world of digital forensics, this guide is designed to be a valuable, continuously updated resource. Embark on this journey with me as we delve into the captivating world of IR and malware. This GitBook is not just a compilation of past experiences but an ongoing narrative enriched by continuous learning and contributions from the community. Your feedback, insights, and contributions are not only welcome but essential in making this a comprehensive and up-to-date guide for all. # Windows Quick Tips This section provided a brief overview of useful command line snippets as well as important file and folder locations for Windows Workstations and Servers. * [Windows Command Line](broken://pages/eXpkDT8BuaELNTDlRnwl) * [Workstation File/Folder Locations](broken://pages/dyoVrWZ59k3oi2fAdzXN) * [Server File/Folder Locations](broken://pages/2ORQhMRtXq4R20oVlyHc) # Windows Command Line * **System Information and Configuration:** * `systeminfo`: Provides detailed information about the system, including OS version, patches, and system uptime. * `netstat -ano`: Lists all ports that are currently open and the corresponding process IDs. Useful for identifying unexpected network connections. * `ipconfig /all`: Displays all network configuration details, including IP addresses, DNS servers, and MAC addresses. * `tasklist`: Shows all currently running processes, which is vital for identifying suspicious activity. * `sc query`: Lists the status of all services. This can help identify unauthorized or rogue services. * `driverquery`: Lists all installed drivers, useful for finding hidden or malicious drivers. * **User Account and Login Information:** * `net users`: Lists all user accounts on the system. * `quser`: Displays information about logged on users. * `net user [username]`: Provides detailed information about a specific user account. * `wevtutil qe Security /f:text /rd:true /c:10`: Queries the Security event log for the last 10 entries, which can include logon events. * **File and Directory Analysis:** * `dir /a /s /b`: Lists all files and directories, including hidden ones. Useful for a quick directory traversal. * `fc /b [file1] [file2]`: Compares two files byte-by-byte, which can be useful for checking file integrity. * `findstr /s /i [string] *.*`: Searches for a string in all files, helpful for finding specific content. * **Network Configuration and Analysis:** * `route print`: Displays the current routing table, which can reveal unexpected routes. * `arp -a`: Shows the ARP table, useful for identifying local network devices. * `nslookup`: A tool for querying DNS to resolve hostnames to IP addresses and vice versa. * **Forensic Tools:** * `powershell "Get-WinEvent -ListLog *"`: Lists all event logs, useful for identifying available logs for deeper analysis. * `wmic process list full`: Provides comprehensive information about running processes, including their execution path, which can reveal malicious processes. * `vssadmin list shadows`: Lists Volume Shadow Copies, which can contain backups of critical files or evidence of tampering. * **Miscellaneous:** * `sfc /scannow`: Scans and verifies the integrity of all protected system files. * `chkdsk`: Checks the file system and file system metadata for logical and physical errors. * `gpresult /H gpresult.html`: Generates a report of group policy settings, which can help identify unauthorized changes. # Workstation File/Folder Locations 1. **System Configuration and Registry** * `C:\Windows\System32\config\`: Contains the Registry hives. * `C:\Windows\regedit.exe`: Registry Editor, for accessing the Windows Registry. 2. **User Data and Profiles** * `C:\Users\`: User profile directories containing personal files, settings, and application data. * `C:\Users\[Username]\AppData`: Application data, roaming profiles, and user-specific settings. 3. **Logs and Event Files** * `C:\Windows\System32\winevt\Logs`: Event logs for system, security, and application events. * `C:\Windows\System32\config`: Also contains some system logs. 4. **Program Files and Applications** * `C:\Program Files` and `C:\Program Files (x86)`: Installed applications. * `C:\Windows`: Core operating system files. 5. **Temporary Files** * `C:\Windows\Temp`: System temporary files. * `C:\Users\[Username]\AppData\Local\Temp`: User-specific temporary files. 6. **Startup Items** * `C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup`: Startup items for individual users. * `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp`: Startup items for all users. 7. **Task Scheduler and Automated Tasks** * `C:\Windows\System32\Tasks`: Task Scheduler tasks. * `C:\Windows\Tasks`: Automated tasks created by older applications. 8. **Windows Registry Key Locations for Autostart Items** * `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run`: Programs that run on system startup. * `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run`: User-specific programs that run on startup. 9. **Temporary Internet Files and Browser Data** * `C:\Users\[Username]\AppData\Local\Microsoft\Windows\INetCache`: Internet Explorer cache. * `C:\Users\[Username]\AppData\Local\Google\Chrome\User Data\Default\Cache`: Google Chrome cache (similar paths for other browsers). 10. **System Restore Points and Shadow Copies** * `C:\System Volume Information`: System Restore points and Volume Shadow Copy service files. 11. **Prefetch Files (Application Launch Information)** * `C:\Windows\Prefetch`: Files that help in speeding up the application launch. 12. **Recycle Bin** * `C:\$Recycle.Bin`: Files that have been deleted but not permanently removed. 13. **Windows Event Tracing Logs** * `C:\Windows\System32\winevt\Logs`: Event Tracing for Windows (ETW) logs, which record system operation and performance data. 14. **Security Software Logs** * Varies by vendor: Security solutions (antivirus, EDR, firewalls) often have their own logging directories. 15. **File History Backup** * `C:\Users\[Username]\AppData\Local\Microsoft\Windows\FileHistory`: Configuration and storage for the Windows File History feature. 16. **Crash Dumps** * `C:\Windows\Minidump`: Contains mini-dump files generated during a system crash (BSOD). * `C:\Windows\MEMORY.DMP`: Full memory dump file. 17. **Installed Programs and Updates** * `C:\Windows\Installer`: Storage location for installation files and patches. * `C:\Windows\SoftwareDistribution\Download`: Windows Update files. 18. **Networking Information** * `C:\Windows\System32\drivers\etc\hosts`: Hosts file for manual IP address mapping. * `C:\Windows\System32\drivers\etc\networks`: Network configuration files. 19. **Command History** * For PowerShell: `C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt` ### Common Directories w/ Servers * `C:\Windows`: Core operating system files. * `C:\Windows\System32`: Essential system files and DLLs. * `C:\Windows\Prefetch`: Information about application launch activities and timings. * `C:\ProgramData`: Application and system-wide data. * `C:\Users`: User profiles and personal files. # Server File/Folder Locations 1. **Active Directory and Group Policy (Specific to Domain Controllers)** * `C:\Windows\NTDS`: Active Directory database files (NTDS.DIT). * `C:\Windows\SYSVOL\sysvol`: Group Policy and logon scripts. 2. **Server Roles and Features** * `C:\Windows\System32`: Includes binaries and configuration for server roles like DHCP, DNS, IIS, etc. * `C:\inetpub`: Default directory for IIS web services. 3. **Logs and Event Files** * `C:\Windows\System32\winevt\Logs`: Similar to workstations, contains event logs. * `C:\Windows\System32\LogFiles`: Logs for IIS and other Windows services. 4. **Hyper-V (if applicable)** * `C:\ProgramData\Microsoft\Windows\Hyper-V`: Configuration files for Hyper-V virtual machines. * Virtual Hard Disk files: Location can vary but often found in `C:\Users\Public\Documents\Hyper-V\Virtual Hard Disks`. 5. **Backup and Recovery** * `C:\Windows\SystemStateBackup`: System State backup location. * `C:\Windows\Backup`: Default backup location. ### Common Directories w/ Workstations * `C:\Windows`: Core operating system files. * `C:\Windows\System32`: Essential system files and DLLs. * `C:\Windows\Prefetch`: Information about application launch activities and timings. * **MUST BE ENABLED** * `C:\ProgramData`: Application and system-wide data. * `C:\Users`: User profiles and personal files. # Account Usage # Authentications SAM Artifacts ## Key Points * **Purpose of SAM File**: The Security Account Manager (SAM) file in Windows systems stores user accounts and security descriptors. * **Location**: SAM file is located at `C:\Windows\config\SAM`. * **Structure**: SAM file is a registry hive, containing keys and values. * **Digital Forensics Value**: Provides detailed information about user accounts, crucial for tying a user to system activities. ## Considerations * **Access to SAM File**: Ensure proper permissions and methods are used to access and analyze the SAM file. * **Data Integrity**: Maintain the integrity of the original SAM file to prevent contamination of evidence. * **Cryptographic Protection**: Understand the cryptographic measures used in SAM to accurately interpret the data. ## Detailed Explanation ### Windows SAM: An Overview Windows stores user accounts and security descriptors in the SAM file, a critical component of a system-defined database for configuration data storage and retrieval. This file plays a key role in authenticating local and remote users, ensuring system security against unauthenticated access. ### Digital Forensics Value of User Accounts Artifacts User Accounts artifacts are invaluable in forensic investigations to identify system users. This information includes: * **Username** * **Full Name** * **Privilege Level** * **Login History (Successful and Failed Attempts)** Analyzing these artifacts helps in establishing a timeline and associating specific users with activities on the computer. ### Location and Structure * **Location**: `C:\Windows\config\SAM` * **SAM Hive Path**: `SAM\Domains\Accounts\Users` * **Structure**: The SAM file is a registry hive with keys and subkeys, viewable and editable through `regedit.exe`. ### Analyzing with ArtiFast Windows ArtiFast Windows facilitates the extraction and analysis of User Accounts artifacts from Windows machines. #### Steps for Analysis 1. **Accessing the File System**: * You need physical or remote access to the file system of the Windows host. * If you have direct physical access, you might use a bootable USB drive with a forensics environment to access the file system without booting into Windows. * For remote access, you might use administrative shares or remote desktop with administrative privileges. 2. **Locating the SAM File**: * The SAM file is located in `C:\Windows\System32\config\SAM` on the target Windows system. * This file is locked by the operating system when Windows is running. To access it, you have to either boot from a different OS (like a forensics live USB) or use a tool that can read locked files. * **Using Volume Shadow Copy**: * If you cannot directly access the file due to it being in use, consider using the Volume Shadow Copy Service (VSS). * You can create a new shadow copy and access the SAM file from there. Tools like `vssadmin` can be used to create and manage shadow copies. 3. **Extracting the SAM File**: * Once you have access to the SAM file, you need to copy it to your analysis environment. * Make sure to follow proper evidence handling procedures to maintain the integrity of the data, like maintaining a chain of custody and using write blockers if working with physical drives. 4. **Create a Case**: Initialize your investigation with a new case. 5. **Add Evidence**: Include the SAM file as part of your evidence. 6. **Artifact Selection**: Choose User Accounts artifact for analysis. 1. **Review Artifacts**: Utilize "Artifact View" or "Timeline View" for detailed examination. #### User Accounts Artifact in ArtiFast * **Username**: Account identifier. * **Full Name**: User's full name. * **User Comment**: Any comments associated with the user account. * **Profile Path**: Location of the user's profile folder. * **Account Type**: Category of the user account (e.g., admin, guest). * **Account Status**: Current status (active, inactive, password requirements). * **Login Count**: Frequency of user logins. * **Last Login Date/Time**: Most recent login timestamp. * **Last Password Reset Date/Time**: Timestamp of the last password reset. * **Last Password Failed Date/Time**: Timestamp of the most recent failed login attempt. * **Logon Script**: Scripts executed during user login. * **Last Write Date/Time**: Timestamp of the last modification to the user's registry key. ## Concluding Notes Investigating User Accounts through the SAM file provides essential insights into user activities and system access patterns. This analysis is crucial for comprehensive digital forensics investigations in Windows environments. # Last Login ### Description The Last Login artifact within the Windows Security Account Manager (SAM) provides crucial information about the local accounts present on a system, alongside their corresponding security identifiers (SIDs). This artifact is instrumental in forensic investigations, offering insights into user account activities. ### Location The Last Login information can be found in the following locations on a Windows system: * **Primary Location**: `C:\Windows\System32\config\SAM` * **Registry Path**: `SAM\Domains\Account\Users` These paths house the data necessary for identifying when each user last logged into the system, which is pivotal for understanding user behavior and potentially identifying unauthorized access. ### Interpretation The key aspect of the Last Login artifact is that it stores only the time of the last login for each account. This is reflected in the registry key associated with each user account under the SAM database. Here's how to interpret and utilize this information: * **Last Login Time**: This is the primary piece of information stored within this artifact. It indicates the exact date and time when a user last logged into the system. This timestamp can be critical in establishing a timeline of user activity or detecting potential unauthorized access. * **Forensic Analysis**: During forensic analysis, the Last Login time can help in pinpointing the usage patterns of a system. It can also assist in identifying if and when an account was used to gain unauthorized access, by comparing the login times with other events logged on the system. * **Security Identifiers (SIDs)**: Each account has a unique SID that is also stored within the SAM. These identifiers are crucial for distinguishing between accounts, especially when there are multiple users with similar names or when trying to correlate account information across different systems or logs. ### Utilizing Last Login Data In the context of digital forensics and incident response, the Last Login artifact is utilized to: 1. **Verify User Activity**: Determine if the reported user activity aligns with the system's recorded login times. 2. **Identify Anomalies**: Spot discrepancies in login patterns that might indicate unauthorized access or insider threats. 3. **Timeline Reconstruction**: Use login times as part of a broader effort to reconstruct the sequence of events before, during, and after an incident. #### Tools and Commands Several forensic tools and scripts can extract and present the Last Login data, including but not limited to: * **Windows Registry Editor** (Regedit): For manual inspection. * **Powershell Commands**: To query the SAM database directly. * **Forensic Software**: Tools like EnCase, FTK, or Autopsy can parse the SAM file and present Last Login information alongside other artifacts. # Last Failed Login ### Description The Last Failed Login artifact in the Windows Security Account Manager (SAM) captures information about the most recent unsuccessful attempt to log into a user account. This artifact is critical for security audits, forensic investigations, and monitoring the overall health of system security, as it can indicate unauthorized access attempts or user error. ### Location Information regarding last failed login attempts is stored within the Windows system at: * **Primary Location**: `C:\Windows\System32\config\SAM` * **Registry Path**: `SAM\Domains\Account\Users\[User RID]` The User Relative Identifier (RID) is unique to each account, which means that the path to find the last failed login attempt data will vary depending on the specific user account being investigated. ### Interpretation The Last Failed Login artifact contains the timestamp of the last unsuccessful login attempt for a user account. Analyzing this data provides valuable insights: * **Security Monitoring**: Identifying repeated failed login attempts can signal a brute force attack or unauthorized access attempts. Monitoring these attempts allows for timely intervention and security measures to be applied. * **Incident Response**: In the context of an incident, knowing when a failed login attempt occurred can help in correlating events and understanding the attacker's actions or the timeline of the incident. * **User Behavior Analysis**: Occasional failed logins may indicate user error (e.g., forgotten passwords) rather than malicious attempts. Tracking these can help in identifying the need for user education or password reset policies. ### Utilizing Last Failed Login Data For security professionals and forensic analysts, the Last Failed Login artifact is used to: 1. **Detect Unauthorized Access Attempts**: By analyzing patterns of failed logins, it's possible to identify and respond to potential attacks. 2. **Support Forensic Investigations**: Failed login attempts can be crucial evidence, offering insights into the behavior of both authorized users and attackers. 3. **Compliance and Auditing**: Ensuring that audit logs capture failed login attempts is often a requirement in regulatory compliance, making this artifact important for audit trails. #### Tools and Commands Accessing and interpreting the Last Failed Login data can be done using various tools and techniques: * **Windows Registry Editor** (Regedit): Allows direct inspection of the SAM file to locate the failed login attempt data. * **Forensic Analysis Tools**: Software like EnCase, FTK, or Autopsy can parse the SAM database and present failed login attempts alongside other relevant data. * **Scripting and Command Line**: Scripts or commands that query the SAM database or utilize Windows event logs to extract failed login attempt information. # Last Password Change ### Description The Last Password Change artifact within the Windows Security Account Manager (SAM) records the most recent occasion on which a user's password was altered. This information is essential for security and forensic analyses, as it helps in identifying and tracking changes in user credentials over time. ### Location The data pertaining to the last password change can be found in the Windows operating system at: * **Primary Location**: `C:\Windows\System32\config\SAM` * **Registry Path**: `SAM\Domains\Account\Users` These directories and registry paths are critical for accessing the specific details regarding the timing of password updates for user accounts on a Windows system. ### Interpretation The artifact stores the timestamp for the last occasion a user's password was changed. This timestamp is vital for several reasons: * **Security Auditing**: Regular password changes are a fundamental aspect of maintaining account security. The last password change timestamp can be used to verify compliance with password policies. * **Incident Response**: In the event of a security breach, determining when a password was last changed can help in assessing whether an account has been compromised or if the change was part of the attacker's actions. * **Forensic Analysis**: The timing of password changes can be correlated with other events to build a timeline or to identify suspicious activity, such as a password being changed shortly after unauthorized access. ### Utilizing Last Password Change Data In digital forensics and incident response, analyzing the Last Password Change artifact involves: 1. **Policy Compliance Checks**: Ensuring that users are adhering to organizational policies regarding password updates. 2. **Identifying Anomalies**: Unusual patterns, such as frequent password changes or changes at odd times, can indicate compromised accounts or insider threats. 3. **Investigation and Evidence**: The last password change timestamp can serve as a piece of evidence in a broader investigation, helping to establish timelines or user behavior patterns. #### Tools and Commands To access and analyze Last Password Change data, investigators may use: * **Windows Registry Editor** (Regedit): For direct examination of the SAM file. * **Command Line Tools**: Such as `net user` on a command prompt, which can display the last password change date for users. * **Forensic Tools**: Applications like EnCase, FTK, or Autopsy can automate the extraction and analysis of password change timestamps from the SAM database. # Authentications (Windows Event Log) ## Key Points * **Purpose**: Analyzing Windows Event Logs for authentication events to detect unauthorized access. * **Primary Event IDs**: 4624, 4634, 4672, 4732, 4648, 4688, 4697, 4768. * **Significance**: These events indicate various authentication-related activities, crucial for security monitoring. ## Considerations * **Event Log Integrity**: Ensure the integrity of event logs to maintain the reliability of the analysis. * **Contextual Analysis**: Analyze events within the context of other system activities for accurate interpretation. * **Regular Monitoring**: Continuously monitor event logs to promptly detect and respond to security incidents. ## Detailed Explanation ### Windows Event Logs: An Overview Windows Event Logs provide a record of security, system, and application events. Analyzing these logs is critical for identifying potential security incidents and unauthorized access attempts. ### Monitoring Authentication Events Specific Windows Event IDs are crucial for monitoring authentication-related activities: #### Key Event IDs 1. [**4624** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4624-authentication-success)**(Successful Login)** 2. [**4634** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4634-account-logoff)**(Logout)** 3. [**4672** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4672-special-privileges)**(Special Privileges Assigned)** 4. [**4732** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4732-addition-to-local-group)**(Addition to Local Group)** 5. [**4648** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/authentication-account/4648-explicit-credentials-success)**(Login with Explicit Credentials)** 6. [**4688** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/25/windows-artifacts/event-ids/file-system/4688-process-created)**(New Process Creation)** 7. **4697 (Service Installation)** 8. **4768 (Kerberos TGT Request)** #### Analyzing Event Logs * **Tool Usage**: Use tools like Windows Event Viewer or third-party applications for log analysis. * **Pattern Recognition**: Look for patterns and anomalies in event log entries. * **Correlation with Other Data**: Cross-reference with other system logs for comprehensive analysis. ### Case Study: Detecting Forged Kerberos Tickets Sean Metcalf's article on detecting forged Kerberos tickets provides valuable insights into advanced authentication attack techniques. It can be found at [ADSecurity](https://adsecurity.org/?p=1515). This case study emphasizes the importance of understanding sophisticated attack vectors in Windows environments. # Logon ID **Key Points** 1. **Definition**: The "Logon ID" is a unique identifier that Windows assigns to each user login session. Whenever a user logs on, a new Logon ID is generated and recorded in the security event log. 2. **Utility**: It is crucial in tracking user activities during a session. By following the trail of a specific Logon ID, investigators can piece together a user's actions on a system. 3. **Event Logs**: This field is found in various Windows Security event log entries, such as Event IDs 4624 (logon), 4634 (logoff), and others related to account use, like 4648 (explicit credentials use). 4. **Correlation**: The Logon ID can be used to correlate login events with other activities, such as file accesses, network activities, or system changes logged under the same session ID. **Considerations** * **Persistence**: Logon IDs persist until the user logs off or the system is restarted. They are not reused across reboots. * **Multiple Sessions**: Users can have multiple active sessions with different Logon IDs. This is common in remote desktop scenarios. * **Event Overlap**: The same Logon ID may appear in events on multiple computers in network logon scenarios. * **Tools for Analysis**: Utilize tools like Event Viewer, PowerShell, or third-party utilities for efficient analysis of event logs. **Technical Explanation** * **Format**: The Logon ID is typically a hexadecimal value (e.g., 0x3E7). * **Locating in Logs**: In Event Viewer, look for the 'New Logon' section in security events, where 'Logon ID' is listed. * **Example Log Entry**: ```yaml yamlCopy codeAn account was successfully logged on. Subject: Security ID: SYSTEM Account Name: WIN-SERVER$ Account Domain: WORKGROUP Logon ID: 0x3E7 Logon Type: 2 New Logon: Security ID: ACME-FRONTDESK\JohnD Account Name: JohnD Account Domain: ACME-FRONTDESK Logon ID: 0x4F3C2 ``` **Using Logon ID in Investigations** 1. **Initial Detection**: Identify a suspicious logon event. Note the Logon ID. 2. **Activity Mapping**: Search for the same Logon ID in other security events to map the user's activities. 3. **Cross-Referencing**: In cases of network logons, check corresponding Logon IDs on other systems. 4. **Building Timelines**: Combine data from various logs to construct a timeline of user activities for a particular session. # Group Membership Windows Group Memberships play a critical role in the security and management of Windows environments, acting as a cornerstone for defining access controls and privileges across networked systems and resources. With the introduction of new auditing capabilities in Windows 10 and Server 2016, Microsoft has significantly enhanced the ability of administrators and security professionals to detect and respond to enumeration activities targeting these sensitive groups and accounts. Enumeration of accounts and groups is a common tactic in the reconnaissance phase of an attack, allowing attackers to identify valuable targets for escalation of privileges or lateral movement within a network. #### The Role of Group Memberships in Security Group memberships define the access level and permissions that user accounts have within a Windows environment. Sensitive groups, such as Domain Admins, Enterprise Admins, and local Administrators, provide elevated privileges that are often targeted by attackers to gain control over systems and data. #### Enumeration Tools and Techniques Tools like PowerView and frameworks such as Empire and PowerSploit have made it easier for attackers to automate the discovery of valuable accounts and group memberships within a domain. These tools can rapidly identify which accounts are members of high-privilege groups and where these accounts are active, facilitating attacks aimed at gaining elevated access and compromising critical assets. #### Tracking Enumeration Activity with Event Logging Prior to Windows 10 and Server 2016, detecting such enumeration activities through event logs was challenging, as there were no explicit events logged for these actions. However, with the introduction of advanced auditing features, administrators can now enable detailed logging for "Audit Security Group Management" and "Audit User Account Management" events. These logs provide insights into activities around group and account enumeration, offering an early warning system for potential attacks. #### Event IDs and Investigation Focus While the advanced auditing features generate a wealth of data, not all of it is immediately relevant to security investigations. To filter through the noise, investigators should concentrate on: * Enumeration of sensitive groups and accounts. * Accounts that are unlikely to perform legitimate enumeration activities. * Unusual processes used for enumeration, such as PowerShell, WMI, or command-line tools. Allowlisting common processes involved in legitimate enumeration activities can help reduce the volume of logs and highlight potentially malicious actions. #### Implications and Mitigation The ability to detect enumeration activities early in the attack cycle is a significant advantage. It allows organizations to respond to threats before attackers can leverage compromised credentials for further escalation or lateral movement. By monitoring for and analyzing these specific event IDs, security teams can identify suspicious behavior, investigate potential threats, and implement appropriate controls or mitigations to protect against unauthorized access and privilege escalation. #### Conclusion The enhancements in Windows 10 and Server 2016 event logging, specifically around group and account enumeration activities, represent a significant step forward in the detection and response capabilities available to defenders. Understanding and utilizing these logs is essential for maintaining a strong security posture, enabling early detection of reconnaissance activities, and mitigating threats before they can escalate into full-blown attacks. # Event ID: 4798 Event ID 4798 is a critical security event in the Windows operating system, indicating "A user's local group membership was enumerated." This event is part of the advanced security auditing features introduced to provide deeper insight into sensitive operations that could affect the security posture of a Windows environment. It's particularly relevant in the context of monitoring and detecting potential reconnaissance activities by attackers or malicious insiders who are trying to understand the local group memberships of users, which can be a precursor to more targeted attacks. ## Key Details of Event ID 4798 * **Log Location**: Security log. * `%SYSTEM ROOT%\System32\winevt\logs\Security.evtx` * **Category**: Account Logon. * **Level**: Information. ## Context and Importance The enumeration of a user's local group membership is a common step in the reconnaissance phase of an attack, where an adversary seeks to identify the local groups a user belongs to. This information can be used to tailor subsequent attacks, such as privilege escalation or lateral movement, based on the privileges associated with these groups. Therefore, monitoring Event ID 4798 can help in identifying unauthorized or suspicious enumeration activities early in the attack lifecycle. ## When Event ID 4798 Is Logged This event is logged when an application or process, such as a script run via PowerShell, queries the local group memberships of a user account. This can happen through various means, including command-line tools, scripts, or software that makes explicit calls to Windows API functions designed to retrieve group membership information. ## Detailed Information Contained in the Event An Event ID 4798 log contains several pieces of information that are crucial for analysis: * **Subject**: The account that requested the enumeration. This includes the security ID (SID), account name, and domain of the user who performed the enumeration. * **Target User**: The user account whose group memberships were enumerated. This includes the SID, account name, and domain. * **Caller Process ID** and **Name**: The process ID and the name of the process that initiated the enumeration. This is critical for understanding the context of the enumeration, whether it's a legitimate system process or potentially malicious software. * **Detailed Authentication Information**: Additional context about how the enumeration was performed, such as any impersonation levels. ## Security Implications Monitoring and analyzing Event ID 4798 is essential for several reasons: * **Detecting Reconnaissance Activity**: Frequent or unusual patterns of group membership enumeration could indicate reconnaissance by attackers. * **Identifying Misuse of Credentials**: The event can signal the misuse of legitimate credentials to gather information on group memberships, potentially for privilege escalation. * **Auditing and Compliance**: For organizations subject to regulatory requirements, logging and auditing access to sensitive information, such as group memberships, can be a compliance necessity. ## Analysis and Response Security teams should incorporate the monitoring of Event ID 4798 into their security operations center (SOC) activities, using SIEM tools to aggregate and analyze these events for patterns that may indicate suspicious behavior. Correlation with other events, such as logon events (Event IDs [4624](/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success), [4625](/windows-artifacts/event-ids/security/authentication-account/4625-authentication-failure)) and group modification events (Event IDs 4728, 4729), can provide a more comprehensive view of potential security incidents. ## Best Practices * **Baseline Normal Activity**: Understand and document normal patterns of group membership enumeration within your environment to better identify anomalies. * **Alert on Anomalies**: Configure alerts for unusual patterns of enumeration, such as high frequency or enumeration performed by non-standard processes. * **Investigate and Remediate**: Follow up on alerts with thorough investigations to determine the intent and scope of the enumeration, applying remediation actions as necessary to mitigate any identified threats. # Event ID: 4799 Event ID 4799 is a significant security event in Windows environments, signaling "A security-enabled local group membership was enumerated." This event is part of Windows' advanced security auditing capabilities, designed to track and log instances where the membership of sensitive, security-enabled local groups is queried or listed. Monitoring Event ID 4799 is crucial for identifying unauthorized reconnaissance activities that may precede attacks aimed at privilege escalation or lateral movement within a network. #### Key Details of Event ID 4799 * **Log Location**: Security log. * `%SYSTEM ROOT%\System32\winevt\logs\Security.evtx` * **Category**: Account Logon. * **Level**: Information. #### When Event ID 4799 Is Logged Event ID 4799 is generated when a process or user queries the membership of a security-enabled local group. This can occur under various circumstances, including but not limited to: * Administrative activities involving group management. * Scripts or applications designed to audit or report on group memberships. * Potentially malicious activities where an attacker enumerates group memberships to identify targets for privilege escalation. #### Information Contained in the Event An Event ID 4799 log includes detailed information that aids in understanding the context and potential implications of the enumerated group membership: * **Subject**: The account that requested the enumeration. Includes the Security ID (SID), account name, and domain of the user who performed the enumeration. * **Security Group Information**: Details about the local group that was enumerated, including its name and SID. * **Caller Process Information**: Identifies the process that initiated the enumeration, including the process ID and name. This is critical for distinguishing between legitimate administrative actions and potentially malicious activities. #### Security Implications The logging of Event ID 4799 serves several important purposes in the context of security monitoring and incident response: * **Reconnaissance Detection**: Frequent or unusual enumeration of group memberships may indicate reconnaissance by attackers seeking to understand the network's security posture. * **Policy and Compliance**: For organizations subject to regulatory requirements, auditing access to and enumeration of security-sensitive group memberships can be a compliance necessity. * **Forensic Analysis**: In the aftermath of a security incident, logs of group membership enumeration can provide valuable forensic evidence, helping to reconstruct the sequence of events leading up to a breach. #### Analysis and Response Strategies To effectively leverage Event ID 4799 for security purposes, organizations should adopt the following strategies: * **Baseline Establishment**: Understand normal patterns of group membership enumeration within the environment to identify deviations that could signify malicious activities. * **Alert Configuration**: Set up alerts for anomalous enumeration activities, especially those involving sensitive groups or performed by unusual or unauthorized processes. * **Investigation and Remediation**: Follow up on alerts with thorough investigations to determine the nature and intent of the enumeration, applying remediation actions as necessary to address any identified security threats. # RDP ### Key Points 1. **Remote Desktop Protocol (RDP) Artifacts**: RDP is a proprietary protocol developed by Microsoft which allows a user to connect to another computer over a network connection. Key artifacts include event logs, registry entries, and file system traces. 2. **RDP-Related Processes**: * **Source Host**: The process `mstsc.exe` is launched when initiating an RDP connection. * **Destination Host**: Processes like `svchost.exe` and `termsrv.dll` are involved in handling incoming RDP connections. 3. **Important Registry Key**: * On the Source Host, the key `NTUSER\Software\Microsoft\Terminal Server Client\Servers` records recent RDP connections. 4. **Event Log Analysis**: * Essential for tracking RDP sessions, with specific Event IDs (4624, 4778, 4779) providing detailed information about RDP activities. ### Considerations * **Security Implications**: Unauthorized RDP access is a common method for lateral movement in cyber attacks. * **Log Centralization**: Centralizing logs aids in quickly identifying malicious patterns across all endpoints. * **Tool Usage**: Attackers often use the same tools as network administrators for lateral movement. ### Technical Explanations ### **Event Log Tracking** * **Event IDs**: * **4624**: Logs RDP logons (Logon Type 10 – Remote Interactive). * **4778**: Tracks RDP session reconnections. * **4779**: Records session disconnections. * **Locations**: * Security Event Logs: `%SYSTEMROOT%\System32\winevt\logs\Security.evtx`. * RDP-specific Logs: * `Microsoft-Windows-RemoteDesktopServices-RDPCoreTS/Operational` * `Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational` * `Microsoft-Windows-TerminalServices-LocalSessionManager/Operational` ### **Source Host Artifacts** * **Registry Entries**: * Recent Connections: `NTUSER\Software\Microsoft\Terminal Server Client\Servers`. * RegRipper Plugin: `rdphint` for parsing RDP registry keys. * **File System Traces**: * Default RDP Connection File: `Default.rdp` in the user profile. * RDP Bitmap Cache Files: Fragments can be reassembled using `bmc-tools.py`. * Jump List Data: Traces from `mstsc.exe`. {% tabs %} {% tab title="Event Log" %} **security.evtx:** [Event ID 4648](https://system32.eventsentry.com/security/event/4648) – Logon specifying alternate credentials * Current logged-on User Name * Alternate User Name * Destination Host Name/IP * Process Name **Microsoft-WindowsTerminalServicesRDPClient%4Operational.evtx**\ [Event ID 1024 ](https://salt4n6.com/2019/09/22/event-id-1024/)\ \- Destination Host Name \ Event ID 1102 \ \- Destination IP Address {% endtab %} {% tab title="Registry" %} * Remote desktop destinations are tracked per-user * `NTUSER\Software`\ `Microsoft\Terminal Server Client\Servers` * [ShimCache](broken://spaces/LHltGerC23QVyjq1LSxc/pages/ihpcmfjBmYkTGpgSNWk5) – SYSTEM * mstsc.exe Remote Desktop Client * [BAM/DAM](broken://spaces/LHltGerC23QVyjq1LSxc/pages/izxtnm4GeGsoJOftuxvi) – SYSTEM – Last Time Executed * mstsc.exe Remote Desktop Client * [AmCache.hve](broken://spaces/LHltGerC23QVyjq1LSxc/pages/BicH3sBBfCQNkjhCDL2w) – First Time Executed * mstsc.exe * [UserAssist](broken://spaces/LHltGerC23QVyjq1LSxc/pages/BGfQvBR8PSlmeRDHGLjb) – NTUSER.DAT * mstsc.exe Remote Desktop Client execution * Last Time Executed * Number of Times Executed * RecentApps – NTUSER.DAT * mstsc.exe Remote Desktop Client execution * Last Time Executed * Number of Times Executed * RecentItems subkey tracks connection destinations and times {% endtab %} {% tab title="File System" %} * [Jumplists ](broken://spaces/LHltGerC23QVyjq1LSxc/pages/oNWH7ISNNtZHVOEEcQgG)– C:\Users\\ AppData\Roaming\Microsoft\Windows\ Recent\AutomaticDestinations\\ * {MSTSC-APPID}- automaticDestinations-ms * Tracks remote desktop connection destination and times * [Prefetch ](broken://spaces/LHltGerC23QVyjq1LSxc/pages/mngP23Kjwo0DI64Sadh3)– C:\Windows\Prefetch * mstsc.exe-{hash}.pf * Bitmap Cache – C:\USERS\\ AppData\Local\Microsoft\Terminal Server Client\Cache * bcache##.bmc * cache####.bin {% endtab %} {% endtabs %} ### **Destination Host Artifacts** * **Event Log IDs**: 4624 (Type 10), 4778, 4779. * **Specialized Logs**: * `Microsoft-Windows-TerminalServices-RDPClient/Operational` for tracking attacker movement from the source system. ### **Alternate Remote Access Tools** * **VNC**: * Event Log ID 4624 (Type 2 – Console logon). * Application-specific logs and registry entries. * **TeamViewer**: * Source System: `TeamViewerX_Logfile.log` in `C:\Program Files\TeamViewer\VersionX`. * Target System: `Connections_incoming.txt`. ### **Security Settings** * **Active Directory Settings**: “Deny log on through Remote Desktop Services” for sensitive accounts. * **Host Level Settings**: Disabling RDP service, configuring Windows Firewall to deny inbound RDP connections. ### Example Logs * **Event ID 4624**: ```yaml Log Name: Security Event ID: 4624 Logon Type: 10 Account Name: [Username] Source Network Address: [IP Address] ``` * **Event ID 4778**: ```yaml Log Name: Security Event ID: 4778 Account Name: [Username] Session Reconnected to: [Target Machine Name] ``` * **Event ID 4779**: ```yaml Log Name: Security Event ID: 4779 Account Name: [Username] Session Disconnected from: [Target Machine Name] ``` ### Example Command Lines * **Starting RDP Session**: ```bash mstsc.exe /v:[TargetHost] ``` * **Using VNC**: ```bash vncviewer.exe [TargetHost] ``` * **Launching TeamViewer**: ```bash TeamViewer.exe ``` # Source System Artifacts - Quick Reference {% tabs %} {% tab title="Event Log" %} **security.evtx:** [Event ID 4648](/windows-artifacts/event-ids/security/authentication-account/4648-explicit-credentials-success) – Logon specifying alternate credentials * Current logged-on User Name * Alternate User Name * Destination Host Name/IP * Process Name **Microsoft-WindowsTerminalServicesRDPClient%4Operational.evtx**\ Event ID 1024 \ \- Destination Host Name \ Event ID 1102 \ \- Destination IP Address {% endtab %} {% tab title="Registry" %} * Remote desktop destinations are tracked per-user * `NTUSER\Software`\ `Microsoft\Terminal Server Client\Servers` * ShimCache – SYSTEM * mstsc.exe Remote Desktop Client * BAM/DAM – SYSTEM – Last Time Executed * mstsc.exe Remote Desktop Client * AmCache.hve – First Time Executed * mstsc.exe * UserAssist – NTUSER.DAT * mstsc.exe Remote Desktop Client execution * Last Time Executed * Number of Times Executed * RecentApps – NTUSER.DAT * mstsc.exe Remote Desktop Client execution * Last Time Executed * Number of Times Executed * RecentItems subkey tracks connection destinations and times {% endtab %} {% tab title="File System" %} * Jumplists * `C:\Users`\ `AppData\Roaming\Microsoft\Windows`\ `Recent\AutomaticDestinations\` * {MSTSC-APPID}- automaticDestinations-ms * Tracks remote desktop connection destination and times * [Prefetch ](/windows-artifacts/program-execution/prefetch)– C:\Windows\Prefetch * mstsc.exe-{hash}.pf * Bitmap Cache * `C:\USERS`\ `AppData\Local\Microsoft\Terminal Server Client\Cache` * bcache##.bmc * cache####.bin {% endtab %} {% endtabs %} # Destination System Artifacts - Quick Reference {% tabs %} {% tab title="Event Logs" %} **Security Event Log – security.evtx** * [**4624**](/windows-artifacts/event-ids/security/authentication-account/4624-authentication-success) Logon Type 10 * Source IP/Logon User Name * [**4778**](https://system32.eventsentry.com/security/event/4778)/[**4779** ](https://system32.eventsentry.com/security/event/4779) * IP Address of Source/Source System Name * Logon User Name **Microsoft-Windows-RemoteDesktopServices-RdpCoreTS%4Operational.evtx** * **131** – Connection Attempts * Source IP * **98** – Successful Connections **Microsoft-Windows-Terminal Services-RemoteConnection Manager%4Operational.evtx** * 1149 * Source IP/Logon User Name * Blank user name may indicate use of Sticky Keys **Microsoft-Windows-Terminal Services-LocalSession Manager%4Operational.evtx** * 21, 22, 25 * Source IP/Logon User Name * 41 * Logon User Name {% endtab %} {% tab title="Registry" %} ShimCache - System * rdpclip.exe * tstheme.exe AmCache.hve - First Time Executed * tstheme.exe * rdpclip.exe {% endtab %} {% tab title="File System" %} [Prefetch ](/windows-artifacts/program-execution/prefetch)– C:\Windows\Prefetch * rdpclip.exe-{hash}.pf * tstheme.exe-{hash}.pf {% endtab %} {% endtabs %} # SSH #### Key Points 1. **SSH-Related Processes**: * **Source Host**: Processes like `ssh.exe` or third-party SSH client executables. * **Destination Host**: The SSH server process, typically `sshd`, handles incoming SSH connections. 2. **Important Registry Keys and Configuration Files**: * **Source Host**: Registry keys for third-party SSH clients (e.g., PuTTY stores sessions in `HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions`). * **Destination Host**: Configuration file `sshd_config` located in the SSH installation directory. 3. **Event Log Analysis**: * Windows does not natively log SSH connections in Event Viewer. However, third-party SSH server logs on the destination host can provide connection details. 4. **Alternate Secure Access Methods**: * Awareness of other secure access methods like OpenVPN or WireGuard used for secure connections. 5. **Security Configuration**: * Implementing strict access control and monitoring on SSH usage, especially for administrative access. 6. **Artifact Locations**: * Locating SSH client and server logs, configuration files, and relevant registry entries is crucial for thorough forensic investigation. #### Considerations * **Security Implications**: Unauthorized SSH access is a potential method for data exfiltration and lateral movement in cyber attacks. * **Limited Windows Logging**: Native Windows Event Logs do not typically record SSH activities, necessitating reliance on third-party logs and tools for monitoring. * **Encryption**: SSH encrypts all traffic, including login credentials, making network-based detection more challenging. #### Technical Explanations **SSH on Windows** * **Windows 10 and Later**: Integrated OpenSSH client (`ssh.exe`) and server (`sshd`). * **Third-Party Applications**: Applications like PuTTY, WinSCP, and Bitvise SSH Client are commonly used. **Log Analysis** * **SSH Server Logs**: On the destination host, `sshd` logs can be found in the installation directory, providing details on connections, authentication, and errors. * **Client Logs**: Some SSH clients maintain logs of connection attempts and sessions. **Security Settings** * **Configuration Best Practices**: * Restricting SSH access to specific users and groups. * Disabling root login over SSH. * Using key-based authentication instead of passwords. * **Monitoring and Auditing**: * Implementing centralized logging and monitoring solutions for SSH activities. #### Example Logs * **SSH Server Log Entry**: ```rust Accepted password for user1 from 192.168.1.100 port 54022 ssh2 Session opened for user user1 by (uid=0) ``` * **PuTTY Session Registry Entry**: ```csharp HKEY_CURRENT_USER\Software\SimonTatham\PuTTY\Sessions\session_name "HostName"="192.168.1.100" "UserName"="user1" ``` #### Example Command Lines * **Starting an SSH Session (Client)**: ```bash ssh.exe user1@192.168.1.100 ``` * **Basic Connection** ```bash putty.exe -ssh username@hostname ``` * **Specifying a port** ```bash putty.exe -ssh username@hostname -P portnumber ``` * **Using a Private Key** ```bash putty.exe -ssh username@hostname -i C:\path\to\private_key.ppk ``` * **Saving Session Information** ```bash putty.exe -load "session_name" ``` * **Enabling X11 Forwarding** * X11 forwarding is a feature of the SSH (Secure Shell) protocol that enables the graphical output of an application running on a remote server to be displayed on a local client machine. ```bash putty.exe -ssh username@hostname -X ``` # Rouge Local Accounts 1. **Manual Creation:** * **Control Panel:** Using 'User Accounts' in the Control Panel. * **Computer Management:** Under 'Local Users and Groups', new users can be added, groups can be managed, and user properties can be edited. 2. **Command Line:** * **`net user` Command:** For creating users and setting properties. * Example: `net user [username] [password] /add` to create a new user. 3. **PowerShell:** * **`New-LocalUser` Cmdlet:** Creates a new local user account. * Example: `New-LocalUser -Name "username" -Password (ConvertTo-SecureString "password" -AsPlainText -Force) -FullName "User Name" -Description "Description"` 4. **Group Policy:** * For domain environments, group policies can be used to manage user accounts across multiple systems. **Querying User Accounts on a Host** 1. **Command Line Tools:** * **`net user`** * Lists all user accounts on a local machine or domain controller. * **`wmic useraccount`** * Provides detailed information about user accounts. 2. **PowerShell:** * **`Get-LocalUser`** * Retrieves local user accounts. * **Custom Scripts:** Can be written to query specific account properties or filter results. 3. **Windows Management Instrumentation (WMI):** * Allows querying of user accounts and their properties through WMI queries. **Expanded Technical Explanations** 1. **System Logs Analysis:** * **Event IDs:** Look for Event IDs 4720 (account creation), 4722 (account enabled), and 4732 (added to group). * **Log Source:** Primarily found in Security logs of Windows Event Viewer. 2. **Identifying Unauthorized Accounts:** * **Account Properties:** Analyze properties like creation date, last login date, group memberships, and whether the account is active or disabled. * **Baseline Comparison:** Compare current user accounts against a known good baseline of authorized accounts. **Advanced Considerations** * **Least Privilege Principle:** Regularly review and enforce least privilege access policies to minimize the impact of rogue accounts. * **Anomalous Behavior Detection:** Implement systems to detect anomalous behaviors such as unusual login times or excessive privilege escalations. * **Incident Response Drills:** Regularly conduct drills to ensure readiness for incidents involving rogue accounts. **PowerShell Query** ```powershell #PowerShell command to list all local users with their last login time Get-LocalUser | Select-Object Name,Enabled,LastLogon | Format-Table -AutoSize ``` # CrowdStrike Searches **User Login Success** ````splunk-spl index=main sourcetype=UserLogon* event_simpleName=UserLogon event_platform=win | search UserName="USERNAME" ```Add your UserName here``` | eval LogonType=case(LogonType_decimal="2", "Interactive", LogonType_decimal="3", "Network", LogonType_decimal="4", "Batch", LogonType_decimal="5", "Service", LogonType_decimal="6", "Proxy", LogonType_dgecimal="7", "Unlock", LogonType_decimal="8", "Network Cleartext", LogonType_decimal="9", "New Credentials", LogonType_decimal="10", "RDP", LogonType_decimal="11", "Cached Credentials", LogonType_decimal="12", "Auditing", LogonType_decimal="13", "Unlock Workstation") | table _time, UserName, ComputerName, LocalAddressIP4, LogonType, LogonDomain ```` **User Login Failed** ````splunk-spl index=main sourcetype=UserLogon* event_simpleName=UserLogonFailed* event_platform=win SubStatus_decimal!=0 | search UserName="USERNAME" ```Add your UserName here``` | eval SubStatus_decimal=tostring(SubStatus_decimal,"hex") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000064", "User name does not exist") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC000006A", "User name is correct but the password is wrong") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000234", "User is currently locked out") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000072", "Account is currently disabled") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC000006F", "User tried to logon outside his day of week or time of day restrictions") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000070", "Workstation restriction, or Authentication Policy Silo violation (look for event ID 4820 on domain controller)") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000193", "Account expiration") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000071", "Expired password") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000133", "Clocks between DC and other computer too far out of sync") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000224", "User is required to change password at next logon") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC0000225", "Evidently a bug in Windows and not a risk") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xc000015b", "The user has not been granted the requested logon type (aka logon right) at this machine") | eval SubStatus_decimal=replace(SubStatus_decimal,"0xC000006E", "Unknown user name or bad password") | eval LogonType=case(LogonType_decimal="2", "Interactive", LogonType_decimal="3", "Network", LogonType_decimal="4", "Batch", LogonType_decimal="5", "Service", LogonType_decimal="6", "Proxy", LogonType_dgecimal="7", "Unlock", LogonType_decimal="8", "Network Cleartext", LogonType_decimal="9", "New Credentials", LogonType_decimal="10", "RDP", LogonType_decimal="11", "Cached Credentials", LogonType_decimal="12", "Auditing", LogonType_decimal="13", "Unlock Workstation") | table _time, UserName, ComputerName, LocalAddressIP4, LogonType, SubStatus_decimal, LogonDomain | sort - failedCount ```` **RDP to Host** ````splunk-spl event_platform=win event_simpleName=UserLogon RemoteAddressIP4!="" LogonType_decimal=10 | search (UserName="USERNAME" OR ComputerName="COMPUTERNAME") ```Change the user or hostname. If only one is present, use a *.``` | stats dc(RemoteAddressIP4) AS "Unique IPs" count(RemoteAddressIP4) AS "Connection Count" values(RemoteAddressIP4) by aid , ComputerName, UserName, UserSid_readable | sort -"Connection Count" | rename aid AS "Agent ID", values(RemoteAddressIP4) AS "Connecting IP" ```` **RDP from Host** ````splunk-spl index=main event_platform=win sourcetype IN (NetworkConnectIP4*, ProcessRollup2*) (event_simpleName=NetworkConnectIP4 AND RPort=3389) OR event_simpleName=ProcessRollup2 | search (UserName="USERNAME" OR ComputerName="COMPUTERNAME") ```Change the user or hostname. If only one is present, use a *.``` | eval falconPID=coalesce(TargetProcessId_decimal, ContextProcessId_decimal) | stats dc(event_simpleName) as eventCount, earliest(ContextTimeStamp_decimal) as ConnectionTime, values(ComputerName) as ComputerName, values(FileName) as FileName, values(CommandLine) as CommandLine, values(RemoteIP) as RemoteIP, values(RPort) as RemotePort by aid, falconPID | where eventCount > 1 | table ConnectionTime, ComputerName, FileName, falconPID, CommandLine, RemotePort, RemoteIP | convert ctime(ConnectionTime) ```` **SSO Requests** ````splunk-spl index=main sourcetype=SsoApplication* event_simpleName=SsoApplicationAccess | search SourceAccountUserName="USERNAME" ```Change the username``` | rename event_err as "Event Error?" | rename _time as Time | rename SourceAccountUserName as UserName | rename SourceEndpointAddressIP4 as "Source IP" | rename SsoApplicationIdentifier as "SSO Application" | rename ClientUserAgentString as "User Agent" | table Time, UserName, "Source IP", "SSO Application","User Agent", "Event Error?" ```` # Event Name - UserLogon **Description** Platforms: *Linux, Windows, macOS* This event is generated when a user logs on to a host. Platforms: *ChromeOS* Fields: Linux, Windows, macOS | Field | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ContextTimeStamp | System time of event creation. | | UserName | | | LogonTime | | | LogonType |

Values:

| | UID | Unix User Identifier. | | UserIsAdmin | Set to TRUE if this user is a local admin. | | PasswordLastSet | | | RemoteAddressIP4 | | | RemoteAddressIP6 | |
# Event Name - UserLogonFailed UserLogonFailed2 will aggregate data from Falcon and Windows ETW when available (assuming you're using a more modern Windows operating system) and UserLongFailed will rely exclusively on Falcon data. **Description** **Platforms:** *Windows* This event is generated when a user logon fails. **Fields: Windows** | Field | Description | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ContextTimeStamp | System time of event creation. | | ContextProcessId | UPID of process originating this event. | | ContextThreadId | UTID of thread originating this event | | TreeId | If this event is part of a detection tree, the tree ID it is part of. | | UserSid |

The User Security Identifier (UserSID) of the user who executed the command. A UserSID uniquely identifies a user in a system.

Values:

| | UserName | | | LogonTime | | | PasswordLastSet | | | UserLogonFlags |

Values:

| # Event Name - UserLogonFailed2 UserLogonFailed2 will aggregate data from Falcon and Windows ETW when available (assuming you're using a more modern Windows operating system) and UserLongFailed will rely exclusively on Falcon data. **Description** **Platforms:** *Linux, ChromeOS, macOS* **Platforms:** *Windows* An event that indicates that a local user attempted to logon, but failed due to bad password. LogonTime is the last successful logon time. The remote information will be present only if the logon originated over the network. RawProcessId will attribute a pid if relevant. **Fields: Linux, ChromeOS, macOS** | Field | Description | | ---------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | ContextTimeStamp | System time of event creation. | | UserName | | | LogonTime | | | LogonType |

Values:

| | UID | Unix User Identifier. | | UserIsAdmin | Set to TRUE if this user is a local admin. | | PasswordLastSet | | | RemoteAddressIP4 | | | RemoteAddressIP6 | |
# Event Name - SsoApplicationAccess **Description** **Platforms:** *Public Cloud* Indicates successful access to an application through an SSO facilitator, which could be either an IDaaS directory, a federation portal, or a combination of both, such as Azure with AD-FS. **Fields: Public Cloud** | Field | Description | | ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | ActivityId | A globally-unique identifier for the activity event. | | ContextTimeStamp | System time of event creation. | | SsoEventSource |

The source from which the activity data was retrieved. In the case of federated-SSO, this might be either the IDaaS vendor or the federation provider, depending on the retrieval method.

Values:

| | WebSessionIdentifier | | | SourceAccountUserName | The username associated with this activity. | | SourceAccountAzureId | The unique Azure `userId` value of the user associated with this activity | | SourceAccountOktaId | The unique OKTA actor ID of the user associated with this activity | | SourceAccountObjectSid | The `objectSid` value of the account bound with this activity. | | SourceAccountObjectGuid | The `objectGUID` value of the account bound with this activity. | | SourceEndpointAddressIP4 |

The IP address of the endpoint from which this activity originates.

Mutually exclusive with the SourceEndpointAddressIP6 field.

| | SourceEndpointAddressIP6 |

The IP address of the endpoint from which this activity originates.

Mutually exclusive with the SourceEndpointAddressIP4 field.

| | SourceEndpointIpReputation |

The reputation attributes of the source IP (SourceEndpointAddressIP4 or SourceEndpointAddressIP6).

Only set for public addresses.

Values:

| | SourceEndpointNetworkType |

The network type to which the SourceEndpointAddressIP4 or SourceEndpointAddressIP6 value belongs, depending on customer configuration.

Values:

| | SourceEndpointNetworkTag | The network tag to which the `SourceEndpointAddressIP4` or `SourceEndpointAddressIP6` value belongs, depending on customer configuration. | | SourceEndpointHostName |

The hostname of the source endpoint. Might originate either directly from the raw event data or from one of the host association resolution methods.

When available, either the SourceEndpointAccountObjectSid or SourceEndpointAccountObjectGuid fields are superior for use as foreign keys.

| | SourceEndpointAccountObjectSid | The `objectSid` value of the source endpoint account. | | SourceEndpointAccountObjectGuid | The `objectGUID` value of the source endpoint account. | | ClientUserAgentString | The HTTP User-Agent string identified by the client. | | ClientIdentifier | A human readable string identifying the client, if available. | | LocationLongitudeAsInt |

The location longitude value associated with the event.

The value is a 4-digit precision fixed-point value (11.1m) represented as a 64-bit integer.

Divide by 100,000 to get back the fixed-point value

| | LocationLatitudeAsInt |

The location latitude value associated with the event.

The value is a 4-digit precision fixed-point value (11.1m) represented as a 64-bit integer.

Divide by 100,000 to get back the fixed-point value.

| | LocationAccuracyRadius | The reported accuracy radius for (`LocationLatitudeAsInt`, `LocationLongitudeAsInt`). | | LocationCountryCode | The country-code associated with (`LocationLatitudeAsInt`, `LocationLongitudeAsInt`). | | LocationStateCode | The state-code associated with (`LocationLatitudeAsInt`, `LocationLongitudeAsInt`). | | LocationCityCode | The city-code associated with (`LocationLatitudeAsInt`, `LocationLongitudeAsInt`) as listed in the *GeoNames* database. | | SsoApplicationIdentifier |

The human-readable target application identifier.

For stronger identification, use either the SsoApplicationUri field, or vendor-specific fields such as AzureApplicationId.

| | SsoApplicationUri | The URL or URN of the target application. | | AzureApplicationId | The unique Azure `appId` value of the application accessed. Is only available when the `SsoEventSource` field is set to `AZURE`. | | OktaApplicationId |

The unique Okta actor ID of the application being accessed.

Only set if the SsoEventSource field is set to OKTA.

| | AppliedDisposition | A bit mask of the disposition the sensor has applied. | | IdpEntityId | |
# Browser Usage # History & Downloads The analysis of browser history and download history is a fundamental aspect of digital forensics, especially when investigating the online activities of a user on a device. These artifacts can provide insights into user behavior, interests, and interactions with websites over time. Let's dive deep into the significance of these artifacts, their locations across different operating systems, and how they can be utilized in forensic investigations. ## Browser History Artifacts Browser history records include URLs visited, the date and time of each visit, the [transition type](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/history-and-downloads/transition-types), and often the frequency of visits to each site. This information is crucial for building a timeline of user activity and can be pivotal in legal cases, corporate investigations, and security breach analyses. ## Download History Artifacts Download history tracks files downloaded through the browser, including the source URL, the file name, and when the download occurred. This can be critical for identifying malicious downloads, intellectual property theft, or unauthorized data exfiltration. ## Storage Locations ### **Firefox** * **Windows XP**: ```sh C:\Users\USER\Application Data\Mozilla\Firefox\Profiles\.default\places.sqlite ``` * **Windows 7 and later**: ```sh C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\.default\places.sqlite ``` The `places.sqlite` file contains both the browser and download history in Firefox. ### **Google Chrome** * **Windows XP**: ```sh C:\Users\USER\Local Settings\Application Data\Google\Chrome\User Data\\History ``` * **Windows 7 and later:** ```sh C:\Users\USER\AppData\Local\Google\Chrome\User Data\\History ``` * **MacOS**: ```sh /Users/USERNAME/Library/Application Support/Google/Chrome/default/history ``` Chrome stores its history in a file named `History` within the user's profile directory. Multiple profiles may exist, including "Default", "Profile 1", etc. ### **Microsoft Edge** * **Windows 7 and later**: ``` C:\Users\USER\AppData\Local\Microsoft\Edge\User Data\default\history ``` Edge, being a Chromium-based browser, similarly stores history in a `History` file within the user data directory of the user's profile. ## Forensic Analysis 1. **User Activity Timeline**: Browser and download history can be used to construct a timeline of a user's online activities, helping to establish when and how a computer was used. 2. **Investigative Leads**: The examination of sites visited and files downloaded can generate leads in various investigations, including cybercrimes, fraud, and unauthorized access cases. 3. **Profile Identification**: Multiple browser profiles can indicate different users or personas using the same device, each with distinct browsing habits and activities. 4. **Evidence of Malware**: Downloads history can reveal the initial infection vector in malware investigations, pinpointing the source of malicious software. 5. **Cross-Referencing with Other Artifacts**: Browser history can be cross-referenced with other forensic artifacts, such as log files and cached web content, to corroborate findings. ## Challenges and Considerations * **Privacy Concerns**: Handling browser history data must comply with privacy laws and regulations, ensuring that investigations respect legal boundaries. * **Data Volatility**: Browser history can be easily cleared by users, making timely acquisition of digital evidence crucial. * **Encryption and Access**: Some modern browsers encrypt user data, requiring specific tools or credentials for access. # Viewing History Files - DB Browser Extracting and viewing browser history from SQLite databases can provide crucial insights during a forensic investigation. This step-by-step guide will focus on using DB Browser for SQLite, a tool designed to view and edit SQLite databases, which is commonly used for analyzing browser history stored in files like `places.sqlite` (Firefox) and `History` (Chrome, Edge). #### Step 1: Install DB Browser for SQLite 1. **Download**: Go to the official DB Browser for SQLite website () and download the version compatible with your operating system. 2. **Install**: Run the installer and follow the on-screen instructions to install DB Browser for SQLite on your computer. #### Step 2: Locate the Browser History File * **Use** [**this script**](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/powershell-scripts/browser-history-finder) **to find all Browser History files (Chrome, Firefox & Edge) on a system.** * **Firefox**: Find the `places.sqlite` file in the user's profile directory. Example path for Windows 10: ```powershell C:\Users\USER\AppData\Roaming\Mozilla\Firefox\Profiles\.default-release\places.sqlite ``` * **Chrome/Edge**: Locate the `History` file in the user's profile directory. Example path for Chrome on Windows 10: ```powershell C:\Users\USER\AppData\Local\Google\Chrome\User Data\Default\History ``` * **Note**: Replace `USER` with the actual username, and `` with the specific folder name on your system. #### Step 3: Make a Copy of the Database File * **Important**: It’s crucial to work on a copy of the database file to preserve the integrity of the original evidence. * Copy the `places.sqlite` or `History` file to another location where you can safely analyze it. #### Step 4: Open the Database in DB Browser for SQLite 1. **Launch DB Browser for SQLite**: Open the application installed in Step 1. 2. **Open Database**: Click on “Open Database” at the top and navigate to the copy of your database file (`places.sqlite` or `History`). Select the file and click “Open”. #### Step 5: Explore the Database Structure * **View Tables**: Once the database is open, switch to the “Database Structure” tab to see all the tables within the database. For browser history, look for tables like: * Firefox: `moz_places` for website visits. * Chrome/Edge: `urls` for website visits. #### Step 6: View and Query History Data 1. **Browse Data**: Click on the “Browse Data” tab and select the relevant table from the drop-down menu to view its contents. 2. **Custom Queries**: For more detailed analysis, you can run custom SQL queries by switching to the “Execute SQL” tab. Example query for Firefox: ```sql SELECT datetime(visit_date/1000000,'unixepoch') as visit_date, url FROM moz_places, moz_historyvisits WHERE moz_places.id = moz_historyvisits.place_id ORDER BY visit_date DESC; ``` This query joins the visit and URL information, converting the visit date to a readable format and ordering the results by the most recent visits. **For more advanced queries, visit the**[ **DB Browser Queries** ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/db-browser-queries)**section.** #### Step 7: Analyze the Results * Review the displayed data to analyze the user's browser history. Pay attention to visit dates, URLs, and, depending on the query, the frequency of visits or titles of the pages. #### Step 8: Exporting Data * If needed, you can export the query results or table data by right-clicking on the results and selecting “Export” to choose your preferred format, such as CSV, for further analysis or reporting. #### Step 9: Documentation * Document your findings and the steps taken during your analysis, including any specific queries used, for reporting and potential legal proceedings. # Transition Types Transition types in web browsers are used to describe how a navigation to a webpage occurred. Understanding these types is crucial in digital forensics and cybersecurity, as they can provide insights into user behavior, track how content is reached, and detect potentially malicious activities. Below is a deep dive into the common transition types and qualifiers found in browser history databases, particularly in browsers like Google Chrome and Firefox. ## Common Transition Types ### **1. Link** * Description: The user navigated to the page by clicking on a hyperlink. * Significance: Indicates direct user interaction with web content, often reflecting intentional browsing behavior. ### **2. Typed** * Description: The user manually entered the URL in the address bar. * Significance: Suggests purposeful navigation to a specific webpage, potentially highlighting sites of particular interest to the user. ### **3. Manual Subframe** * Description: A subframe (e.g., an iframe) was manually navigated to by the user. * Significance: Less common, but can indicate user interaction within complex web applications. ### **4. Generated** * Description: The URL was automatically generated based on past navigation patterns, such as using the forward or backward buttons, or opening a new tab. * Significance: Reflects user's browsing habits and the use of browser features to navigate web sessions. ### **5. Auto Bookmark** * Description: The URL was triggered from a bookmark. * Significance: Indicates preferred or frequently visited sites saved by the user. ### **6. Auto Top-Level** * Description: Navigation to a top-level URL occurred via an automated process, not directly initiated by the user (e.g., JavaScript, meta refresh, or redirects). * Significance: Can be a regular part of web navigation or indicate redirection by ads or potentially malicious content. ### **7. Reload** * Description: The user reloaded the page, either from a menu option or by using a keyboard shortcut. * Significance: May suggest interest in the page content or issues with page loading. ### **8. Keyword** * Description: The URL was loaded by using a search engine with keywords. * Significance: Demonstrates use of search engines to find content, can indicate interests or topics of research. ### **9. Keyword Generated** * Description: The URL was generated from a replaceable keyword other than the default search provider. * Significance: Shows customized search engine use or specialized search methods. ## Qualifiers Qualifiers provide additional context to the basic transition types: * **Client Redirect**: Navigation occurred via client-side redirection (e.g., JavaScript, HTML meta tags). * **Server Redirect**: Occurs due to server-side redirection (HTTP 301/302 responses). * **Forward Back**: User navigated using the browser's forward or back buttons. * **From Address Bar**: Indicates direct entry of the URL in the address bar, overlapping with the Typed transition type. ## Other Transition Types * **Reset**: Navigation is incoming, initialized by the browser or scripts. * **Reload Ignore Cache**: The user forces a reload that bypasses the cache, often to retrieve the most up-to-date content. * **Form Submit**: Indicates navigation through form submission, common in web applications for login pages, searches, or data entry. * **Named Outbound**: A new named window or tab is created and navigated by another window, often via JavaScript. # Auto-Complete Data AutoComplete data in web browsers provides a rich source of information for digital forensics and incident response professionals. This data, generated by users as they fill out forms and search fields on the web, is stored locally by browsers to enhance the user experience by predicting and filling in information in similar forms in the future. Here's an overview of how AutoComplete data is stored across different browsers and its forensic implications. ## **Mozilla Firefox** ### **Location of AutoComplete Data**: * **Form History**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\formhistory.sqlite` * **Places Database**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\places.sqlite` The `formhistory.sqlite` database stores information that users have entered into web forms, while `places.sqlite` contains records of URLs, including those typed into the address bar, enhancing the browser's ability to autocomplete URLs based on partial user inputs. ## **Google Chrome and Microsoft Edge** ### **History**: * Chrome: `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\\History` * Edge: `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\History` These `History` files contain URLs that have been visited, search queries, and may also include titles of visited web pages, facilitating a predictive typing feature for URLs and search queries. ### **Web Data** (Chrome and Edge): * `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Web Data` * `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Web Data` The `Web Data` file is critical for storing AutoComplete information related to web forms, including names, addresses, search terms, and other entries made by the user. * **Shortcuts and Network Action Predictor**: * These files store information related to frequently visited websites and are used to predict user actions based on their browsing habits. * **Login Data**: * Chrome: `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Login Data` * Edge: `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Login Data` The `Login Data` files are particularly sensitive, as they contain information related to websites where the user has entered a username and password, potentially including encrypted passwords. ## **Forensic Implications** The forensic analysis of AutoComplete data can reveal: * User behavior and interaction with specific websites. * Potential credentials and sensitive personal information. * Patterns that may help in understanding a user's habits or intentions. Analyzing these files requires specialized tools and knowledge of database structures to interpret the data correctly. It's crucial to handle this data with care due to its potential sensitivity and the ethical and legal considerations involved in accessing personal information. A tutorial is coming soon! # Bookmarks Bookmarks in web browsers serve as a digital trail of a user's interests and priorities online, marking websites for easy access in the future. These artifacts not only reflect user-chosen content but also include default bookmarks added by the browser. For forensic analysts, bookmarks can provide valuable insights into a subject's online behavior, interests, and activities. Here's an in-depth look at how bookmarks are stored and managed in popular browsers like Firefox, Google Chrome, and Microsoft Edge. #### Firefox Bookmarks **Location** * **Main Bookmarks Database**: ```sql %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\places.sqlite ``` * **Backup Bookmarks**: ```sql %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\bookmarkbackups\bookmarks-.jsonlz4 ``` Firefox stores bookmarks in the `places.sqlite` database, which also houses history and other related data. The browser automatically creates backup copies of bookmarks in the `bookmarkbackups` folder in compressed JSON format (`jsonlz4`), allowing for recovery and analysis even if the main database is corrupted or deleted. #### Chrome and Edge Bookmarks **Location in Chrome** * **Main Bookmarks File**: ```sql %USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Bookmarks ``` * **Backup Bookmarks File**: ```sql %USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Bookmarks.bak ``` **Location in Edge** * **Main Bookmarks File**: ```sql %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Bookmarks ``` * **Backup Bookmarks File**: ```sql %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Bookmarks.msbak ``` Both Chrome and Edge store bookmarks in a JSON format file named `Bookmarks`, making it relatively straightforward to access and analyze bookmark data. These browsers also create backup copies of bookmarks, ensuring that previous states can be recovered or examined. #### Analyzing Bookmark Data 1. **Accessing Bookmark Files**: Navigate to the appropriate location based on the browser. For Firefox, you may need tools capable of reading SQLite databases or decompressing `jsonlz4` files. Chrome and Edge bookmark files can be opened directly with text editors or JSON viewers. 2. **Content of Interest**: Bookmark data typically includes: * The title of the bookmark. * The URL of the bookmarked page. * The date the bookmark was created. * Folder organization for the bookmark, if applicable. 3. **Forensic Implications**: Analyzing bookmarks can reveal: * Websites of interest to the user. * Organizational methods (how bookmarks are sorted into folders). * Potential evidence of planning or research related to a case. * Timestamps that may correlate with other activities or incidents. 4. **Considerations**: It's important to note that a bookmark's presence doesn't necessarily indicate that the site was visited. Users can bookmark pages based on recommendations or for future reference without actually accessing the content at the time of bookmarking. #### Tools for Analysis * **SQLite Browsers**: For Firefox's `places.sqlite`, tools like [DB Browser for SQLite](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/history-and-downloads/viewing-history-files-db-browser) can query and export bookmark data. * **JSON Viewers**: Chrome and Edge bookmark files can be analyzed using any text editor or a specialized JSON viewer for easier navigation of the structure. # Browser Preferences Browser preferences and configuration data are essential in digital forensics, offering insights into user behavior, privacy settings, synchronization preferences, and interaction with websites. These preferences are stored in specific files within the user's profile directory for each browser. Here's how to locate and analyze these files for Mozilla Firefox, Google Chrome, and Microsoft Edge. ## **Mozilla Firefox** * **Location**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\prefs.js` * **Key Insights**: * The `prefs.js` file contains user preferences and configurations, including privacy settings and extensions installed. * It notably includes synchronization status, indicating if and when the browser data (such as bookmarks, passwords, history) was last synced, along with the types of artifacts selected for synchronization. ## **Google Chrome** * **Location**: `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Preferences` * **Format**: JSON * **Key Insights**: * The `Preferences` file in Chrome is a JSON document detailing user settings, extensions, privacy configurations, and more. * **User Interaction**: Fields like `per_host_zoom_levels`, `media-engagement`, and `site_engagement` provide forensic clues about how frequently the user interacts with specific websites, indicating interest or routine behavior. * **Synchronization Data**: Contains detailed information on synchronization status, including last sync time and what types of data (e.g., bookmarks, passwords) were synchronized across devices. ## **Microsoft Edge** * **Location**: `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Preferences` * **Key Insights**: * Similar to Chrome, Edge stores its preferences in a JSON format file, which includes information on user settings and configurations. * **Account Information**: Details about the user's Microsoft account used for synchronization. * **Privacy and Security Settings**: Including `clear_data_on_exit` preferences, indicating if the user opts to clear browsing data upon exiting the browser. * **Synchronization Settings**: Information on what data is being synced, such as favorites, passwords, and other browsing data, along with synchronization status. ## Forensic Analysis of Browser Preferences 1. **Understanding User Behavior**: Analysis of these preferences files can reveal a user's browsing habits, privacy concerns, and interaction with specific websites. 2. **Investigating Sync Data**: Synchronization settings and data can be crucial in cross-device investigations, helping to trace a user's activities across different platforms and devices. 3. **Privacy and Security Preferences**: A user's configuration for data deletion on exit and use of privacy features can indicate awareness or intent to conceal activities. 4. **Tools and Techniques**: Forensic investigators need to be familiar with JSON structure and the specific schema used by each browser to parse and analyze these files effectively. # Cache The web cache represents a critical component in the analysis of digital forensics, especially when reconstructing a user's online activities. By storing web page components locally, browsers can load previously visited pages more quickly. However, from a forensic perspective, this cache provides a snapshot in time of what a user was viewing online, making it an invaluable resource for investigators. ## Overview of Cache Locations ### **Firefox** * **Windows XP**: ```sql %USERPROFILE%\Local Settings\Application Data\Mozilla\Firefox\Profiles\.default\Cache ``` * **Windows 7 and Later**: ```sql %USERPROFILE%\AppData\Local\Mozilla\Firefox\Profiles\.default\Cache ``` * **Firefox 32+ (Windows 7 and Later)**: ```sql %USERPROFILE%\AppData\Local\Mozilla\Firefox\Profiles\.default\cache2 ``` ### **Google Chrome** * **Windows XP**: ```sql %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\\Cache ``` * **Windows 7 and Later**: ```sql %USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Cache ``` ### **Microsoft Edge** * **Windows 7 and Later**: ```sql %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Cache ``` ## Significance of Cached Files in Investigations Cached files offer a rich set of data for forensic analysis: 1. **Visited Websites**: Identifying websites that were visited, even if the browser history has been cleared. 2. **User's Viewed Content**: Providing actual files (HTML, CSS, images, JavaScript) that the user viewed on a given website. 3. **Timestamps**: Showing when the site was first saved to the cache and last viewed, offering insights into the user's browsing timeline. ## Analyzing Cache for Forensic Evidence 1. **Locate Cache Directory**: Navigate to the appropriate cache directory for the browser in question. The path varies depending on the operating system and browser version. 2. **Identify Relevant Files**: Cached files can include `data_#` and `f_####` files (in Chrome and Edge) or be stored within the `cache2` directory in newer versions of Firefox. These files represent the actual web content fetched by the browser. 3. **Use Forensic Tools**: Tools like NirSoft’s WebCacheView, Magnet Forensics Internet Evidence Finder, or custom scripts can help extract and analyze cached web content. These tools can parse the cache files and present the data in a more readable format. 4. **Timestamp Analysis**: Examine file metadata to determine when each cached file was created and last accessed. This helps in constructing a timeline of the user's web activity. 5. **Content Examination**: Review the content of cached files to understand what information the user accessed. This can include reviewing images, reading HTML files, or executing JavaScript in a controlled environment. 6. **Correlation with Other Artifacts**: Correlate cache data with other forensic artifacts like cookies, browser history, and log files to build a comprehensive picture of the user's online behavior. ## Challenges and Considerations * **Volume of Data**: The cache can contain a large volume of data, making manual examination challenging. Automated tools can assist in filtering and analyzing relevant information. * **Privacy and Legal Concerns**: Ensure compliance with privacy laws and legal guidelines when accessing and analyzing cached data. * **Cache Management Policies**: Users or applications can clear the cache, and browsers may automatically manage cached content based on storage limits, potentially affecting the availability of data for analysis. # Cookies Cookies are small pieces of data stored on a user's device by web browsers at the request of websites visited. They play a crucial role in enhancing user experience by remembering login information, preferences, and tracking user activity across sessions and websites. From a digital forensics perspective, cookies are invaluable for providing insights into a user's online behavior, website visits, and activities on those sites. This deep dive will explore how cookies are stored across different browsers and operating systems and how they can be analyzed. ## Cookie Storage Locations ### **Firefox** * **Windows XP**: ```arduino %USERPROFILE%\Application Data\Mozilla\Firefox\Profiles\.default\cookies.sqlite ``` * **Windows 7 and Later**: ```arduino %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\cookies.sqlite ``` Firefox stores cookies in a SQLite database named `cookies.sqlite` within the user's profile directory. ### **Google Chrome** * **Windows XP**: ```sql %USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\\Cookies ``` * **Windows 7 and Later**: ```sql %USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Network\Cookies ``` Chrome initially stored cookies in a file named `Cookies`. In later versions, especially after significant updates around Chrome 80, cookie storage was moved to the `Network\Cookies` directory, still within the SQLite database format. ### **Microsoft Edge** * **Windows 7 and Later**: ```sql %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Network\Cookies ``` Being a Chromium-based browser, Edge follows a similar pattern to Chrome for cookie storage, utilizing the `Network\Cookies` path within the user's profile directory. ## Analyzing Cookies Cookies can be analyzed to extract various pieces of information, such as: * **Hostname/Domain**: Identifies which website set the cookie, providing clues about the sites visited. * **Name and Value**: The actual data stored in the cookie, which can include user identifiers, session tokens, or preferences. * **Path**: The specific path on the domain where the cookie is valid. * **Expiration Date**: Indicates when the cookie will expire and be automatically deleted by the browser. * **Creation and Last Accessed Time**: Timestamps that can help build a timeline of when a website was visited and how often. ## Forensic Analysis Tools and Techniques To extract and analyze cookie data, forensic analysts typically use specialized software or scripts. Tools like DB Browser for SQLite or the SQLite command-line tool can open the `cookies.sqlite` or `Cookies` database files for examination. Analysts can run SQL queries to search for cookies from specific domains, identify cookies that have long expiration periods (which might indicate tracking cookies), or sort cookies by their creation or last access times to infer a timeline of web activity. ## Privacy and Security Considerations Cookies often contain sensitive information, making them a target for attackers and a concern for privacy. Forensic analysts must handle cookie data carefully, ensuring compliance with privacy laws and regulations. Additionally, the presence of cookies from known tracking domains or malicious sites can indicate security or privacy breaches. # Extensions Browser extensions, also known as plugins or add-ons, enhance the functionality of web browsers by adding new features or modifying existing ones. They can range from utility tools, ad blockers, and security plugins to customization themes. From a forensic perspective, analyzing extensions installed on a browser can reveal user preferences, potential sources of malware, and even evidence of specific user actions. Here's a closer look at how extensions are managed in popular browsers like Firefox, Google Chrome, and Microsoft Edge. ## Firefox Extensions * **Firefox 4-25**: * Extensions were managed in SQLite databases: `extensions.sqlite` and `addons.sqlite`. * **Firefox 26+**: * The management of extensions transitioned to JSON files: `addons.json` and `extensions.json`. * **Location**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\` * The JSON format provides detailed information about each installed extension, including the name, installation source, installation time, last update, and plugin status. ## Google Chrome and Microsoft Edge Extensions * **Location**: * Chrome: `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Extensions\\` * Edge: `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Extensions\\` * Extensions are stored in folders named after their unique GUID, with subfolders for each version. * The creation time of the folder can hint at the installation time, but this may be influenced by syncing extensions across devices. * The `manifest.json` file within each extension's folder contains essential details about the extension, including its name, URL, permissions, and version. ## Analyzing Browser Extensions 1. **Identify Installed Extensions**: Navigate to the extensions directory for the browser and profile in question to list all installed extensions, [or use this PowerShell Script](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/15/windows-artifacts/browser-usage/powershell-scripts/browser-history-finder). 2. **Review Extension Metadata**: Examine the `manifest.json` (Chrome/Edge) or `addons.json`/`extensions.json` (Firefox) files to gather information on the extensions, including their purpose, permissions, and version details. 3. **Installation and Update Timestamps**: Use file system metadata (creation and modification times) to determine when extensions were installed or updated. This can provide insights into user behavior or potential points of compromise. 4. **Cross-Device Syncing Considerations**: Be mindful that timestamps might reflect syncing actions rather than direct user installations, especially in environments where users log into their browser accounts on multiple devices. 5. **Investigate Extension Preferences**: For more in-depth analysis, review the preferences files where browsers may store additional data related to extension settings and states. ## Forensic Implications * **User Behavior and Interests**: The types of installed extensions can indicate user interests, such as productivity, privacy, or entertainment. * **Security Analysis**: Malicious or compromised extensions can be vectors for malware, phishing, or data exfiltration. Identifying such extensions is crucial in cybersecurity investigations. * **Evidence of Actions**: Some extensions might keep logs or data related to their functionality, which can serve as evidence of specific online actions or behaviors. # Super Cookies (HTML5 Web Storage) HTML5 Web Storage, often referred to as "Super Cookies," represents a significant evolution in web storage capabilities, allowing websites to store large amounts of data directly on the user's local system. Unlike traditional cookies, which are limited to 4KB of data, HTML5 Web Storage can store up to 10MB of text-based data per domain. This capability enhances web applications by allowing for more complex data to be stored client-side, facilitating offline use cases, faster page loads, and more personalized user experiences. #### Types of HTML5 Web Storage HTML5 Web Storage is divided into two main types: 1. **LocalStorage**: Designed for long-term data storage, LocalStorage data persists across browser sessions. Data stored in LocalStorage does not expire and remains until explicitly cleared by the user or the web application. 2. **SessionStorage**: Aimed at storing data for a single session, SessionStorage data is cleared when the tab or window is closed. It is ideal for sensitive data that should not persist beyond the current session. #### Locations of HTML5 Web Storage Files The storage locations for HTML5 Web Storage vary by browser: * **Mozilla Firefox**: HTML5 data is stored within the `webappstore.sqlite` file located in the user's profile directory. The path to this file is typically `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\webappstore.sqlite`. * **Google Chrome**: Chrome stores its Local Storage data within the `Local Storage` directory under the user's profile. The typical path is `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Local Storage`. * **Microsoft Edge**: Similar to Chrome, Edge stores HTML5 data in the `Local Storage` directory within the user's profile. The path is usually `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Local Storage`. #### Forensic Relevance of HTML5 Web Storage In digital forensics and incident response, HTML5 Web Storage is a valuable source of evidence. It can contain information about user interactions with websites, preferences, and potentially sensitive data. Forensic examiners can analyze the contents of HTML5 Web Storage to: * Identify user activities and interactions with specific websites. * Recover data that may indicate user preferences, settings, or even credentials stored by web applications. * Track and understand sessions, especially in cases involving SessionStorage, to piece together user actions within a specific timeframe. #### Challenges and Considerations While HTML5 Web Storage provides a wealth of information for forensic analysis, it also presents challenges: * **Data Volume**: The large amount of data that can be stored may require significant analysis effort and filtering to identify relevant information. * **Encryption and Obfuscation**: Web applications may encrypt or obfuscate the data stored in HTML5 Web Storage, requiring additional steps to decode or interpret the information. # Media History Media history in Chromium-based browsers like Google Chrome and Microsoft Edge offers a deep insight into the audio and video content consumed by users. This feature tracks media usage on visited websites, logging details such as URLs of the media, playback times, watch durations, and positions within the video at the last playtime. Given its unique storage and the type of data it captures, media history can be a valuable resource in digital forensics investigations, user behavior analysis, and compliance monitoring. #### Location of Media History * **Google Chrome**: ```sql %USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Media History ``` * **Microsoft Edge**: ```sql %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Media History ``` * **Firefox does not have a specific Media History file.** Replace `` with the specific user profile directory, usually "Default" for the primary user, but can include other profiles like "Profile 1", "Profile 2", etc. #### Structure of Media History Media history is stored in a SQLite database, similar to other browsing data, and contains several tables. The three primary tables relevant to media playback analysis are: **1. playbackSession** This table records individual media playback sessions, detailing each instance a media file was played in the browser. Key information includes: * Session identifiers. * Timestamps for when the playback started and ended. * References to the `origin` and `playback` tables for more details. **2. origin** The origin table links media playback to its source, providing: * The origin URL (the root website URL where the media was played). * Additional metadata about the website. **3. playback** This table contains the core details of media interactions, including: * URLs of the media files played. * Last play time indicating when the media was last accessed. * Watch time duration showing the total time spent watching the media. * Last video position indicating where the playback was stopped or ended. #### Forensic Significance The analysis of media history can reveal: * **User Interests and Habits**: Types of media content (e.g., news, educational, entertainment) a user consumes and when. * **Incident Correlation**: Times and origins of media playback can be correlated with other forensic artifacts to build a timeline or context around an incident. * **Policy Compliance**: Verification that users are adhering to organizational policies regarding internet and media use. #### Analyzing Media History To analyze media history: 1. **Access the Media History File**: Navigate to the location based on the user's browser and profile. 2. **Use SQLite Database Tools**: Open the `Media History` database file in a tool like DB Browser for SQLite to view and query the tables. 3. **Run Custom Queries**: Craft SQL queries to extract specific insights, such as listing all media URLs accessed within a certain timeframe, calculating total watch durations, or identifying frequently visited media origins. 4. **Export Data for Reporting**: Most tools allow exporting query results or table data to formats like CSV for further analysis or inclusion in reports. #### Privacy and Security Considerations * **User Consent and Legal Compliance**: Ensure that accessing and analyzing browser data, including media history, complies with privacy laws and regulations. * **Data Sensitivity**: Be aware of the sensitive nature of media consumption data and handle it with appropriate confidentiality and security measures. # Private Browsing # Session Restore Session Restore functionality, integral to modern web browsers, significantly enhances user experience by saving the state of all open tabs and windows. In the event of a crash, update, or deliberate closure, this feature allows users to resume their browsing session seamlessly. From a forensic perspective, the data stored by session restore mechanisms can provide a wealth of information about a user's browsing habits, including visited websites, session times, and more. ## Firefox Session Restore ### **Location in Older Versions** * **Windows 7 and Later**: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\sessionstore.js` ### **Location in Newer Versions** * **Windows 7 and Later**: * Main File: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\sessionstore.jsonlz4` * Backups: `%USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\sessionstore-backups\` Firefox has transitioned from using the `.js` extension for session store files to a compressed format `.jsonlz4`, enhancing storage efficiency and security. These files contain data about open tabs, window configurations, URLs, and, in some cases, form data and page states. ## Chrome Session Restore ### **Location in Older Versions** * `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\\` ### **Location in Newer Versions** * `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Sessions` Chrome stores session information in the `Sessions` directory for newer versions. This includes snapshots of open tabs and windows, facilitating a quick recovery of the browsing session. ## Microsoft Edge Session Restore ### **Location in Older Versions** * `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\` ### **Location in Newer Versions** * `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Sessions` Similar to Chrome, Edge (being Chromium-based) stores session data in the `Sessions` directory for newer versions, allowing users to restore their previous sessions. ## Forensic Analysis of Session Restore Data Analyzing session restore files can unveil: * **Historical Websites**: Lists of URLs opened in each tab, providing a timeline of user activity. * **Referring Websites**: Information about how the user navigated to each site, which can be used to trace a user's browsing path. * **Session Timings**: Data on when sessions started and ended, offering insights into browsing habits. * **Page Content**: HTML, JavaScript, XML, and form data might be stored, revealing what information the user viewed or submitted. * **Browser State**: Additional details like transition types, browser window sizes, and whether tabs were pinned, offering context on user preferences and behaviors. ## Tools and Techniques for Analysis 1. **Accessing Files**: Navigate to the session restore directories based on the browser and OS version. 2. **Decompression and Decoding**: For Firefox's `.jsonlz4` files, use specialized tools or scripts to decompress and decode the contents. 3. **Analysis Software**: Utilize digital forensics tools capable of parsing browser artifacts to analyze session data. Custom scripts may also be written to extract specific information. 4. **Manual Inspection**: In some cases, manually inspecting the session restore files in a text editor can provide immediate insights, though this is less efficient for larger data sets. # Stored Credentials Browser-based stored credentials provide a convenient way for users to access frequently visited sites without the need to re-enter login details. However, from a digital forensics and cybersecurity perspective, these stored credentials are of significant interest as they can reveal user habits, potential access points for unauthorized users, and evidence in investigations. Let's explore the nuances of stored credentials in popular browsers and their forensic implications. ## Firefox Stored Credentials ### **Location** * **File Path**: ```arduino %USERPROFILE%\AppData\Roaming\Mozilla\Firefox\Profiles\.default\logins.json ``` Firefox stores login credentials in the `logins.json` file within the user's profile directory. This file contains an array of encrypted login records, including information such as the hostname, URL, creation time, last used time, times used, and the time of the last password change, all in JSON format. ## Chromium-based Browsers (Chrome and Edge) Stored Credentials ### **Location in Chrome** * **File Path**: ```sql %USERPROFILE%\AppData\Local\Google\Chrome\User Data\\Login Data ``` ### **Location in Edge** * **File Path**: ```sql %USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\\Login Data ``` Chrome and Edge store credentials in a SQLite database named `Login Data` within the user's profile directory. The database includes information like the origin URL, action URL (where the login form was submitted), the username, and timestamps for the date created and date last used. ## Analyzing Stored Credentials 1. **Accessing the Data**: * For Firefox, the `logins.json` file can be directly accessed and read using text editors or JSON parsers. * For Chrome and Edge, accessing the `Login Data` database requires SQLite database tools to view and query the encrypted login records. 2. **Encryption and Decryption**: * Firefox and Chromium-based browsers encrypt the stored passwords using the Windows Data Protection API (DPAPI), ensuring that they are protected at rest. * In Windows 10 and 11, if the user's login account is a Microsoft cloud account, DPAPI utilizes a randomly generated password instead of the user's account password, adding an additional layer of security. * Retrieving the actual credentials typically requires access to the live system with the user's account logged in, as decryption happens on the fly with the correct user context and DPAPI keys. 3. **Forensic Implications**: * Even if the actual passwords are encrypted, the metadata within these files (e.g., URLs, usernames, timestamps) can provide valuable insights into user behavior and potential security risks. * Analysis of stored credentials can reveal patterns in password reuse, identify potentially compromised accounts, and highlight websites of interest in an investigation. 4. **Privacy and Legal Considerations**: * Given the sensitive nature of stored credentials, forensic analysts must ensure that any examination complies with privacy laws, ethical guidelines, and has appropriate legal authorization. # Suggested/Frequent Sites ## Chrome Chrome, developed by Google, does not have a "Suggested Sites" feature explicitly named as such; however, it incorporates a similar functionality through its "New Tab" page, which displays sites based on the user's browsing history, bookmarks, and frequently visited pages. These suggestions are part of Chrome's effort to enhance user experience by providing quick access to relevant content. * **Location of Artifacts**: The artifacts related to these suggestions are primarily stored in the 'Top Sites' database file (`Top Sites`), which is part of Chrome's user profile directory. Additionally, information about the user's browsing history that influences these suggestions is stored in the `History` database file. * **Forensic Analysis**: Analyzing these files can reveal the user's browsing habits, frequently visited sites, and possibly infer the user's interests or intent based on the data. Tools like SQLite browser can be used to examine these files. ## Firefox Mozilla Firefox has a feature called "Top Sites" on its New Tab page, which shows websites that the user frequently visits or has pinned. This feature aims to improve user experience by making navigation to favorite sites easier. * **Location of Artifacts**: Firefox stores information about the user's top sites in the `places.sqlite` file, located in the user's profile folder. This SQLite database also contains bookmarks, history, and downloads. * **Forensic Analysis**: By examining the `places.sqlite` file, forensic analysts can determine which sites were frequently visited and any specific sites the user has pinned to their New Tab page. This analysis can reveal patterns in the user's web browsing behavior and preferences. ## Edge Microsoft Edge, the default browser in Windows 10 and later, has a feature similar to Chrome's, displaying suggested content on the New Tab page. This content includes frequently visited sites, news, and other personalized content based on user activity and interests. * **Location of Artifacts**: Edge stores its browsing history, favorites, and other relevant data in an ESE (Extensible Storage Engine) database known as `spartan.edb` in earlier versions, and later in a series of databases located within the user's profile directory under `DataStore`. * **Forensic Analysis**: Analyzing these ESE databases requires specialized tools capable of reading the format. Forensic analysts can extract information about frequently visited sites and other personalized content suggestions, providing insights into the user's online behavior. # DB Browser Queries # Firefox ## **Query for File Downloads** Firefox stores download history in the `moz_annos` and `moz_places` tables. You can extract information about downloaded files with the following query: ```sql SELECT p.url AS 'Download URL', datetime(a.dateAdded/1000000,'unixepoch') AS 'Download Date', a.content AS 'Downloaded File' FROM moz_annos a JOIN moz_places p ON a.place_id = p.id WHERE a.anno_attribute_id = (SELECT id FROM moz_anno_attributes WHERE name = 'downloads/destinationFileURI') ORDER BY a.dateAdded DESC; ``` This query joins the annotations (where download information is stored) with the places table (which stores URLs) to find out what was downloaded, from where, and when. ## **Query for Visiting a Specific Webpage** To find instances of visiting a specific webpage, you can use: ```sql SELECT url, title, datetime(last_visit_date/1000000,'unixepoch') AS 'Last Visit Date' FROM moz_places WHERE url LIKE '%example.com%' ORDER BY last_visit_date DESC; ``` Replace **`example.com`** with the domain or specific webpage you're interested in. This query searches the `moz_places` table for URLs that match the pattern and orders the results by the most recent visit. # Chrome ## **Query for File Downloads** Chrome stores file download information in the `downloads` and `downloads_url_chains` tables. You can query this information as follows: ```sql SELECT d.target_path AS 'Downloaded File', d.referrer AS 'Download Source', datetime(d.start_time/1000000-11644473600, 'unixepoch', 'localtime') AS 'Download Start Time', datetime(d.end_time/1000000-11644473600, 'unixepoch', 'localtime') AS 'Download End Time' FROM downloads d JOIN downloads_url_chains duc ON d.id = duc.id WHERE duc.url LIKE '%' ORDER BY d.start_time DESC; ``` This query retrieves the paths of downloaded files, their download sources, and the start and end times of downloads. ## **Query for Visiting a Specific Webpage** To find records of visiting a specific webpage in Chrome, use the `urls` table: ```sql SELECT url, title, datetime(last_visit_time/1000000-11644473600, 'unixepoch', 'localtime') AS 'Last Visit Time' FROM urls WHERE url LIKE '%example.com%' ORDER BY last_visit_time DESC; ``` Again, replace `example.com` with the domain or specific page you're investigating. This will return URLs matching the search pattern along with the titles and last visit times, sorted by the most recent visit. # Media History ## List All Media Playback Sessions This query retrieves all records of media playback, including the media URL, start time, and duration. ```sql SELECT playback.url AS 'Media URL', datetime(playback.last_play_time / 1000000 - 11644473600, 'unixepoch', 'localtime') AS 'Last Play Time', playback.watch_time_s AS 'Duration (Seconds)', origin.origin AS 'Origin URL' FROM playback JOIN origin ON playback.origin_id = origin.id ORDER BY playback.last_play_time DESC; ``` ## Find Media Playback from Specific Origin If you're interested in media playback from a specific website, this query filters sessions by origin. ```sql SELECT playback.url AS 'Media URL', datetime(playback.last_play_time / 1000000 - 11644473600, 'unixepoch', 'localtime') AS 'Last Play Time', playback.watch_time_s AS 'Duration (Seconds)' FROM playback JOIN origin ON playback.origin_id = origin.id WHERE origin.origin LIKE '%example.com%' ORDER BY playback.last_play_time DESC; ``` Replace `%example.com%` with the desired website origin. ## Aggregate Watch Time by Origin To understand which websites users spend the most time watching media on, use this query to sum watch times grouped by origin. ```sql SELECT origin.origin AS 'Origin URL', SUM(playback.watch_time_s) / 60 AS 'Total Watch Time (Minutes)' FROM playback JOIN origin ON playback.origin_id = origin.id GROUP BY origin.origin ORDER BY SUM(playback.watch_time_s) DESC; ``` ## Identify Most Frequently Played Media This query helps identify the most frequently accessed media files, which can be indicative of user interest or important content. ```sql SELECT playback.url AS 'Media URL', COUNT(playback.url) AS 'Play Count', SUM(playback.watch_time_s) / 60 AS 'Total Watch Time (Minutes)' FROM playback GROUP BY playback.url ORDER BY COUNT(playback.url) DESC, SUM(playback.watch_time_s) DESC; ``` ## Media Playback Within a Specific Timeframe To filter media playback sessions within a specific timeframe, modify this query with your desired dates. ```sql SELECT playback.url AS 'Media URL', datetime(playback.last_play_time / 1000000 - 11644473600, 'unixepoch', 'localtime') AS 'Last Play Time', playback.watch_time_s AS 'Duration (Seconds)' FROM playback WHERE playback.last_play_time BETWEEN strftime('%s','2024-01-01')*1000000+11644473600000000 AND strftime('%s','2024-01-31')*1000000+11644473600000000 ORDER BY playback.last_play_time DESC; ``` Adjust the dates in the `BETWEEN` clause (`'2024-01-01'` and `'2024-01-31'`) to the desired timeframe. # PowerShell Scripts # Browser Extension Finder ```powershell $excludeUsers = @("Public", "LocalAdmin") $chromePath = "\AppData\Local\Google\Chrome\User Data" $edgePath = "\AppData\Local\Microsoft\Edge\User Data" $firefoxPath = "\AppData\Roaming\Mozilla\Firefox\Profiles" $results = @{} try { Get-ChildItem C:\Users\* -Directory | Where-Object { $excludeUsers -notcontains $_.Name } | ForEach-Object { $user = $_.Name $results[$user] = @{} # Google Chrome Extensions try { $chromeProfilePath = "C:\Users\$user$chromePath" if (Test-Path $chromeProfilePath) { $results[$user]["Google Chrome"] = @{} Get-ChildItem -Path $chromeProfilePath -Directory | Where-Object { $_.Name -ne 'System Profile' } | ForEach-Object { $profileName = $_.Name try { $extensionsPath = $_.FullName + "\Extensions" if (Test-Path $extensionsPath) { $results[$user]["Google Chrome"][$profileName] = @() Get-ChildItem -Path $extensionsPath -Directory | ForEach-Object { $extensionID = $_.Name $results[$user]["Google Chrome"][$profileName] += $extensionID } } } catch {} } } } catch {} # Microsoft Edge Extensions try { $edgeProfilePath = "C:\Users\$user$edgePath" if (Test-Path $edgeProfilePath) { $results[$user]["Microsoft Edge"] = @{} Get-ChildItem -Path $edgeProfilePath -Directory | Where-Object { $_.Name -ne 'System Profile' } | ForEach-Object { $profileName = $_.Name try { $extensionsPath = $_.FullName + "\Extensions" if (Test-Path $extensionsPath) { $results[$user]["Microsoft Edge"][$profileName] = @() Get-ChildItem -Path $extensionsPath -Directory | ForEach-Object { $extensionID = $_.Name $results[$user]["Microsoft Edge"][$profileName] += $extensionID } } } catch {} } } } catch {} # Firefox Extensions try { $firefoxProfilePath = "C:\Users\$user$firefoxPath" if (Test-Path $firefoxProfilePath) { $results[$user]["Firefox"] = @{} Get-ChildItem -Path $firefoxProfilePath -Filter "*.default*" -Directory | ForEach-Object { $profileName = $_.Name try { $extensionsPath = $_.FullName + "\extensions" if (Test-Path $extensionsPath) { $results[$user]["Firefox"][$profileName] = @() Get-ChildItem -Path $extensionsPath | ForEach-Object { $extensionID = $_.Name $results[$user]["Firefox"][$profileName] += $extensionID } } } catch {} } } } catch {} } } catch {} # Custom formatting of the results foreach ($user in $results.Keys) { Write-Output "$user" foreach ($browser in $results[$user].Keys) { Write-Output " - $browser" foreach ($profile in $results[$user][$browser].Keys) { Write-Output " - $profile" foreach ($extension in $results[$user][$browser][$profile]) { Write-Output " - $extension" } } } Write-Output "--------------------------" } ``` # Browser History Finder ```powershell $excludeUsers = @("Public", "LocalAdmin") $chromePath = "\AppData\Local\Google\Chrome\User Data" $edgePath = "\AppData\Local\Microsoft\Edge\User Data" $firefoxPath = "\AppData\Roaming\Mozilla\Firefox\Profiles" $results = @() Get-ChildItem C:\Users\* -Directory | Where-Object { $excludeUsers -notcontains $_.Name } | ForEach-Object { $user = $_.Name # Chrome try { $path = "C:\Users\$user$chromePath" if (Test-Path $path) { Get-ChildItem -Path $path -Directory | ForEach-Object { $profilePath = $_.FullName + "\history" if (Test-Path $profilePath) { $modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime $results += New-Object PSObject -Property @{ User = $user Browser = "Google Chrome" Profile = $_.Name ModifiedTime = $modificationTime FilePath = $profilePath } } } } } catch { Write-Output ("An error occurred while checking Google Chrome history for " + $user + ": " + $_.Exception.Message) } # Edge try { $path = "C:\Users\$user$edgePath" if (Test-Path $path) { Get-ChildItem -Path $path -Directory | ForEach-Object { $profilePath = $_.FullName + "\history" if (Test-Path $profilePath) { $modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime $results += New-Object PSObject -Property @{ User = $user Browser = "Microsoft Edge" Profile = $_.Name ModifiedTime = $modificationTime FilePath = $profilePath } } } } } catch { Write-Output ("An error occurred while checking Microsoft Edge history for " + $user + ": " + $_.Exception.Message) } # Firefox try { $path = "C:\Users\$user$firefoxPath" if (Test-Path $path) { Get-ChildItem -Path $path -Filter "*.default" -Directory | ForEach-Object { $profilePath = $_.FullName + "\places.sqlite" if (Test-Path $profilePath) { $modificationTime = (Get-ItemProperty -Path $profilePath -Name LastWriteTime).LastWriteTime $results += New-Object PSObject -Property @{ User = $user Browser = "Firefox" Profile = $_.Name ModifiedTime = $modificationTime FilePath = $profilePath } } } } } catch { Write-Output ("An error occurred while checking Firefox history for " + $user + ": " + $_.Exception.Message) } } $results | Sort-Object ModifiedTime -Descending | Format-Table -AutoSize | Out-String ``` # Processes # at.exe Superseded by schtasks.exe in later versions of Windows, understanding at.exe remains relevant for analyzing older systems. `at.exe` is a command-line utility that enables users and administrators to schedule commands and programs to run on a local or remote computer at specified times. Its functionality is integral to automating system tasks, but it can also be exploited for persistence or execution of malicious payloads in older Windows environments. * **Image Path**: Typically found in `%SystemRoot%\system32\at.exe` * **Expected Command Line**: `at [\\computername] [[id] [/delete] | /delete [/yes]]` * `at 15:00 cmd.exe /c "example_command"` schedules `example_command` to run at 3:00 PM. * **Parent Process**: Commonly initiated by `cmd.exe` or `Task Scheduler` service processes, but in malicious use cases, it could be spawned by any process. * **Number of Instances**: Varies based on the number of scheduled tasks. Typically, `at.exe` runs briefly to schedule a task and then exits. * **User Account**: Runs under the context of the user who schedules the task. Tasks scheduled to run at system startup or in a system context may require administrative privileges. * **Start Time**: Execution time is determined by the scheduling parameters passed to the command. ## Functionality * **File Management**: While `at.exe` itself does not manage files, it can schedule tasks that perform file operations. * **User Interface**: Primarily a command-line tool, offering no graphical user interface. Users interact with `at.exe` through the Windows Command Prompt. * **Registry Configuration**: Does not directly modify the registry for its primary operation, but tasks scheduled with `at.exe` can be designed to interact with the registry. * **Multiple Instances**: The nature of `at.exe` allows for multiple tasks to be scheduled, each potentially running different commands or applications at specified times. ## Security Considerations The use of `at.exe` for scheduling tasks presents several security considerations: * **Legacy Tool**: As a legacy tool, `at.exe` may not be closely monitored by modern security solutions, making it a potential vector for stealthy execution of malicious tasks. * **Privilege Execution**: Tasks scheduled with `at.exe` run with the permissions of the user who scheduled them, potentially allowing for privilege escalation if used by an administrator account. * **Malicious Use**: Threat actors can exploit `at.exe` to schedule malicious tasks, maintaining persistence or executing malware at specific times. * **Auditing and Monitoring**: Due to its potential for misuse, monitoring the execution of `at.exe` and scheduled tasks is crucial for security. Event logs and security solutions should be configured to alert on its use, especially in environments where `at.exe` is not commonly used for legitimate purposes. # explorer.exe `Explorer.exe`, commonly known as Windows Explorer, serves as the backbone of the user interface in Windows operating systems. It facilitates file management and provides access to various system elements like the Desktop, Start Menu, and Taskbar. Here's a closer look at its structure and functions. ## **Overview** * **Image Path**: `%SystemRoot%\explorer.exe` * **Parent Process**: Typically initiated by `userinit.exe`, which exits afterward, making it uncommon for tools to display `userinit.exe` as the parent. * **Number of Instances**: Generally, one instance runs per interactively logged-on user, but multiple instances can occur based on user settings. * **User Account**: Runs under the context of the currently logged-on user(s). * **Start Time**: The first instance starts with the user's interactive logon session. * **Description**: `Explorer.exe` is pivotal for interacting with the Windows environment, enabling file browsing and access to system functionalities like the Control Panel, Taskbar, and application launching based on file associations and shortcuts. ## **Functionality** * **File Management**: At its core, `explorer.exe` allows users to navigate the file system, manage files and folders, and perform operations like copy, move, delete, and rename. * **User Interface**: Beyond file management, `explorer.exe` is integral to the user experience, providing the Desktop environment, Start Menu, Taskbar, and system notification area. It enables users to interact seamlessly with system settings and installed applications. * **Registry Configuration**: The functionality of `explorer.exe` as the default user interface is defined in the Registry under `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell`. This setting allows for customization, permitting alternative interfaces such as `cmd.exe` or `powershell.exe`. * **Multiple Instances**: Users can opt to "Launch folder windows in a separate process" through Folder Options, which can lead to multiple instances of `explorer.exe` running simultaneously. This setting can enhance system stability by isolating file browser windows from the main `explorer.exe` process. ## **Security Considerations** Given its central role in user interaction, `explorer.exe` is a target for malicious activities. Malware may attempt to mimic or inject code into `explorer.exe` due to its persistent operation and high level of user trust. Monitoring for unusual behaviors, such as unexpected instances or operations not initiated by the user, is crucial for maintaining system integrity. # lsass.exe lsass.exe, a critical component of the Windows operating system, plays a central role in its security architecture by managing user logins and enforcing security policies. ## Overview **Description**: lsass.exe is pivotal for the security architecture of the Windows operating system, handling user authentication, managing password changes, and enforcing security policies. It's essential for verifying login credentials and facilitating secure access to Windows systems. * **Image Path**: `%SystemRoot%\System32\lsass.exe` * **Expected Command Line**: `C:\Windows\System32\lsass.exe` * Typically, no additional command line arguments are used, as lsass.exe is a core system process that starts automatically with system initialization procedures. * **Parent Process**: `C:\Windows\system32\wininit.exe` * **Description**: wininit.exe is responsible for starting critical Windows services during system boot, including lsass.exe, which is fundamental for system security and user authentication. * **Example Command Line**: `C:\Windows\system32\wininit.exe` * **Number of Instances**: Typically, only one instance of lsass.exe runs on a Windows system. * **User Account**: Operates under the Local System account, providing the necessary privileges for its security-sensitive operations. * **Start Time**: Starts within seconds of the system booting up, following the initiation of wininit.exe. ## Functionality * **File Management**: Not applicable as lsass.exe primarily handles authentication and security policy enforcement rather than file management. * **User Interface**: Lsass.exe operates in the background without a user interface, focusing on authentication and security processes. * **Registry Configuration**: Manages and enforces local security policies, which can be configured through the Group Policy Editor or directly in the Windows Registry. It ensures compliance with organizational security standards and policies. * **Multiple Instances**: Typically, only one instance should be running. Multiple instances may indicate malicious activity or system misconfiguration. ## Security Considerations * **Protection**: Windows implements several security measures to protect lsass.exe, including running it within a protected process in certain configurations and restricting access to its memory to prevent unauthorized access and manipulation. * **Monitoring**: Given its critical role and high value as a target for attacks, monitoring lsass.exe for anomalies such as unexpected child processes (except known cases like EFS) or unusual network activities is essential. These could serve as indicators of compromise or potential security issues. # lsaiso.exe `lsaiso.exe`, also known as the LSA Isolated Mode process, is a crucial component of the Windows security infrastructure, especially when Credential Guard is enabled. This process plays a pivotal role in enhancing the security of account credentials by isolating them from the rest of the system. Here's an in-depth look at its operations, significance, and conditions for activation. ## **Overview** * **Image Path**: `%SystemRoot%\System32\lsaiso.exe` * **Parent Process**: `wininit.exe` * **Description**: Initiated by wininit.exe, lsaiso.exe starts as part of the system's boot process when Credential Guard is enabled, ensuring a secure environment for credential management from the earliest stages of system operation. * **Example Command Line**: `C:\Windows\system32\wininit.exe` * **Number of Instances**: Typically, there's either zero (when Credential Guard is not enabled) or one instance of `lsaiso.exe` running. * **User Account**: It operates under the Local System account, necessitating high privilege levels for accessing and managing sensitive credential information. * **Start Time**: Activated within seconds of boot time, contingent upon Credential Guard being enabled. * **Command Line:** `C:\Windows\System32\lsaiso.exe` * `lsaiso.exe` does not usually have command line arguments visible to users or administrators as it operates automatically when Credential Guard is active. * **Description**: `lsaiso.exe` serves as a secure repository for account credentials, enhancing the security posture by segregating critical authentication information from other system processes through hardware virtualization technology. ## **Key Functions and Features** * **Credential Isolation**: With Credential Guard enabled, `lsaiso.exe` takes over the role of securely storing account credentials from `lsass.exe`. This isolation is achieved using virtualization-based security (VBS), effectively creating a hardened barrier against various types of attacks aimed at extracting credentials from the system memory. * **Proxy Authentication Requests**: For scenarios requiring remote authentication, `lsass.exe` communicates with `lsaiso.exe` using a secure RPC channel. This setup ensures that even when authentication needs to occur across the network, the credential verification process remains secure, leveraging the isolated environment provided by `lsaiso.exe`. * **Enhanced Security Posture**: The introduction of `lsaiso.exe` into the Windows security ecosystem significantly raises the bar for attackers. By compartmentalizing sensitive information in a hardware-protected space, it mitigates the effectiveness of pass-the-hash and similar credential theft attacks. ## **When is LSAISO.exe Active?** `lsaiso.exe` is only operational when Credential Guard, a feature available in Windows Enterprise and Education editions, is enabled. This feature is part of Microsoft's broader effort to secure Windows against advanced persistent threats by leveraging modern hardware capabilities like virtualization. ## **Security Implications** The presence of `lsaiso.exe` on a system is a strong indicator that Credential Guard is active, reflecting a higher security configuration state. However, its critical role in authentication and credential management also makes understanding its operation essential for security professionals. Monitoring `lsaiso.exe` for unexpected behavior is crucial, as any anomalies could indicate sophisticated attempts to bypass Windows security mechanisms. # PuTTy.exe PuTTY is an open-source terminal emulator, serial console, and network file transfer application. It supports several network protocols, including SSH, Telnet, SCP, and SFTP, making it a versatile tool for remote administration of systems. Below is a detailed exploration of PuTTY, including its functionalities, usage examples, common file paths, and behaviors. **Overview** * **Executable Path**: Typically, `PuTTY.exe` is located in the directory where it was installed or downloaded, often directly accessed by the user rather than being installed in a system directory. * If installed, its likely in the `C:\Program Files` folder. * **Parent Process**: As a standalone application, the parent process is usually `explorer.exe` or a command shell from which it was launched. * **Number of Instances**: There can be multiple instances running simultaneously, each managing a separate connection. * **User Account**: Runs under the context of the user who initiated the application. * **Start Time**: Starts when the user initiates an SSH or another protocol connection. * **Description**: PuTTY provides a user interface to remotely access computers over various network protocols. It is widely used for secure shell access to Unix and Linux systems. **Key Functions** * **SSH Connections**: Secure Shell (SSH) for secure access to remote servers. * **Telnet Connections**: Telnet for unencrypted communication with remote servers. * **SCP/SFTP**: Secure file transfer protocols used for secure file transfers between systems. * **Serial Console Access**: Provides serial port connections for devices like routers and switches. **Command Line Examples** PuTTY's versatility is partly due to its support for various command-line arguments that allow users to initiate connections with specific parameters directly. * **SSH Connection** connects to `hostname` as `username` over SSH on port 22.: ```bash putty.exe -ssh username@hostname -p 22 ``` * **Telnet Connection** initiates a Telnet connection to `hostname` on port 23: ```bash putty.exe -telnet hostname 23 ``` * **Serial Connection** connects to a serial device on COM1 with the specified serial configuration: ```bash putty.exe -serial COM1 -sercfg 9600,8,n,1,X ``` * **Loading a Saved Session** loads a pre-configured session with all its settings: ```bash putty.exe -load "session name" ``` * **SSH with Key Authentication** uses a private key for SSH authentication: ```bash putty.exe -ssh username@hostname -i "C:\Windows\Users\Admin\private_key.ppk" ``` **Common File Paths** * **Configuration Storage**: PuTTY does not require installation and stores its configuration data in the Windows Registry under `HKEY_CURRENT_USER\Software\SimonTatham\PuTTY`. * **Portable Use**: Often found on USB drives for portable applications, with configurations stored within the same directory or the user's profile directory. * **Log Files**: Users can configure PuTTY to save session logs to a specified path, commonly within the user’s document folder or a designated logs directory. **Behavior** * **Session Management**: PuTTY allows users to save session configurations for quick access to frequently used connections. * **Security**: Provides robust encryption for data transmitted over network connections, ensuring secure communication. * **Interoperability**: Compatible with a wide range of SSH servers and supports various encryption algorithms and authentication methods. # X11 Forwarding X11 forwarding is a feature of the SSH (Secure Shell) protocol that enables the graphical output of an application running on a remote server to be displayed on a local client machine. This feature is particularly useful for running GUI-based applications on a remote server while interacting with them as if they were running locally on your client machine. #### How X11 Forwarding Works 1. **X11 Server (Display Server):** On your local machine, an X11 server must be running. This server is responsible for rendering the graphical interface that the user interacts with. In the context of X11 forwarding, the term "server" refers to the software displaying the graphics (typically running on the client machine), which can be confusing because it's the opposite of how we usually understand client-server relationships. 2. **SSH Client:** The SSH client on your local machine initiates a connection to the remote server. When enabling X11 forwarding, the SSH client requests that the remote server forwards the X11 protocol messages over the encrypted SSH connection. 3. **SSH Server:** The remote machine, where the SSH server is running, receives the request for X11 forwarding. When a graphical application runs on the remote server, instead of displaying its output on the server's screen, the application sends its graphical output (X11 protocol messages) back through the SSH connection to the client machine. 4. **Graphical Output:** The SSH client on the local machine receives the forwarded X11 messages and sends them to the local X11 server, which then displays the graphical output of the remote application. #### Requirements for X11 Forwarding * **X11 Server on the Client Machine:** You need an X11 server running on your local machine. On Linux and macOS, X11 capabilities are often available through XQuartz or similar X11 implementations. On Windows, additional software such as Xming or VcXsrv is required to provide an X11 server. * **SSH Client and Server Support:** Both the SSH client and server must support X11 forwarding. This feature is typically available in most SSH implementations but may need to be explicitly enabled in the SSH server configuration (e.g., setting `X11Forwarding yes` in `sshd_config`). * **Secure Configuration:** While X11 forwarding over SSH is encrypted and secure, the X11 protocol itself was not designed with strong security in mind. It's important to use X11 forwarding in trusted networks and be aware of its security implications. For enhanced security, consider using "X11 forwarding with SSH -Y option" which is more restrictive about which X11 clients can connect to the X11 server. #### Benefits and Use Cases * **Remote Application Execution:** Allows users to run software that requires a graphical user interface on a remote server without needing to install the software locally. * **Secure Network Communications:** X11 forwarding over SSH encrypts the graphical data between the remote server and the local client, providing security over untrusted networks. * **Resource Efficiency:** Enables resource-intensive applications to run on powerful remote servers while being used from less powerful client machines. X11 forwarding is a powerful feature for users who need to run GUI applications on remote servers securely and conveniently.
# runtimebroker.exe RuntimeBroker.exe, a key Windows process, manages permissions for Universal Windows Platform (UWP) apps, ensuring they operate within their allocated privileges on Windows 10 and later versions. ## Overview **Description**: RuntimeBroker.exe acts as an intermediary between UWP apps and system resources. It enforces permissions set by the user, allowing or denying access to system functionalities like the microphone, camera, and file system based on these permissions. This process is crucial for maintaining the security and privacy of the user's data while facilitating the smooth operation of UWP apps. * **Image Path**: `%SystemRoot%\System32\RuntimeBroker.exe` * **Expected Command Line**: `C:\Windows\System32\RuntimeBroker.exe -Embedding` * This argument signifies that the process was started by the COM-based activation system, typically in response to the activation of a UWP app. * **Parent Process**: `svchost.exe` * **Description**: RuntimeBroker.exe is typically launched by the Service Host (svchost.exe) as part of the system's management of background tasks and services. * **Example Command Line**: `Not Applicable` as svchost.exe's invocation of RuntimeBroker.exe does not usually come with a specific command line visible to users. * **Number of Instances**: Varies based on the number of UWP apps in use. Each app may trigger its own instance of RuntimeBroker.exe to manage permissions and access to resources. * **User Account**: Runs under the context of the currently logged-on user(s), ensuring that permissions and resource access are managed according to the active user's settings. * **Start Time**: Instances of RuntimeBroker.exe start as needed when UWP apps are launched, without a fixed start time. ## Functionality * **File Management**: Facilitates controlled access to the file system for UWP apps, based on permissions granted by the user. * **User Interface**: Not directly involved in user interface operations; its role is more about managing the background permissions and resources for UWP apps. * **Registry Configuration**: Not typically involved in direct registry configuration or manipulation by end users. * **Multiple Instances**: Designed to operate with multiple instances, each corresponding to separate UWP apps to ensure isolated and secure management of app permissions. ## Security Considerations RuntimeBroker.exe is essential for security, requiring regular monitoring for abnormal behaviors, such as excessive memory usage or unexpected instances which could indicate malware disguising itself as this legitimate process. Ensuring system security involves keeping an eye on RuntimeBroker's activities and performing regular system scans for potential threats. # services.exe `services.exe`, also known as the Service Control Manager (SCM), is a critical system process in the Windows operating system, integral to the management and operation of Windows services and background tasks. Here’s a closer look at its functionality, importance, and operation. ## **Overview** * **Image Path**: `%SystemRoot%\System32\services.exe` * **Parent Process**: [`wininit.exe`](/windows-artifacts/processes/wininit.exe) * **Number of Instances**: There is only one instance of `services.exe` running on a Windows system at any time. * **User Account**: It operates under the Local System account, providing it with high-level privileges required for managing system services. * **Start Time**: It is initiated within seconds of the system's boot time, following the start-up of [`wininit.exe`](/windows-artifacts/processes/wininit.exe). * **Command Line Example**: `C:\Windows\System32\services.exe` * `services.exe` runs without additional command line arguments, as it's a core process initiated by [`wininit.exe`](/windows-artifacts/processes/wininit.exe). * **Description**: `services.exe` is responsible for implementing the Unified Background Process Manager (UBPM) and the Service Control Manager (SCM). It plays a pivotal role in the management of background activities, including services and scheduled tasks. ## **Key Functions** * **Unified Background Process Manager (UBPM)**: The UBPM framework within `services.exe` oversees the execution and management of background tasks and services, ensuring they operate efficiently and without direct user interaction. * **Service Control Manager (SCM)**: The SCM component of `services.exe` is essential for loading and managing the life cycle of Windows services and device drivers that are set to auto-start. It controls the starting, stopping, and interacting of these services throughout the system's uptime. * **Last Known Good Configuration**: An important feature of `services.exe` is its role in setting the Last Known Good control set. After a user logs on interactively and the system deems the boot process successful, `services.exe` updates the `LastKnownGood` control set in the registry (`HKLM\SYSTEM\Select\LastKnownGood`) to match the `CurrentControlSet`. This mechanism is crucial for system recovery, allowing users to revert to a stable configuration if subsequent changes cause system instability. ## **Importance** The functionality of `services.exe` is vital for the stability and security of Windows systems. By managing the loading and operation of services and device drivers, it ensures that essential processes required for the system's operation are available and functioning correctly. Its role in managing the Last Known Good configuration also provides a safety net for recovering from system errors or misconfigurations. ## **Security Implications** Given its central role in the system, `services.exe` is a target for malware and other security threats. Malware may attempt to mimic or inject malicious code into `services.exe` due to its high privilege level and essential functions. Monitoring `services.exe` for unusual activity, such as unexpected child processes or network connections, is a key aspect of Windows system security. # smss.exe The `smss.exe` process, or Session Manager Subsystem, is a critical system process in Windows operating systems that plays a crucial role during the boot process and session management. Let's break down its key components and functionalities based on the information provided: ## **Overview:** * **Location**: `%SystemRoot%\System32\smss.exe` * The `smss.exe` file is located in the System32 directory, which is a part of the Windows installation directory, typically found in `C:\Windows\System32`. * **Parent Process**: System * `smss.exe` is initiated by the System process during the early stages of the Windows boot process. Being spawned by the System process underscores its importance and foundational role in setting up the operating system environment. * **Instances**: One master instance and another child instance per session. * Initially, a single (master) instance of `smss.exe` runs, which subsequently spawns child instances. Each child instance is responsible for initializing a new user session. After setting up the session, these child instances terminate, leaving the master instance running throughout the system's uptime. * **User Account**: Local System * `smss.exe` operates under the Local System account, granting it high levels of privilege necessary for performing system-level tasks and operations. * **Start Time**: Within seconds of boot time for the master instance * The master instance of `smss.exe` starts almost immediately as part of the system's boot process, indicating its priority in the sequence of tasks that Windows must perform to start up successfully. ## **Description and Functionality** * **Role**: Session Management * The primary function of `smss.exe` is to manage user sessions within Windows. It creates a new session by spawning a child instance for each session, which then initializes the session by starting critical processes: * For Session 0 (the first session which is reserved for system processes and services), it starts `wininit.exe`. * For Session 1 and higher (user sessions), it launches `winlogon.exe`, which is responsible for managing the user login sequence. * The child instance of `smss.exe` exits once it has successfully initialized its session, indicating a design focused on efficiency and minimizing resource usage. ## **Additional Insights** * `smss.exe` is also responsible for setting system variables and initializing the system portion of the registry before user login, further underscoring its critical role in preparing the operating system environment for use. * The operation of `smss.exe` within the Local System account and its early start in the boot process make it a target for malicious activities. Malware may attempt to mimic or hijack `smss.exe` due to its high privileges and fundamental role in the system. Therefore, the integrity and security of this process are paramount for system stability and security. ## **Security Considerations** Given its critical role, any tampering or malfunction in the `smss.exe` process can lead to serious system stability and security issues. It's essential for system administrators and security professionals to monitor this process for signs of compromise, such as multiple instances running from unusual locations or with unusual command-line arguments, which could indicate malware attempting to disguise itself as `smss.exe`. # System The System Process, often represented as `System` or `system.exe` in various system monitoring tools, is a critical component of the Windows operating system. Unlike most processes, the System Process does not originate from an executable image on disk; therefore, it doesn't have an image path. It is a fundamental process responsible for managing kernel-mode operations and is essential for the Windows kernel to function correctly. ## **Overview** * **Image Path**: Not applicable, as the System Process is not generated from an executable image. * **Parent Process**: None. The System Process is a core process initiated by the operating system at boot time; it does not have a parent process in the traditional sense. * **Number of Instances**: One. There is only a single instance of the System Process running on a Windows system, reflecting its unique and integral role in system operations. * **User Account**: Local System. The process runs with Local System privileges, the highest level of privilege on a Windows system. * **Start Time**: At boot time. The System Process is one of the first processes to start when Windows boots up, underlining its importance in the overall system architecture. * **Command Line Example**: Not applicable (`system` is not launched from an executable path but is a fundamental part of the Windows kernel). * The System Process does not have a command line as it is a core part of the operating system's kernel architecture. * **Description**: The System Process is responsible for managing most kernel-mode threads. Kernel-mode threads are low-level operations closely tied to the core functions of the operating system. These operations include managing hardware interactions, system services, and the execution of system-level instructions. ## **Components Managed by the System Process** * **Kernel-Mode Drivers (.sys files)**: The System Process oversees the execution of drivers, which are essential for hardware components to communicate effectively with the operating system. * **Important System DLLs**: Dynamic Link Libraries (DLLs) necessary for the functioning of the system also run under the System Process. These DLLs provide a variety of system-level functionalities and are invoked by applications and other system processes. * **Kernel Executable (ntoskrnl.exe)**: Perhaps the most critical component under the System Process is the kernel executable, `ntoskrnl.exe`. This executable contains the kernel and executive layers of the Windows NT kernel space, handling processes and memory management, scheduling, and hardware virtualization. ## **Forensic and Technical Significance** The System Process is a focal point for understanding low-level system activity and diagnosing system health and performance issues. In digital forensics, analyzing the behavior and the threads running under the System Process can provide insights into system operations, potential rootkits, or other kernel-mode malware that operate at a low level to avoid detection. Given its critical role and high privilege level, any anomalies associated with the System Process warrant careful investigation, as they may indicate sophisticated attacks or system integrity issues. # svchost.exe {% hint style="info" %} **The most common filename for malware is svchost.exe** {% endhint %} The process `svchost.exe` is a fundamental component of the Windows operating system, acting as a generic host process for services that are executed from dynamic-link libraries (DLLs). Understanding `svchost.exe` is crucial for both system administration and cybersecurity, as it is involved in many core system functions and can be a target for malicious activities. Unfortunately, I couldn't access the specific article from nasbench.medium.com to provide additional insights as requested. However, I can still provide a comprehensive overview based on the details provided and general knowledge of `svchost.exe`. ## **Overview** * **Image Path**: `%SystemRoot%\system32\svchost.exe` indicates that `svchost.exe` resides in the system32 directory of the Windows installation, which is a protected system folder. * **Parent Process**: The most common parent process is `services.exe`, which is responsible for starting, stopping, and interacting with system services. * **Number of Instances**: There are typically many instances of `svchost.exe` running on a Windows system, **often at least 10.** This is because Windows isolates different services into separate instances of `svchost.exe` for management and security purposes. * **User Account**: The user account under which an instance of `svchost.exe` runs can vary. It often runs under system accounts like Local System, Network Service, or Local Service. In Windows 10, some instances also run under the context of the logged-on user. * **Start Time**: Instances of `svchost.exe` are usually started within seconds of the system booting up. However, it's possible for new instances to start post-boot, such as at user logon, depending on when services are initiated. * **Command Line Example**: `C:\Windows\System32\svchost.exe -k netsvcs` * The `-k` argument specifies the service group that the `svchost.exe` instance is hosting. Multiple instances will have different `-k` values depending on the services they are managing. * View the [services ](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/16/windows-artifacts/common-processes/svchost.exe/services)page for a extensive list of Windows Services. * **Description****:**`svchost.exe` serves as a generic host process for Windows services that run from DLLs. To manage and group similar services, Windows uses unique “-k” parameters with `svchost.exe`. Some common “-k” parameters include DcomLaunch, RPCSS, and netsvcs, among others. This system allows Windows to compartmentalize services for better management and security. ## **Security Implications**: Due to its ubiquitous presence in Windows systems, `svchost.exe` is a popular target for malware. Malicious actors may disguise malware as `svchost.exe` or run malicious services through it. Vigilance and regular system scanning are advised to detect such anomalies. * **Windows 10 Changes**: Starting with Windows 10 version 1703, Microsoft introduced changes to how services are grouped in `svchost.exe` for systems with more than 3.5 GB of RAM. Instead of grouping similar services together, most services run in their own instance of `svchost.exe`. This change can result in a system running more than 50 instances of `svchost.exe`, which might seem alarming but is normal for enhancing system performance and security. ## Command Line Options and Analysis svchost.exe's behavior and specific services it hosts can be controlled through command-line flags, notably the "-k", "-s", and "-p" flags. Let's delve into the functionalities and implications of these flags. ### **The “K” Flag** * **Functionality**: The "-k" flag is used to specify a service group. When `svchost.exe` is launched with this flag, it looks up the service group in the registry path `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost`. * **Registry Interaction**: This registry key contains values for Service Host Groups, each of which references the services that should be launched under the specified group. For example, if `svchost.exe` is executed with `-k UnistackSvcGroup`, it will refer to this registry key to determine the services included in the "UnistackSvcGroup". * **Service Loading**: After identifying the services associated with the "-k" flag value, `svchost.exe` loads each service from its corresponding registry key at `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[Service Name]`. This mechanism allows multiple services to be hosted within a single `svchost.exe` instance, enhancing system efficiency. ### **The “S” Flag** * **Selective Service Loading**: Besides the "-k" flag, `svchost.exe` may also use the "-s" flag. This flag specifies that only a single service, identified by the flag from a selected group, should be loaded. For instance, using `-s CDPUserSvc` within the "UnistackSvcGroup" would result in only the "CDPUserSvc" service being loaded, ignoring other services in the group. * **Usage Context**: The "-s" flag offers a more granular control over service loading, enabling specific services within a group to be isolated and launched independently. ### **The “P” Flag** * **Enforcing Policies**: The "-p" flag is less commonly understood but plays a crucial role in enforcing certain policies for the `svchost.exe` process. These policies include `DynamicCodePolicy`, `BinarySignaturePolicy`, and `ExtensionPolicy`. * **Implications**: The use of the "-p" flag indicates that `svchost.exe` will adhere to specific security and operational policies, affecting how the services are executed and interacted with. The policies enforced by this flag can significantly impact the security posture of the services hosted by `svchost.exe`. For more information on svchost.exe and it's flags, [read this article. ](https://nasbench.medium.com/demystifying-the-svchost-exe-process-and-its-command-line-options-508e9114e747) # Services Common services seen running under svchost.exe
Service Display Name Service (Registry Key)DescriptionDefault Status
ActiveX Installer (AxInstSV)AxInstSVUAC validation to control the installation of Active-X controls via the internet.Manual
Agent Activation Runtime_?????AarSvc_?????Chatbot Runtime for activating Conversational agent applications - Clippy returns.Manual
AllJoyn Router ServiceAJRouterIoT integration.Manual (Trigger Start)
App ReadinessAppReadinessRuns at first logon to prepare apps for use.Manual
Application IdentityAppIDSvcVerify Application identity, used by AppLocker.Manual (Trigger Start)
Application InformationAppinfoFacilitates running applications with additional administrative privileges. If disabled those additional privileges will not be available.Manual (Trigger Start, Running)
Application Layer Gateway ServiceALGEnables plugins for the now ancient internet connection sharing.Manual
Application ManagementAppMgmtRequired for Group Policy software management, Not Available in Win 10 home.Manual
AppX Deployment Service (AppXSVC)AppXSvcWindows Store integration. Cannot be disabled.Manual
AssignedAccessManager ServiceAssignedAccessManagerSvcKiosk mode, Not Available in Win 10 home.Manual
Auto Time Zone UpdatertzautoupdateAutomatically set the Time Zone.Disabled
AVCTP serviceBthAvctpSvcAudio Video Control TP service - Bluetooth / Wireless.Manual (Trigger Start)
Background Intelligent Transfer ServiceBITSTransfer files.Manual or Automatic (Delayed Start, Running)
Background Tasks Infrastructure ServiceBrokerInfrastructureCannot be disabled.Automatic (Running)
Base Filtering EngineBFEManage Windows Firewall and IPsec policies and implements user mode filtering. Do not disable.Automatic (Running)
BitLocker Drive Encryption ServiceBDESVCSecure startup and volume encryption.Manual (Trigger Start)
Block Level Backup Engine ServicewbengineUsed by Windows Backup.Manual
Bluetooth Audio Gateway ServiceBTAGServiceBluetooth Audio - Wireless headsets.Manual (Trigger Start)
Bluetooth Support ServicebthservDiscovery of Bluetooth devices.Manual (Trigger Start)
Bluetooth User Support Service_?????BluetoothUserService_?????Bluetooth features.Manual (Trigger Start)
BranchCachePeerDistSvcUsed by Windows Update for download sharing on the local subnet.Manual
Capability Access Manager ServicecamsvcManage UWP apps.Manual
CaptureService_?????CaptureService_?????Screen Capture Service via the Windows.Grapics.Capture API.Manual
Cellular TimeautotimesvcSet the time based on NITZ messages from a mobile network.Manual
Certificate PropagationCertPropSvcManage certificates for Smart Card login.Manual (Trigger Start)
Client License Service (ClipSVC)ClipSVCSupport for Microsoft store, cannot be disabled.Manual (Trigger Start)
Clipboard User Service_?????cbdhsvc_?????Clipboard.Manual
CNG Key IsolationKeyIsoSecure long lived keys for cryptographic operations.Manual (Trigger Start, Running)
COM+ Event SystemEventSystemCOM Event notification service, required for COM+Manual
COM+ System ApplicationCOMSysAppNetwork discovery of systems on local network.Manual (Trigger Start)
Connected Devices Platform ServiceCDPSvcConnected Devices Platform.Automatic (Delayed Start, Trigger Start)
Connected Devices Platform User Service_?????CDPUserSvc_?????Connected Devices Platform.Automatic (Running)
Connected User Experiences and TelemetryDiagTrackFeedback and Diagnostics.Automatic (Running)
ConsentUX_?????ConsentUxUserSvc_?????Connect and pair WiFi and Bluetooth devices, ConnectUX.Manual
Contact Data_?????PimIndexMaintenanceSvc_?????Indexes contact data for fast contact searching.Manual
CoreMessagingCoreMessagingRegistrarCannot be disabled. Manages communication between system components.Automatic (Running)
Credential ManagerVaultSvcSecure storage and retrieval of credentials. Control Panel: Credential Manager.Manual
CredentialEnrollmentManagerUserSvc_?????CredentialEnrollmentManagerUserSvc_?????Credential Enrolment Manager.Manual
Cryptographic ServicesCryptSvcManage root certificates.Automatic (Running)
Data Sharing ServiceDsSvcData brokering between applications.Manual (Trigger Start)
Data UsageDusmSvcNetwork data usage,data limit/metered networks.Automatic (Running)
DCOM Server Process LauncherDcomLaunchRequired for COM and DCOM object activation requests.Automatic (Running)
Delivery OptimizationDoSvcContent delivery Optimisation.Automatic (Delayed Start)
Device Association ServiceDeviceAssociationServicePairing between the system and wired or wireless devices.Manual (Trigger Start)
Device Install ServiceDeviceInstallRecognise new hardware, do not disable.Manual (Trigger Start)
Device Management Enrollment ServiceDmEnrollmentSvcDevice enrolment/management.Manual
Device Management Wireless Application Protocol (WAP) Push message Routing ServicedmwappushserviceWAP - Sync device sessions.Manual
Device Setup ManagerDsmSvcInstall device drivers.Manual (Trigger Start)
DeviceAssociationBroker_?????DeviceAssociationBrokerSvc_?????Pair devices.Manual
DevicePicker_?????DevicePickerUserSvc_?????Manage Miracast DLNA and DIAL UI.Manual
DevicesFlow_?????DevicesFlowUserSvc_?????Connect and pair WiFi and Bluetooth devices, ConnectUX/PC settings.Manual
DevQuery Background Discovery BrokerDevQueryBrokerEnable apps to discover devices with a background task.Manual (Trigger Start)
DHCP ClientDhcpAllocate an IP address to this computer automatically.Automatic (Running)
Diagnostic Execution ServicediagsvcEnable troubleshooting support.Manual (Trigger Start)
Diagnostic Policy ServiceDPSEnable problem detection, troubleshooting and resolution for Windows components.Automatic (Running)
Diagnostic Service HostWdiServiceHostDiagnostics for Local Services.Manual (Running)
Diagnostic System HostWdiSystemHostDiagnostics for the Local System.Manual
DialogBlockingServiceDialogBlockingServiceDialogBlockingServiceDisabled
Display Enhancement ServiceDisplayEnhancementServiceBrightness.Manual (Trigger Start)
Display Policy ServiceDispBrokerDesktopSvcConnection and configuration of local and remote displays.Automatic (Delayed Start)
Distributed Link Tracking ClientTrkWksAttempt to maintain valid links between NTFS files across a network.Automatic (Running)
Distributed Transaction CoordinatorMSDTCCo-ordinate transactions between resource managers, database, file and message queues.Manual
DNS ClientDnscacheCache DNS queries and register the computername.Automatic (Trigger Start, Running)
Downloaded Maps ManagerMapsBrokerWindows/Bing maps.Automatic (Delayed Start)
Embedded ModeembeddedmodeActivate background applications.Manual (Trigger Start)
Encrypting File System (EFS)EFSAllow storage of encrypted files on NTFS file systems.Manual (Trigger Start)
Enterprise App Management ServiceEntAppSvcCannot be disabled. Enterprise Application management.Manual
Extensible Authentication ProtocolEaphostNetwork Authentication - VPN NAP and Wireless.Manual
File History ServicefhsvcUsed by Windows Backup.Manual (Trigger Start)
Function Discovery Provider HostfdPHostNetwork discovery and Web Service discovery.Manual
Function Discovery Resource PublicationFDResPubPublish this computer and resources over the network.Manual (Running)
GameDVR and Broadcast User Service_?????BcastDVRUserService_?????Game recordings and Live broadcasts. Cannot be disabled.Manual (Trigger Start)
Geolocation ServicelfsvcManage Geofences - a geographic location with associated events.Manual (Trigger Start, Running)
GraphicsPerfSvcGraphicsPerfSvcMonitor graphics performance.Manual (Trigger Start)
Group Policy ClientgpsvcCannot be disabled. Apply admin settings through group policy.Automatic (Trigger Start)
Human Interface Device ServicehidservActivate and maintain hot buttons on keyboards and other controls.Manual (Trigger Start)
HV Host ServiceHvHostHyper-V interface for performance counters.Manual (Trigger Start)
Hyper-V Data Exchange ServicevmickvpexchangeHyper-V interface for data exchange.Manual (Trigger Start)
Hyper-V Guest Service InterfacevmicguestinterfaceHyper-V interface for VM services.Manual (Trigger Start)
Hyper-V Guest Shutdown ServicevmicshutdownHyper-V interface for VM shutdown.Manual (Trigger Start)
Hyper-V Heartbeat ServicevmicheartbeatHyper-V identify frozen VMs.Manual (Trigger Start)
Hyper-V PowerShell Direct ServicevmicvmsessionHyper-V interface for PowerShell.Manual (Trigger Start)
Hyper-V Remote Desktop Virtualization ServicevmicrdvHyper-V desktop interface. Not Available in Win 10 home.Manual (Trigger Start)
Hyper-V Time Synchronization ServicevmictimesyncHyper-V time sync.Manual (Trigger Start)
Hyper-V Volume Shadow Copy RequestorvmicvssHyper-V shadow copy/backup.Manual (Trigger Start)
IKE and AuthIP IPsec Keying ModulesIKEEXTInternet Key exchange.Manual (Trigger Start)
Internet Connection Sharing (ICS)SharedAccessProvides NAT/name resolution for small office networks. Very rarely needed.Manual (Trigger Start)
IP HelperiphlpsvcIPv6 translation.Automatic (Running)
IP Translation Configuration ServiceIpxlatCfgSvcIPv6 translation.Manual (Trigger Start)
IPsec Policy AgentPolicyAgentNetwork level peer authentication. Enforces IPsec policies.Manual (Trigger Start)
KtmRm for Distributed Transaction CoordinatorKtmRmCo-ordinates distributed transactions. MSDTC/KTM.Manual (Trigger Start)
Language Experience ServiceLxpSvcDeployment infrastructure for configuring additional languages.Manual
Link-Layer Topology Discovery MapperlltdsvcCreates a Network map describing each PC and device.Manual
Local Profile Assistant ServicewlpasvcProfile management for local subscriber identity modules.Manual (Trigger Start)
Local Session ManagerLSMCannot be disabled. Manage local user sessions.Automatic (Running)
MessagingService_?????MessagingService_?????Text Messaging.Manual (Trigger Start)
Microsoft (R) Diagnostics Hub Standard Collector Servicediagnosticshub.standardcollector.serviceCollect real-time Event Tracing for Windows (ETW) events.Manual
Microsoft Account Sign-in AssistantwlidsvcRunning if using MS account to log in to computer.Manual (Trigger Start)
Microsoft App-V ClientAppVClientManage App-V users and virtual applications. Not Available in Win 10 home.Disabled
Microsoft iSCSI Initiator ServiceMSiSCSIManage iSCSI devices.Manual
Microsoft Keyboard FilterMsKeyboardFilterControl keystroke filtering and mapping.Not Installed (Disabled)
Microsoft PassportNgcSvcProcess isolation for cryptographic keys. Cannot be disabled.Manual (Trigger Start)
Microsoft Passport ContainerNgcCtnrSvcManage Local user identity keys and smartcard access. Cannot be disabled.Manual (Trigger Start)
Microsoft Software Shadow Copy ProviderswprvVolume Shadow Copy. Used by Windows Backup.Manual (Runs at boot, then stops)
Microsoft Storage Spaces SMPsmphostManage storage pools with multiple disks (WSS).Manual
Microsoft Store Install ServiceInstallServiceMicrosoft Store.Manual
Microsoft Windows SMS Router Service.SmsRouterRoute messages.Manual (Trigger Start)
Natural AuthenticationNaturalAuthenticationSignal aggregator service for automatic device lock/unlock.Manual (Trigger Start)
Net.Msmq/Net.Pipe/Net.Tcp Listener AdapterNetMsmqActivator/NetPipeActivator/NetTcpActivator Not installed
Net.Tcp Port Sharing Service Provides ability to share TCP ports over net.tcpDisabled
NetlogonNetlogonConnect to a domain controller.Manual
Network Connected Devices Auto-SetupNcdAutoSetupDiscover and install qualified devices.Manual (Trigger Start, Running)
Network Connection BrokerNcbServiceBroker connections between Windows store apps and the internet.Manual (Trigger Start, Running)
Network ConnectionsNetmanManage network and Dial-up connections.Manual
Network Connectivity AssistantNcaSvcDirectAccess status notification.Manual (Trigger Start)
Network List ServicenetprofmIdentify networks.Manual (Running)
Network Location AwarenessNlaSvcNotify changes in the network configuration.Automatic (Running)
Network Setup ServiceNetSetupSvcManage installation and configuration of network drivers.Manual (Trigger Start)
Network Store Interface ServicensiNetwork notifications for user mode clients.Automatic (Running)
Offline FilesCscServicePerform offline maintenance on the offline files cache. Not Available in Win 10 home.Manual (Trigger Start)
OpenSSH Authentication Agentssh-agentAgent to hold private keys used for public key authentication.Manual
Optimize drivesdefragsvcOptimise file storage by defragmenting on disc.Manual
Parental ControlsWpcMonSvcEnforces parental controls in Windows.Manual
Payments and NFC/SE ManagerSEMgrSvcManage payments and Near Field Communication (NFC) based secure elements.Manual (Trigger Start)
Peer Name Resolution ProtocolPNRPsvcEnable serverless peer name resolution over the internet (Remote Assistance).Manual
Peer Networking Groupingp2psvcEnables multi-party communication using peer-peer grouping. (Home Group).Manual
Peer Networking Identity Managerp2pimsvcIdentity services for peer Name resolution and peer-peer grouping services.Manual
Performance Counter DLL HostPerfHostEnable remote users and 64 bit processes to query perf counters provided by 32-bit DLLs.Manual
Performance Logs & AlertsplaCollect performance data from local or remote computers.Manual
Phone ServicePhoneSvcManage the telephony state.Manual (Trigger Start)
Plug and PlayPlugPlayRecognise new hardware. Do not disable.Manual (Running)
PNRP Machine Name Publication ServicePNRPAutoRegPublish a machine name using Peer name resolution protocol.Manual
Portable Device Enumerator ServiceWPDBusEnumEnforce group policy for removable mass storage devices. Enables transferring and synchronising content.Manual (Trigger Start)
PowerPowerManage power policy and power policy notifications.Automatic (Running)
Print SpoolerSpoolerSpool print jobs. Do not disable.Automatic (Running)
Printer Extensions and NotificationsPrintNotifyOpen custom printer dialogue boxes and handle notifications from a remote print server or printer.Manual
PrintWorkflow_?????PrintWorkflowUserSvc_?????Print Workflow. Cannot be disabled.Manual
Problem Reports and Solutions Control Panel SupportwercplsupportSystem level problem reports.Manual
Program Compatibility Assistant ServicePcaSvcProgram Compatibility Assistant (PCA)Automatic (Running)
Quality Windows Audio Video ExperienceQWAVEPlatform for A/V streaming applications on IP home networks.Manual
Radio Management ServiceRmSvcRadio Management and Airplane Mode - wireless comms / Bluetooth.Manual
Recommended Troubleshooting ServiceTroubleshootingSvcAutomatic mitigation for known problems and recommended troubleshooting options.Manual
Remote Access Auto Connection ManagerRasAutoAutomatically connect to a remote network whenever a DNS name is used.Manual
Remote Access Connection ManagerRasManManage Dial-Up and VPM connections.Manual
Remote Desktop ConfigurationSessionEnvRemote Desktop related activities, temporary folders,themes and certificates.Manual
Remote Desktop ServicesTermServiceAllow users to connect interactively with a remote computer. To prevent remote use of this computer clear the checkboxes on the Remote tab of the system properties control panel item.Manual
Remote Desktop Services UserMode Port RedirectorUmRdpServiceAllow redirection of Printers/Drivers/Ports for RDP connections.Manual
Remote Procedure Call (RPC)RpcSsObject activation for COM and DCOM. Cannot be disabled.Automatic (Running)
Remote Procedure Call (RPC) LocatorRpcLocatorNo functionality in Windows 10, this is provided for Application Compatibility.Manual
Remote RegistryRemoteRegistryEnable remote users to modify the registry on this computer.Disabled
Retail Demo ServiceRetailDemoAllows running the Retail Demo mode which will erase all files and restore Windows to a factory default. You may prefer to disable this.Manual
Routing and Remote AccessRemoteAccessLAN and WAN routing to other businesses.Disabled
RPC Endpoint MapperRpcEptMapperResolve RPC interface identifiers to a transport endpoint. Cannot be disabled.Automatic (Running)
Runtime BrokerRuntimeBrokerMicrosoft core process, manages permissions for all universal (Windows Store) apps.Automatic (Running)
Secondary LogonseclogonEnable starting processes under alternate credentials.Manual
Secure Socket Tunneling Protocol ServiceSstpSvcSSTP VPN Capability.Manual
Security Accounts ManagerSamSsAllows SAM to accept request from other services.Automatic (Running)
Security CenterwscsvcMonitor and report security health settings: Firewall, Anti-Virus,Anti-Spyware.Automatic (Delayed Start, Running)
Sensor Data ServiceSensorDataServiceDelivers data from a variety of sensors.Manual (Trigger Start)
Sensor Monitoring ServiceSensrSvcMonitor sensors to expose data and user state e.g. Adjust brightness.Manual (Trigger Start)
Sensor ServiceSensorServiceManage Simple Device Orientation (SDO) and History for sensors. Reports device orientation changes.Manual (Trigger Start)
ServerLanmanServerFile, Print and named pipe sharing over the network.Automatic (Running)
Shared PC Account ManagershpamsvcManage profiles and accounts on a SharedPC configured device.Disabled
Shell Hardware DetectionShellHWDetectionAutoplay notification.Automatic (Running)
Smart CardSCardSvrSupport for Smart Card login/logout.Disabled
Smart Card Device Enumeration ServiceScDeviceEnumSupport for Smart Card login/logout.Manual (Trigger Start)
Smart Card Removal PolicySCPolicySvcSupport for Smart Card login/logout.Manual
SNMP TrapSNMPTRAPHandle Simple Network Management Protocol (SNMP) agent messages.Manual
Software ProtectionsppsvcDownload and install Digital Licences. Cannot be disabled.Automatic (Delayed Start,Trigger Start)
Spatial Data ServiceSharedRealitySvcVirtual Reality data manager.Manual
Spot VerifiersvsvcVerify potential file system corruptions.Manual (Trigger Start)
SSDP DiscoverySSDPSRVDiscover UPnP /SSDP devices. Enables SSDP device discovery. Can be disabled.Manual (Running)
State Repository ServiceStateRepositoryReports Application State. Cannot be disabled.Manual (Running)
Still Image Acquisition EventsWiaRpcLaunch applications associated with still image acquisition.Manual
Storage ServiceStorSvcAdds 'System Volume Information' folder to external USB memory devices. Required for Windows Store.Manual (Trigger Start)
Storage Tiers ManagementTieringEngineServiceOptimise the placement of data in storage tiers on all tiered storage spaces.Manual
Sync Host_?????OneSyncSvc_?????Sync mail, contacts calendar and other user data.Automatic (Delayed Start)
SysMainSysMainTune system performance over time.Automatic (Running)
System Event Notification ServiceSENSMonitor system events and notify COM+ subscribers.Automatic (Running)
System Events BrokerSystemEventsBrokerCo-ordinates background work for WinRT. Cannot be disabled.Automatic (Trigger Start, Running)
System Guard Runtime Monitor BrokerSgrmBrokerAttests to Windows platform integrity.Automatic (Delayed Start, Running)
Task SchedulerScheduleSchedule Automated Tasks. Cannot be Stopped or disabled.Automatic (Running)
TCP/IP NetBIOS HelperlmhostsProvides NetBIOS over TCP/IP (NetBT) Enables sharing Files, Printers and logon to the network.Manual (Trigger Start, Running)
TelephonyTapiSrvSupport for programs that control telephony devices.Manual
ThemesThemesUser Theme Management.Automatic (Running)
Time BrokerTimeBrokerSvcBackground work for WinRT application.Manual (Trigger Start, Running)
Touch Keyboard and Handwriting Panel ServiceTabletInputServiceEnables touch keyboard and handwriting panel pan and ink functionality.Manual (Trigger Start)
Update Orchestrator ServiceUsoSvcManages Windows Updates.Manual (Running)
UPnP Device HostupnphostAllows UPnP devices to be hosted on this computer.Manual
User Data Access_?????UserDataSvc_?????Provides apps access to structured user data, including contact info, calendars, messages. Cannot be disabled.Manual (Running)
User Data Storage_?????UnistoreSvc_?????Handles storage of structured user data, including contact info, calendars, messages.Cannot be disabled.Manual (Running)
User Experience Virtualization ServiceUevAgentServiceSupport for the roaming of OS and application settings. Not Available in Win 10 home.Disabled
User ManagerUserManagerSupport for Multi-User interaction.Automatic (Trigger Start, Running)
User Profile ServiceProfSvcLoading and unloading of user profiles.Automatic (Running)
Virtual DiskvdsMagagement of disks and volumes.Manual
Volume Shadow CopyVSSManages and implements Volume Shadow copies used for backup and other purposes.Manual
Volumetric Audio Compositor ServiceVacSvcHosts spacial analysis for mixed reality audio simulation.Not Installed
WalletServiceWalletServiceObjects used by clients of the wallet.Manual
WarpJITSvcWarpJITSvcJIT out of process service for Windows Advanced Rasterization Platform (WARP) when running with Arbitrary Code Guard (ACG) enabled.Manual (Trigger Start)
Web Account ManagerTokenBrokerProvide single sign on to apps and services.Manual (Running)
WebClientWebClientEnable Windows based programs to create access and modify internet based files.Manual (Trigger Start)
Wi-Fi Direct Services Connection Manager ServiceWFDSConMgrSvcConnect to wireless display and/or dock.Manual (Trigger Start)
Windows AudioAudiosrvManage Audio.Automatic (Running)
Windows Audio Endpoint BuilderAudioEndpointBuilderManage Audio devices.Automatic (Running)
Windows BackupSDRSVCWindows Backup.Manual
Windows Biometric ServiceWbioSrvcCapture and edit biometric data without gaining direct access to any biometric hardware or samples.Manual (Trigger Start)
Windows Camera Frame ServerFrameServerAccess video frames from camera devices.Manual (Trigger Start)
Windows Connect Now - Config RegistrarwcncsvcWireless Protected Setup (WPS) protocol.Manual
Windows Connection ManagerWcmsvcMakes automatic connect/disconnect decisions based on the network connectivity options currently available to the PC.Automatic (Trigger Start, Running)
Windows Defender Advanced Threat Protection ServiceSenseSecurity event monitor. Not Available in Win 10 homeManual
Windows Defender Antivirus Network Inspection ServiceWdNisSvcAnti-Virus Cannot be disabled.Manual (Running)
Windows Defender Antivirus ServiceWinDefendMalware detection. Cannot be disabled.Automatic (Running)
Windows Defender FirewallmpssvcFirewall. Cannot be disabled.Automatic (Running)
Windows Encryption Provider Host ServiceWEPHOSTSVCExchange Active Sync (EAS) policies for Email encryption with 3rd parties.Manual (Trigger Start)
Windows Error Reporting ServiceWerSvcAllows errors to be reported.Manual (Trigger Start)
Windows Event CollectorWecsvcRemote event log management.Manual
Windows Event LogEventLogManage and query event logs.Automatic (Running)
Windows Font Cache ServiceFontCacheCache font data.Automatic (Running)
Windows Image Acquisition (WIA)stisvcImage acquisition for scanners and cameras.Manual
Windows Insider ServicewisvcUsed only for Windows insider - beta testing of new versions of Windows.Manual (Trigger Start)
Windows InstallermsiserverInstall applications from an .MSI or .MSP package. Cannot be disabled.Manual
Windows License Manager ServiceLicenseManagerWindows Store.Manual (Trigger Start)
Windows Management InstrumentationWinmgmtWindows Management Instrumentation (WMI).Automatic (Running)
Windows Management ServiceWManSvcProvisioning and enrolment services.Manual
Windows Media Player Network Sharing ServiceWMPNetworkSvcShare Windows Media Player libraries with other devices using PnP.Disabled
Windows Mixed Reality OpenXR ServiceMixedRealityOpenXRSvcEnable Mixed reality OpenXR runtime.Manual
Windows Mobile Hotspot ServiceicssvcShare a Mobile Data Connection with another device.Manual (Trigger Start)
Windows Modules InstallerTrustedInstallerWindows Update, installer service.Manual
Windows Perception ServicespectrumVirtual Reality Service.Manual (Trigger Start)
Windows Perception Simulation ServiceperceptionsimulationEnables spatial perception simulation - camera and spatial input simulation.Manual
Windows Presentation Foundation Font Cache 3.0.0.0FontCache3.0.0.0Optimise the performance of WPF applications by caching commonly used files.Not Installed (Manual)
Windows Push Notifications System ServiceWpnServicePush Notifications.Automatic (Running)
Windows Push Notifications User Service_?????WpnUserService_?????Local and push notifications: tile, toast and raw.Automatic (Running)
Windows PushToInstall ServicePushToInstallWindows Store.Manual
Windows Remote Management (WS-Management)WinRMRemote Management.Manual
Windows SearchWSearchSearch content indexing.Automatic (Delayed Start, Running)
Windows Security ServiceSecurityHealthServiceDevice protection.Manual
Windows TimeW32TimeDate and Time Synchronisation.Manual (Trigger Start)
Windows UpdatewuauservWindows Update.Manual (Trigger Start)
Windows Update Medic ServiceWaaSMedicSvcRemediation and protection of Windows Update components.Manual
WinHTTP Web Proxy Auto-Discovery ServiceWinHttpAutoProxySvcWeb Proxy Auto-Discovery over HTTP.Manual (Running)
Wired AutoConfigdot3svcIEEE 802.1 authentication over Ethernet.Manual
WLAN AutoConfigWlanSvcConnect and Disconnect from a Wireless LAN, it is strongly recommended that this service is left set to Automatic if a Wireless Card is installed.Automatic
WMI Performance AdapterwmiApSrvProvide performance information from WMI providers to clients on the network.Manual
Work FoldersworkfolderssvcSync files with the Work Folders server enabling you to use the files on any PC where you have setup Work Folders.Manual
WorkstationLanmanWorkstationConnect to remote servers using SMB 2.0 or 3.0Automatic (Running)
WWAN AutoConfigWwanSvcManages Mobile Broadband Data Connections (GSM and CDMA) by auto-configuring the network.Manual
Xbox Accessory Management ServiceXboxGipSvcXbox Accessories.Manual (Trigger Start)
Xbox Live Auth ManagerXblAuthManagerXbox Authentication.Manual
Xbox Live Game SaveXblGameSaveXbox sync with game server.Manual (Trigger Start)
Xbox Live Networking ServiceXboxNetApiSvcXbox API.Manual
# winlogon.exe `Winlogon.exe` is a critical system process in Windows operating systems, pivotal for managing user logons, logoffs, and the overall user session experience. It ensures secure user authentication and initiates user session processes. Here’s an in-depth look at its roles, operation, and significance. **Overview** * **Image Path**: `%SystemRoot%\System32\winlogon.exe` * **Parent Process**: Initially spawned by `smss.exe` (Session Manager Subsystem), which terminates afterward, leaving `winlogon.exe` without an easily traceable parent process in analysis tools. * **Number of Instances**: The system maintains one instance of `winlogon.exe` per session. The first instance starts for Session 1 (the first user session) at boot time, with additional instances created for new user sessions initiated via Remote Desktop, Fast User Switching, or other means. * **User Account**: It runs under the Local System account, granting it necessary privileges for authentication and session management tasks. * **Command Line****:** winlogon.exe operates with system-defined parameters and does not typically utilize command-line arguments for its primary functions related to user logon and session management. * **Start Time**: The initial instance starts within seconds of the system booting up, aligning with the setup of Session 1. Subsequent instances start as needed for additional user sessions. **Key Functions** * **User Authentication**: `Winlogon.exe` is responsible for the interactive logon process, handling user credentials input, and coordinating with `LogonUI.exe` to present the user with the logon interface. * **Credential Handling**: It interacts with credential providers to collect user credentials (such as passwords, smart cards, or biometric data) and passes these credentials to `lsass.exe` (Local Security Authority Subsystem Service) for verification against system security policies. * **Session Initialization**: Upon successful authentication, `winlogon.exe` loads the user’s profile into the registry (HKCU) and initiates the user’s shell (typically `explorer.exe`) through `userinit.exe`, effectively starting the user’s interactive session. * **Logoff and Session Management**: In addition to handling logons, `winlogon.exe` manages user logoffs and plays a role in session termination processes, ensuring a secure and orderly closure of user sessions. **Security Considerations** * **Critical Security Component**: Given its central role in user authentication and session management, `winlogon.exe` is a prime target for attackers looking to intercept user credentials or hijack sessions. Windows implements stringent protections around `winlogon.exe` to safeguard against such threats. * **Monitoring for Malicious Activity**: Anomalies related to `winlogon.exe`, such as unexpected instances or modifications to its file integrity, should be investigated promptly as potential indicators of compromise. # wininit.exe `wininit.exe` stands as a pivotal system process in the Windows operating system, instrumental in the initial setup of critical system services and processes. Here's a deep dive into its functions, characteristics, and importance: ## **Overview** * **Image Path**: `%SystemRoot%\System32\wininit.exe` * **Parent Process**: Directly initiated by `smss.exe` (Session Manager Subsystem), which exits afterward, making it uncommon for tools to display `smss.exe` as the parent. * **Number of Instances**: Runs as a singular instance. * **User Account**: Operates under the Local System account. * **Start Time**: Activated within seconds of the system booting up. * **Command Line Example**: `C:\Windows\System32\wininit.exe` * Like many core system processes, `wininit.exe` does not typically use command line arguments for its operation. * **Description**: `wininit.exe` is tasked with launching foundational background processes within Session 0, the core system session in Windows. ## **Key Responsibilities** * [**Service Control Manager (services.exe)**](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/16/windows-artifacts/common-processes/services.exe): `wininit.exe` initiates `services.exe`, the Service Control Manager, which is critical for managing the start and stop operations of Windows services. * [**Local Security Authority Process (lsass.exe)**](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/16/windows-artifacts/common-processes/lsass.exe): Another crucial process started by `wininit.exe`, `lsass.exe` is responsible for enforcing security policies on the system. It handles password changes and login authentication processes. * [**LSA ISO (lsaiso.exe)**](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/16/windows-artifacts/common-processes/lsaiso.exe): On systems with Credential Guard enabled, `wininit.exe` also starts `lsaiso.exe`, a process dedicated to isolating and protecting sensitive security information. * **Local Session Manager (lsm.exe) Prior to Windows 10**: Before the advent of Windows 10, `wininit.exe` was also responsible for starting the Local Session Manager process (`lsm.exe`). However, in Windows 10 and later versions, `lsm.exe`'s functionalities have been integrated into a service DLL (`lsm.dll`) managed by `svchost.exe`. ## **Significance** `wininit.exe` is essential for the stability and security of Windows systems. It lays the groundwork for vital system processes that manage services, security, and session management. Operating exclusively within Session 0, it ensures that key system services are up and running before user sessions begin. This process is critical for the overall functionality and security framework of Windows, as it initiates components that are fundamental to the system's operation and security. # Cloud Storage # Deleted File or File Knowledge # WordWheelQuery (Win 7+) WordWheelQuery is a Windows artifact that records the terms entered into the File Explorer search dialog by a user. Stored within the Windows Registry, specifically in the NTUSER.DAT file, it maintains an ordered list of search terms. These terms are stored in Unicode format and are organized based on the order of their usage, following a Most Recently Used (MRU) list pattern. This artifact provides valuable insights into the search behavior of a user, documenting the exact keywords searched in File Explorer. ## Key Insights: * **Location in the Registry**: * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery` * **Data Format**: * Keywords are stored in Unicode. * **Ordering**: * The search terms are listed in the MRUlist, indicating their temporal order of use. ## Deeper Dive * **WordWheelQuery**: * This registry value is instrumental for forensic analysts because it reveals the user's search history in File Explorer. By examining the MRUlist, investigators can ascertain the sequence of searches conducted by the user, which could be pivotal in understanding user behavior or in supporting investigations. The use of Unicode for storing search terms ensures that a wide range of characters, including non-English ones, is accurately recorded. ## Analyzing The Artifact 1. **Accessing the Registry File**: Start by opening the `NTUSER.DAT` file of the user profile in question. This requires using a tool capable of loading and interpreting registry hive files. 2. **Navigating to the Key**: Locate the `WordWheelQuery` key within the path `Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery`. 3. **Extracting Search Terms**: Examine the MRUlist to retrieve and decode the Unicode search terms. The order of these terms will reflect their usage chronology. 4. **Interpreting the Data**: Analyze the extracted terms to understand the context of the searches. This might include identifying patterns, frequently searched terms, or specific files or topics of interest. ## Tools for Analysis * **Registry Explorer**: A powerful tool for navigating and analyzing Windows Registry files, offering a user-friendly interface for accessing `NTUSER.DAT`. * **AccessData FTK**: Provides capabilities for loading and analyzing registry hives, among other forensic functionalities. * **Autopsy**: An open-source digital forensics platform that can analyze Windows artifacts, including registry hives, to extract user activities. # ACMRU (Win XP) ACMRU, or AutoComplete Memory Registry Unit, is a key artifact in Windows XP that records the search terms entered by users through the Search Assistant. This functionality is an integral part of the operating system's user experience, allowing for quick retrieval of previous searches. The ACMRU keys within the NTUSER.DAT hive provide a comprehensive record of various search categories, including files, computers, and specific content within files. Each category of search is identified by a unique identifier, making it possible to distinguish between different types of searches performed by the user. ## Key Insights: * **Registry Location**: * `NTUSER.DAT\Software\Microsoft\SearchAssistant\ACMru\####` * **Categories of Search**: * **Search the Internet**: `####=5001` * **All or Part of a Document Name**: `####=5603` * **A Word or Phrase in a File**: `####=5604` * **Printers, Computers, and People**: `####=5647` ## Deeper Dive ### **ACMRU Search Categories** * The ACMRU keys offer insights into the specific searches conducted by a user. By analyzing these keys, investigators can discern whether a user was searching for files, phrases within documents, or even other computers on a network. This granularity helps in constructing a detailed profile of user behavior and potentially uncovering evidence of interest in digital forensics cases. ## Analyzing The Artifact * To effectively analyze ACMRU data, follow these steps: 1. **Access the NTUSER.DAT Hive**: Use a registry editor or forensic tool to navigate to the ACMRU keys. 2. **Identify the Search Categories**: Look at the specific numerical identifiers to understand the type of search (e.g., files, phrases, computers). 3. **Examine the Search Terms**: Analyze the stored values to see what the user was searching for. This can reveal interests, intentions, or specific files and information the user was attempting to locate. 4. **Correlate with Other Artifacts**: Combine the ACMRU findings with other digital artifacts to build a comprehensive picture of user activity, potentially linking searches to accessed or deleted files. ## Tools for Analysis * **Registry Analysis Tools**: Tools like AccessData Registry Viewer or RegRipper can facilitate viewing and analyzing the NTUSER.DAT hive. * **Digital Forensics Platforms**: Comprehensive forensics suites like EnCase or FTK can parse the registry and automatically extract ACMRU data, presenting it in an easily understandable format. ACMRU search history in Windows XP offers a unique window into user behavior, capturing the essence of user interactions through the Search Assistant. By meticulously analyzing these entries, digital forensic investigators can gain valuable insights into past activities, revealing much about a user's actions and intentions on a system. # Internet Explorer file:/// Internet Explorer History databases are pivotal for forensic investigations as they record both local and remote file accesses through network shares. This capability of Internet Explorer to log file access details offers a rich source of evidence about user interactions with files, irrespective of whether Internet Explorer is present on the system. Notably, these databases can capture file access on systems up to and including Windows 11. ## Key Insights: * **File Access Tracking Through History Databases**: * Entries for accessed files are recorded in a specific format, using the `file:///C://` notation. This format highlights the method of access but does not confirm that the file was opened within the browser itself. Instead, it indicates that Internet Explorer was used to navigate to or attempt access to the file location. * **Location of Internet Explorer History Files**: * **IE6-7**: * `%USERPROFILE%\Local Settings\History\History.IE5` * **IE8-9**: * `%USERPROFILE%\AppData\Local\Microsoft\Windows\History\History.IE5` * **IE10-11 and Windows 10+**: * `%USERPROFILE%\AppData\Local\Microsoft\Windows\WebCache\WebCacheV*.dat` ## Deeper Dive: ### **File Access Logging Mechanism**: * Internet Explorer's method of recording file access into history databases is a nuanced process. While the `file:///C://` format is used to denote file accesses, it's essential to understand that this does not automatically mean the file was viewed or edited using Internet Explorer. The presence of such entries in the history database signifies the navigation to or interaction with file paths, which can be initiated from the Internet Explorer address bar or through file explorations initiated within the browser. ### **Implications for Forensic Analysis**: * The persistence of Internet Explorer history data on systems, even those where the application is no longer available, underscores the importance of this artifact for digital forensic investigations. It provides a backtrack to user activities regarding file access, which can be crucial in cases where understanding access to specific files or directories is necessary for the investigation. ## Analyzing The Artifact: * **Accessing Internet Explorer History Files**: To analyze these artifacts, forensic analysts can use specialized tools designed to parse the contents of Internet Explorer history databases. This includes understanding the structure of `WebCacheV*.dat` files for newer versions of Windows, where traditional history files are replaced by a more complex database format. * **Interpretation of Entries**: Analyzing the `file:///C://` entries requires a careful approach. Investigators need to differentiate between mere navigations within the browser and actual file interactions. The context of these entries, combined with other artifacts such as timestamps and user profiles, can provide a comprehensive view of the user's actions related to file access. ## Tools for Analysis: * **IEHistoryView**: For older versions of Internet Explorer (IE6-9), tools like IEHistoryView can simplify the process of viewing and analyzing browser history entries. * **ESEDatabaseView**: For Internet Explorer 10-11 and Windows 10+ systems, ESEDatabaseView can be used to access and analyze the `WebCacheV*.dat` files, offering insights into the structured storage of history data. # Last Visited MRU The LastVisitedMRU (Most Recently Used) and LastVisitedPidlMRU registry keys are instrumental in tracking the applications utilized by a user, as well as the specific directory locations where the last files were accessed by these applications. Present in different locations based on the Windows version, these keys offer a snapshot of user interactions with the file system, which is invaluable for forensic investigations, especially when piecing together the timeline of deleted file activities. ## Key Insights: * **XP Location**: * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedMRU` * **Win7 and Later Location**: * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU` ## Deeper Dive ### **LastVisitedMRU and LastVisitedPidlMRU** * These registry keys not only document the applications executed by the user but, more importantly, the last directory interactions. This can lead to the discovery of important, often hidden or overlooked directories. For investigators, it's particularly valuable for uncovering the traces of deleted files, as it shows where an application last accessed a file, providing clues to the original location of now-deleted or moved files. ## Analyzing The Artifact * To extract meaningful insights from these keys, forensic analysts can follow these steps: 1. **Identify the Application Usage**: Determine which applications have been used by examining the entries in the LastVisitedMRU or LastVisitedPidlMRU keys. 2. **Trace Last Accessed Directories**: Look for the paths associated with these applications to find the last accessed directories. This can indicate the user's file access patterns and highlight areas of the file system that were of interest. 3. **Investigate for Deleted Files**: Knowing the last accessed directories can be a starting point to search for deleted files. Tools that recover deleted files can be directed towards these locations to potentially retrieve lost data. 4. **Contextual Analysis**: Use the information about accessed directories and applications in conjunction with other forensic data to build a comprehensive picture of user behavior and file interaction history. ## Tools for Analysis * **Registry Editors**: View and analyze the contents of the NTUSER.DAT file. * **Forensic Software**: Tools like EnCase, FTK, or Autopsy can parse these registry keys and present the data in a user-friendly manner. * **Deleted File Recovery Tools**: Leverage file recovery tools in the directories highlighted by these keys to search for and potentially recover deleted files. The LastVisitedMRU and LastVisitedPidlMRU keys serve as a critical link in understanding not just user behavior but also in the forensic investigation of file access patterns, particularly in cases involving deleted or otherwise obscured files. # Thumbs.db (Win XP) The `Thumbs.db` file is a hidden database found within directories where images have been viewed in thumbnail mode. This file is primarily associated with Windows XP, where it plays a significant role in digital forensics due to its ability to store metadata about image files, even after those image files have been deleted. Understanding the structure and forensic value of `Thumbs.db` files is crucial for investigators when analyzing evidence from systems running older versions of Windows, as well as in certain cases involving more modern operating systems. **Creation and Purpose** * **Windows XP and Earlier**: In these systems, `Thumbs.db` is automatically generated when a user views a folder in thumbnail view. This functionality was designed to speed up the loading of thumbnails when folders are reopened, by caching the thumbnail images in the `Thumbs.db` file. * **Modern Windows Versions**: The use of `Thumbs.db` files has been largely superseded by the Windows Image Cache in later versions of Windows. However, `Thumbs.db` files can still be created in modern OS versions under specific circumstances, such as when accessing folders over a network (UNC paths) or in backward compatibility scenarios. **Contents of Thumbs.db** The `Thumbs.db` file contains several pieces of information relevant to digital forensics: 1. **Thumbnail Image of Original Picture**: It stores a compressed version of the image file, allowing for the reconstruction of image content even if the original file is no longer present in the folder. 2. **Last Modification Time (Windows XP Only)**: Records the last modification timestamp of the original image file, which can be pivotal in timeline analysis during an investigation. 3. **Original Filename (Windows XP Only)**: The original name of the file as it was when the thumbnail was generated, useful for identifying renamed or deleted files. **Forensic Relevance** * **Evidence of File Existence**: `Thumbs.db` can prove the existence of files that have been deleted or moved from the folder. By extracting and analyzing the thumbnail images, investigators can identify what images were previously stored in the directory. * **Timeline Construction**: The metadata stored within `Thumbs.db`, such as the last modification time, aids in constructing a timeline of user actions and file modifications. * **Recovery of Image Content**: In some cases, the thumbnail images stored in `Thumbs.db` may be the only remaining evidence of an image's content, making them a valuable resource for investigation. **Analysis Tools and Techniques** Several forensic tools can extract and analyze the contents of `Thumbs.db` files, including but not limited to: * **Thumbs.db Viewer**: Designed specifically for the examination of `Thumbs.db` files, this tool can display the thumbnail images and extract metadata. * **Forensic Imaging Tools**: Tools such as EnCase and FTK can process `Thumbs.db` files as part of a broader forensic analysis of the file system, extracting thumbnails and metadata for investigators. **Challenges and Considerations** * **Privacy Concerns**: The extraction and analysis of `Thumbs.db` files involve considerations regarding the privacy of individuals, as personal photos and images may be recovered. * **Data Integrity**: Ensuring the integrity of `Thumbs.db` files during extraction and analysis is critical, as with all digital evidence. Proper chain of custody and documentation are required. # Thumbcache The thumbcache system in Windows represents a sophisticated mechanism for storing and managing thumbnail images of files, including pictures, documents, and folders. Introduced in Windows Vista and present in all subsequent versions, thumbcache plays a crucial role in digital forensics, particularly in the examination of user activities and file access histories. **Overview and Location** Thumbcache files are located in the user profile directory, specifically under `%USERPROFILE%\AppData\Local\Microsoft\Windows\Explorer`. These database files are crucial for forensic investigators as they store thumbnail images of various files accessed by a user, allowing for a reconstruction of user activity and potentially recovering evidence of files that have been deleted. **Structure and Content** * **Database Files**: The thumbcache consists of several database files, each named according to the size of the thumbnails they store, such as `Thumbcache_256.db`, `Thumbcache_1024.db`, etc. This naming convention reflects the pixel dimensions of the thumbnails, catering to different sizes like small, medium, large, and extra-large. * **Contents**: Inside these databases, thumbnails for pictures, documents, and even folder previews are stored. These thumbnails are generated and stored to improve the user experience by speeding up the loading of icons in File Explorer. **Forensic Relevance** 1. **File Access and Deletion Evidence**: Thumbnails stored in the thumbcache can serve as evidence that a specific file was accessed by the user. Even if the original file is deleted, its thumbnail might remain in the cache, providing crucial evidence of its existence. 2. **Timeline Analysis**: The creation and modification times of the thumbcache files themselves can offer insights into when certain files were viewed or accessed, aiding in timeline reconstruction during an investigation. 3. **Cross-Reference with Windows Search Database**: The Thumbnail Cache ID, a unique identifier for each thumbnail, can be cross-referenced within the Windows Search Database. This allows forensic analysts to link thumbnails back to their original filenames, paths, and access additional file metadata, enhancing the investigative process. **Analysis Tools and Techniques** Forensic analysts utilize specialized tools to extract and analyze data from thumbcache files. Some of these tools include: * **Thumbcache Viewer**: Allows for the extraction and viewing of thumbnail images stored within the thumbcache files, facilitating the identification of previously accessed files. * **Forensic Software Suites**: Comprehensive forensic tools like EnCase and FTK can process thumbcache files, extracting thumbnails and associated metadata for analysis. **Challenges and Considerations** * **Privacy Concerns**: Analysis of thumbcache files may raise privacy issues, as thumbnails of personal photos and documents are accessible to investigators. * **Data Volatility**: Thumbcache files are subject to overwriting and deletion, meaning that evidence may be ephemeral. Regular maintenance tasks and user actions can lead to the loss of forensic artifacts.
# Recycle Bin The Recycle Bin on Windows systems is a special folder that temporarily stores deleted files and folders. It is a key artifact in forensic analysis, particularly for investigating deleted file artifacts. The Recycle Bin captures files that have been "soft deleted," meaning they are marked for deletion but not immediately removed from the file system. This allows for the potential recovery of deleted items, along with the associated metadata, which can provide valuable insights into user actions. ## Key Insights: * **Windows XP Path**: * `C:\Recycler` * **Windows 7 and Later Path**: * `C:\$Recycle.Bin` * **User-Specific SID Sub-Folders**: * Each user's deleted items are stored in a sub-folder within the Recycle Bin, identified by the user's Security Identifier (SID). This SID can be mapped back to a specific user via the Registry, providing a clear link between deleted items and the account responsible for the deletion. * **Metadata Storage**: * **Windows XP**: The `INFO2` file within the `C:\Recycler` directory contains metadata such as deletion times and original filenames. * **Windows 7 and Later**: Files starting with `$I######` hold metadata like the original filename and deletion date/time, while files beginning with `$R######` contain the contents of the deleted file. ## Deeper Dive ### **Understanding Recycle Bin Artifacts** * **Metadata Files**: The `$I` files are instrumental in determining when a file was deleted and what it was called prior to deletion. This information can be critical in timeline analysis and understanding user behavior. * **Content Files**: The `$R` files are essentially the deleted files themselves, preserved until the Recycle Bin is emptied. These files can be a goldmine for investigators, potentially containing evidence or important insights into the case at hand. ## Analyzing The Artifact * **Identifying User Actions**: By examining the metadata associated with each deleted item, investigators can piece together a timeline of deletion events, correlating these with other user actions or system events. * **Recovering Deleted Files**: The ability to directly access and recover the contents of deleted files provides a direct path to evidence that may have been thought lost. This can include documents, images, or any other file type that was deleted by the user. * **SID Mapping**: Mapping the SID sub-folders to specific users allows for the attribution of deletion actions to individual accounts, adding a layer of accountability and specificity to the forensic analysis. # User Typed Paths The user-typed paths feature in Windows, particularly the use of the File Explorer path bar, offers a direct method for users to navigate to specific file locations without the need to browse through folder hierarchies. This capability is especially useful for quickly accessing deeply nested directories or frequently used locations. The paths that users type into the File Explorer path bar are recorded in the Windows Registry under the TypedPaths key, providing a useful trail of user activity for forensic analysis. Here's a detailed overview based on the provided information and structured according to the template. ## Overview **Description**: The TypedPaths feature in Windows records the paths that users directly type into the File Explorer path bar. This functionality is crucial for digital forensic investigations as it reveals user interactions with the file system, including access to potentially sensitive or hidden locations, external drives, and network shares. ## Functionality * **File Management**: Directly typing paths into the File Explorer path bar facilitates quick navigation to specific directories or files, bypassing the graphical user interface's folder structure. * **User Interface**: This feature directly interacts with the File Explorer path bar, a component of the File Explorer user interface. * **Registry Configuration**: User-typed paths are recorded in the Windows Registry under the key `NTUSER\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths`. Each entry under this key represents a path that the user has manually entered into the File Explorer path bar. * **Multiple Instances**: Not applicable in the context of process instances, but multiple paths can be recorded under the TypedPaths key, reflecting the variety of locations accessed by the user. ## Security Considerations * The TypedPaths key can reveal a user's knowledge of specific file system locations, which might include sensitive or hidden directories, as well as locations on external drives or network shares. * Analysis of the TypedPaths key can expose access patterns and potentially unauthorized or suspicious access to certain file locations. * Malicious actors with access to a user's profile could potentially manipulate these entries to obscure unauthorized access or to plant misleading information as part of a broader attack strategy. # Windows Search Database The Windows Search Database plays a pivotal role in digital forensics due to its comprehensive indexing of file types and content across Windows systems. It provides a rich source of evidence for investigators by cataloging not just file metadata, but in many cases, partial content of the files themselves. This database is instrumental in forensic investigations for reconstructing user activities, identifying document accesses, and even uncovering attempts to conceal or delete information. **Overview and Location** Windows Search uses the Windows.edb database file to store its index. The location of this file varies depending on the version of Windows: * **Windows XP**: `C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb` * **Windows 7 and Newer**: `C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb` Additionally, Windows 7 and newer versions store GatherLogs in `C:\ProgramData\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex`, which provides a log of files considered for indexing within each 24-hour period. **Database Structure** * **Extensible Storage Engine (ESE) Format**: The Windows.edb database is structured using the ESE format, a robust and efficient data storage technology developed by Microsoft. This format supports high-volume data transactions and is optimized for quick access to indexed information. * **Gather Logs**: These logs are particularly useful for forensic analysts as they provide a record of candidate files for indexing, offering insights into user activity and system usage over time. **Forensic Relevance** 1. **Extensive File Metadata**: The Windows Search Database stores detailed metadata about files, including but not limited to file names, paths, sizes, creation, and modification dates. This metadata can be crucial for timeline analysis and understanding the context of file usage. 2. **Partial File Content**: In some cases, the database includes partial content of the files it indexes. This can be particularly useful in investigations where the actual files may have been deleted or are otherwise inaccessible. 3. **Reconstruction of User Activity**: By analyzing the Windows.edb file and the GatherLogs, investigators can reconstruct a user's activity, identifying which files were accessed or modified and when. This information can be vital in both criminal and corporate investigations. **Analysis Tools and Techniques** Analyzing the Windows Search Database requires specialized tools capable of parsing the ESE database format. Some of these tools include: * **ESE Database Viewers**: Tools designed specifically to view and analyze ESE databases can extract information from Windows.edb, allowing forensic analysts to access the indexed metadata and content. * **Digital Forensics Software**: Comprehensive forensic suites like EnCase and FTK include modules or plugins that can process Windows.edb files, extracting and presenting the data in a forensically sound manner. **Challenges and Considerations** * **Data Volume**: The sheer volume of data contained in the Windows Search Database can be overwhelming, requiring forensic analysts to use targeted search and analysis techniques to identify relevant evidence. * **Privacy and Legal Concerns**: The examination of file metadata and content can raise privacy and legal issues, necessitating careful adherence to legal guidelines and ethical standards during forensic analysis # File Download # Zone.Identifier The `Zone.Identifier` alternate data stream (ADS) is a core component of Windows' Mark of the Web (MotW) security framework. When a file is downloaded from the Internet, Windows tags it with a hidden NTFS ADS named `Zone.Identifier` containing metadata about the file's origin. This tag is used by the operating system, Microsoft Office, SmartScreen, and other security features to warn users before opening potentially dangerous files. For forensic analysts, `Zone.Identifier` provides direct evidence that a file was downloaded from an external source and can reveal where it came from. ### How It Works When a file is downloaded through a MotW-aware application, the Windows API function `IAttachmentExecute` writes a `Zone.Identifier` ADS to the file. This ADS is only preserved on NTFS volumes. Files moved to FAT32, exFAT, or network shares using non-NTFS file systems will lose the stream. The `Zone.Identifier` stream is a plain-text INI-style file containing a `[ZoneTransfer]` section with one or more of the following fields: ```ini [ZoneTransfer] ZoneId=3 ReferrerUrl=https://example.com/downloads HostUrl=https://cdn.example.com/file.exe ``` ### ZoneId Values | ZoneId | Zone Name | Description | | ------------------------------------- | --------------------------------------------- | --------------------------------------------------------------------------------------------------- | | 0 | MyComputer | File originated from the local machine | | 1 | Intranet | File originated from the local intranet | | 2 | Trusted | File originated from a trusted site | | 3 | Internet | File originated from the Internet (most common for downloads) | | 4 | Untrusted | File was flagged as suspicious (e.g., by Microsoft SmartScreen) | ZoneId=3 is by far the most common value encountered during investigations and indicates a standard Internet download. ### Additional Fields * **ReferrerUrl:** The URL of the page that initiated the download. This can reveal the website the user was visiting when the download occurred. * **HostUrl:** The direct URL from which the file was downloaded. This is useful for tracing the exact source of a payload. * **HostIpAddress:** In some cases, the IP address of the download host is recorded (primarily seen with downloads via Edge). Not all applications populate all fields. The presence and completeness of these fields varies by browser and download method. ### Application Support #### Applications That Set MotW * **Modern browsers:** Microsoft Edge, Google Chrome, and Mozilla Firefox all tag downloaded files with `Zone.Identifier`. Edge and Chrome tend to populate both `ReferrerUrl` and `HostUrl`. Firefox populates `ReferrerUrl` but may not always include `HostUrl`. * **Email clients:** Outlook tags attachments saved to disk. * **Windows built-in:** Files downloaded via Windows Explorer (e.g., from network shares mapped to Internet zone). #### Applications That Do NOT Set MotW * **Command-line tools:** `curl.exe`, `wget`, `bitsadmin`, PowerShell's `Invoke-WebRequest` / `Invoke-RestMethod`, and `ftp.exe` do **not** apply the `Zone.Identifier` ADS by default. This is a critical gap. If an attacker downloads a payload using these tools, the file will lack MotW and will not trigger SmartScreen warnings. * **Some third-party download managers and torrent clients** may not apply MotW. * **Git clone operations** do not apply MotW to cloned files. > **Forensic Implication****:** The ***absence*** of a `Zone.Identifier` on a file that appears to have been downloaded can itself be an indicator. It may suggest the file was downloaded via a command-line tool, extracted from a container format that stripped MotW, or had its ADS deliberately removed. ### MotW Bypass Techniques (MITRE ATT\&CK T1553.005) MotW bypasses are actively exploited in the wild and are directly relevant to DFIR investigations. Understanding these techniques helps explain why a downloaded malicious file may lack a `Zone.Identifier` or why SmartScreen did not trigger. #### Container Format Bypasses Certain container file formats do not properly propagate MotW to their contents when extracted: * **ISO / IMG files:** When a user mounts an ISO or IMG file, the files inside are accessed via a virtual drive and do not inherit MotW. This technique has been heavily abused since Microsoft disabled Office macros by default for Internet-sourced documents in 2022. Threat actors commonly deliver malicious payloads inside ISO files attached to phishing emails. * **VHD / VHDX files:** Same behavior as ISO files. Mounting a VHD bypasses MotW for files inside. * **CAB files:** In some configurations, extracting CAB files does not propagate MotW. #### Archive Tool Vulnerabilities * **CVE-2025-0411 (7-Zip):** Versions before 24.09 did not propagate MotW to files within double-compressed archives (an archive inside an archive). Exploited as a zero-day by Russian threat actors against Ukrainian targets using SmokeLoader. * **CVE-2024-8811 / CVE-2025-33028 (WinZip):** WinZip 29.x and earlier failed to propagate MotW to extracted files. * **CVE-2024-38217:** A Windows vulnerability allowing MotW bypass through specially crafted archive files. * **CVE-2024-38213:** Exploited by DarkGate operators to bypass SmartScreen using MotW manipulation. * **CVE-2022-41091 / CVE-2022-44698:** Earlier MotW bypass vulnerabilities in Windows itself. #### Deliberate MotW Removal The `Zone.Identifier` ADS can be stripped from a file through built-in Windows mechanisms, third-party tools, or by directly deleting the alternate data stream. Once removed, it cannot be recovered unless a backup or forensic image preserved the original ADS. The absence of MotW on a file you expect to have been downloaded should be treated as suspicious and investigated further. ### Analyzing the Artifact #### Reading Zone.Identifier on a Live System ```powershell # PowerShell - read the ADS contents Get-Content -Path "C:\Users\user\Downloads\file.exe" -Stream Zone.Identifier # PowerShell - list all files with Zone.Identifier in a directory Get-ChildItem -Path "C:\Users\user\Downloads" -Recurse | ForEach-Object { Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue } | Select-Object FileName ``` ```cmd # Command line - using notepad to view the ADS notepad "C:\Users\user\Downloads\file.exe:Zone.Identifier" # Using more more < "C:\Users\user\Downloads\file.exe:Zone.Identifier" ``` #### Forensic Image Analysis * **MFTECmd (Eric Zimmerman):** Parse the MFT to identify files with alternate data streams, including `Zone.Identifier`. This can reveal downloaded files even in unexpected locations like `C:\Windows\System32` or temp directories. * **FTK Imager:** View ADS contents directly from a forensic image. * **The Sleuth Kit (TSK):** Use `fls` to list files with ADS, `istat` to view ADS details for a specific MFT entry, and `icat` to extract the ADS contents. * **Velociraptor:** The `Windows.NTFS.ADSHunter` artifact can scan for and collect `Zone.Identifier` streams across a system. * **Windows Sysinternals Streams:** `streams.exe -s C:\Users` recursively lists all files with ADS. #### What to Look For During an investigation, focus on: * Files with ZoneId=3 or ZoneId=4 in sensitive directories (System32, ProgramData, temp folders, user profile root). * `HostUrl` or `ReferrerUrl` values pointing to suspicious domains, IP addresses, paste sites, file-sharing services, or CDN URLs commonly abused for payload hosting. * Downloaded executables, scripts (.ps1, .vbs, .js, .hta, .wsf), or Office documents with macros. * The *absence* of `Zone.Identifier` on files that contextual evidence (browser history, Prefetch, proxy logs) suggests were downloaded. This may indicate a MotW bypass or command-line download tool was used. ### Artifact Correlation * **Browser History:** Correlate `HostUrl`/`ReferrerUrl` from `Zone.Identifier` with browser download records to build a complete picture of the download chain. * **Prefetch / Amcache:** Determine if a downloaded executable was subsequently executed. * **$MFT / $UsnJrnl:** Timeline file creation events alongside `Zone.Identifier` data to establish when files arrived on the system. * **Email Headers / Attachments:** For files saved from email, correlate with email artifacts to identify the sender and delivery path. * **Proxy / Firewall Logs:** Match `HostUrl` values against network logs for additional context. ### References * [MITRE ATT\&CK T1553.005 - Mark-of-the-Web Bypass](https://attack.mitre.org/techniques/T1553/005/) * [Red Canary: Mark of the Web Bypass](https://redcanary.com/threat-detection-report/techniques/mark-of-the-web-bypass/) * [Microsoft: IAttachmentExecute Interface](https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iattachmentexecute) * [BleepingComputer: 7-Zip MotW bypass exploited in zero-day attacks](https://www.bleepingcomputer.com/news/security/7-zip-motw-bypass-exploited-in-zero-day-attacks-against-ukraine/) # Open/Save Most Recently Used (MRU) The Open/Save Most Recently Used (MRU) feature is a key component of the Windows operating system that memorizes the files and directories a user has recently accessed. This mechanism, integrated into the Windows user interface, simplifies file retrieval and enhances user efficiency by reducing the need for extensive navigation through file systems. The MRU system supports a wide range of applications, making it a ubiquitous element of the Windows user experience. ## Key Insights: * **Registry Storage**: * **General Path**: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU` * **Windows XP Path**: `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU` * **Format and Content**: The registry contains values named after file extensions or identifiers (like `*` for all files), with paths stored in binary or string formats. Additionally, individual applications may maintain their own MRU lists in specific registry paths or configuration files. ## Deeper Dive ### **Forensic Importance in Incident Response** * **Timeline Analysis**: The timestamps associated with MRU entries can be instrumental in constructing a timeline of events, helping to pinpoint when specific files were accessed. * **User Behavior Insight**: Analyzing the contents of MRU lists can provide a glimpse into user behavior, including file interactions that might indicate unauthorized access or interest in sensitive information. * **Malware Indicators**: MRU paths leading to executable files or documents that are known vectors for malware can serve as indicators of a security breach. * **Evidence Corroboration**: Data from MRU entries can corroborate findings from other digital artifacts, providing a more comprehensive understanding of an incident. ## User Interface Reflection * The Open and Save dialog boxes in Windows applications utilize MRU data to display a list of recent documents, streamlining the file access process. Similarly, the Quick Access or Recent Documents sections in File Explorer aggregate MRU data to highlight frequently used files and folders. * Jump Lists, accessible by right-clicking an application on the taskbar, also draw from MRU entries to present a list of recently opened files associated with that application. ## Forensic Relevance * The convenience features provided by the MRU system, while primarily designed to enhance user efficiency, can also be leveraged in forensic investigations. The data captured by Open/Save MRU entries offers a window into user behavior, revealing patterns that might otherwise remain hidden. This information can be especially valuable in cases involving data breaches, unauthorized file access, or the introduction of malware into a system. ## Practical Example * In investigating a data breach, an analyst might discover MRU entries pointing to unusual file types or locations, such as external drives or network paths not typically accessed by the user. These entries, when analyzed alongside other digital evidence like access logs, can offer vital clues to the methods and pathways utilized in the breach, aiding in the reconstruction of the incident and the identification of potential security lapses. The Open/Save MRU feature, by keeping a record of recently accessed files and directories, not only simplifies file operations for users but also serves as a significant artifact in digital forensics. Its analysis can reveal a wealth of information about user activities, offering insights that are critical in the context of incident response and investigation. # Email Email services are pivotal in everyday communication, frequently used to exchange files. When files are downloaded from email clients or web-based email services, they are usually saved to a default download folder or a temporary location on the computer. These paths can be crucial in digital forensics for tracing the origin of files and understanding user behavior. ## Popular Email Services and Their File Download Mechanisms: ### Microsoft Outlook * **Process Name**: OUTLOOK.EXE * **Default File Path for Downloads**: * `%USERPROFILE%\Downloads` for attachments saved manually by the user. * **Temporary Folder**: * `%USERPROFILE%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook` for attachments opened directly within Outlook. ### Mozilla Thunderbird * **Process Name**: thunderbird.exe * **Default File Path for Downloads**: * `%USERPROFILE%\Downloads` or custom path set by the user. * **Temporary Folder**: * `%USERPROFILE%\AppData\Local\Temp` for files temporarily stored during access. ### Gmail (Web-based) * **Process Name**: Browser-dependent (e.g., chrome.exe, firefox.exe) * **Default File Path for Downloads**: * Browser's default download location, typically `%USERPROFILE%\Downloads`. * **Temporary Folder**: * Browser-specific cache directory, such as `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Cache` for Chrome. ### Yahoo Mail (Web-based) * **Process Name**: Browser-dependent * **Default File Path for Downloads**: * Follows the browser's configured download path, usually `%USERPROFILE%\Downloads`. * **Temporary Folder**: * Dependent on the browser used; for instance, Firefox might use `%USERPROFILE%\AppData\Local\Mozilla\Firefox\Profiles\\cache2`. ## Forensic Analysis Considerations: * **Temporary Folders**: These locations are critical in forensic investigations for identifying files that were not saved permanently but opened directly from email applications. * **Path Analysis**: The default and temporary paths can reveal not just the files exchanged via email but also the user's habits in managing downloaded content. * **Process Tracking**: Knowing the process names associated with email services allows forensic analysts to track application usage and file access through logs and system monitoring tools. ## Practical Implications in Digital Forensics: By examining the default download locations and temporary folders used by email services, forensic analysts can uncover evidence related to file transfers, including the origin of malicious files or unauthorized data exfiltration. This information is invaluable for constructing timelines, understanding user behavior, and supporting investigations into cybersecurity incidents or data breaches. # Drive By Downloads ## Understanding Drive-By Downloads Drive-by downloads can be initiated by simply visiting a website with malicious content, without any interaction from the user (such as clicking on a link). These threats often leverage: * **Exploits in Web Browsers**: Outdated or vulnerable browsers can be exploited to download malware. * **Compromised Websites**: Legitimate websites that have been hacked to serve malware. * **Malvertising**: Malicious advertisements on legitimate sites that can redirect users to malware-serving pages. ### How They Work 1. **Initial Contact**: The user visits a compromised website, which contains malicious code. 2. **Exploit**: The malicious code exploits vulnerabilities in the browser or its plugins. 3. **Download and Execute**: Malware is downloaded and executed on the user’s system, often without their knowledge. ### Detecting Drive-By Downloads on Windows Detection of drive-by downloads involves monitoring for suspicious activities and artifacts indicative of unauthorized downloads or executions. Key strategies include: #### Security Software * **Antivirus and EDR Solutions**: Continuously monitor for malware signatures and suspicious behaviors, including unauthorized downloads and executions. #### Browser and Plugin Updates * **Regular Updates**: Keeping browsers and plugins updated reduces vulnerabilities that can be exploited by malicious websites. #### Network Monitoring Tools * **Traffic Analysis**: Tools like Wireshark can monitor network traffic for suspicious activities, including connections to known malicious domains. #### System Logs and Artifacts * **Windows Event Logs**: Monitor security and application logs for suspicious entries indicating unauthorized activities. * [**Prefetch Files**](/windows-artifacts/program-execution/prefetch): Windows prefetch (`%SystemRoot%\Prefetch`) contains files that can show the execution of unexpected or unknown applications. * [**Browser Cache**](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/21/windows-artifacts/file-download/web-browsing/cache-files) **and** [**History**](/windows-artifacts/browser-usage/history-and-downloads): Examination of browser cache and history can reveal visits to known malicious sites or unexpected file downloads. #### File System Monitoring * **Unexpected Files or Directories**: Automated tools can monitor file systems for the creation of new, unexpected files or directories, often used by malware. ### Best Practices for Prevention * **Use Up-to-date Security Software**: Ensure comprehensive security solutions are installed and regularly updated. * **Enable Software Restriction Policies**: Use policies to block the execution of programs from common malware locations, such as temporary folders. * **Educate Users**: Training on the risks of malicious websites and the importance of cautious web browsing can reduce the risk of drive-by downloads. ### Forensic Analysis In the aftermath of a suspected drive-by download, forensic analysis can help in identifying the source and impact of the infection. This includes: * **Timeline Analysis**: Constructing a timeline of events to understand the sequence of actions leading to the malware infection. * **Artifact Examination**: Analyzing artifacts such as browser history, cache, and system logs to identify the infection vector. * **Malware Analysis**: Examining the downloaded malware to understand its capabilities, origin, and potential data exfiltration activities. Detecting drive-by downloads on Windows systems requires a combination of technical safeguards, user education, and vigilant monitoring of system and network activities. By employing a multi-layered security approach, organizations and individuals can significantly reduce the risk of malware infection through drive-by downloads. # Malvertising Malvertising, a portmanteau of "malicious advertising," refers to the practice of embedding malware within digital advertisements. This cyberattack method exploits online advertising networks to distribute malware to unsuspecting users, bypassing the need for direct interaction with malicious sites. Malvertising can target any website, including highly reputable ones, by submitting or injecting malicious ads into the web advertising supply chain. This deep dive explores the technical mechanisms, attack vectors, detection methods, and mitigation strategies associated with malvertising. #### Mechanisms and Attack Vectors 1. **Compromised Advertisements**: Malvertisers often submit malicious ads directly to advertising networks. These ads might look legitimate but contain malicious code or redirect users to malicious sites when clicked. 2. **Exploit Kits**: Some malvertisements leverage exploit kits, which are automated threats that exploit vulnerabilities in browsers, plugins, or applications to install malware without user interaction. 3. **Drive-by Downloads**: Through malvertising, users can be exposed to drive-by download attacks, where malware is downloaded and executed simply by visiting a website with a malicious ad, without any click required. 4. **Malicious Redirects**: Malicious scripts within ads can redirect users to phishing sites or other malicious domains, exploiting vulnerabilities or deceiving users into downloading malware. #### Technical Aspects * **IFrame Tags**: Malicious ads often use hidden IFrame tags to embed external content that can execute without user knowledge, leading to stealthy malware injection. * **JavaScript Obfuscation**: Malvertisers frequently obfuscate malicious JavaScript code within ads to bypass detection by ad networks and security tools. * **Zero-Day Exploits**: Utilization of previously unknown vulnerabilities (zero-days) in browsers or plugins makes some malvertising attacks particularly difficult to detect and prevent. #### Detection Methods 1. **Behavioral Analysis**: Monitoring and analyzing the behavior of ads, such as unexpected redirections or attempts to execute code, can help in detecting malvertising. 2. **Code Inspection**: Regular inspection of ad code for obfuscation, suspicious URLs, or known malicious patterns is critical for ad networks. 3. **Anomaly Detection**: Implementing anomaly detection systems to identify unusual traffic patterns or ad performance metrics can signal a malvertising campaign. 4. **Threat Intelligence**: Leveraging threat intelligence feeds to identify known malicious domains, IP addresses, or malware signatures associated with malvertising. #### Mitigation Strategies 1. **Regular Software Updates**: Keeping browsers, plugins, and ad-serving platforms updated to mitigate known vulnerabilities exploited by malvertisers. 2. **Ad Blockers and Anti-Malware**: Using ad blockers and anti-malware solutions can help prevent malvertising from reaching end-users, though this may not be feasible for ad-supported websites. 3. **Secure Ad Serving Practices**: Ad networks and publishers should implement secure ad serving practices, such as scanning and vetting ads for malicious content before serving them. 4. **Network Segmentation**: Limiting ad server network access and segmenting networks can reduce the spread of malware introduced by malvertising. 5. **User Education**: Educating users about the risks associated with clicking on advertisements and encouraging the use of reputable ad blockers and security software. #### Challenges * **Evolving Tactics**: Malvertisers continuously adapt their strategies to bypass security measures, making detection and prevention a moving target. * **Supply Chain Complexity**: The complexity of the online advertising supply chain, involving multiple intermediaries, makes it difficult to ensure the security of every ad served. * **Legitimate vs. Malicious Ads**: Distinguishing between legitimate and malicious ads can be challenging due to sophisticated obfuscation techniques used by malvertisers. Malvertising represents a significant security threat within the digital advertising ecosystem, affecting publishers, ad networks, and users alike. Combating this threat requires a multi-faceted approach, including advanced detection technologies, stringent ad vetting processes, and ongoing user education. As malvertising techniques continue to evolve, so too must the strategies to detect and mitigate them # Web Browsing Some MacOS included in here as well Web browsers are the gateways through which users access and download content from the Internet. Each browser has its own set of conventions for managing file downloads, including specified directories for saving files and temporary storage locations for files in transit. These details can be critical in forensic contexts, offering insights into user actions and the provenance of files. ## Popular Web Browsers and Their Download Mechanisms: ### Google Chrome * **Process Name**: chrome.exe * **Default File Path for Downloads**: * `%USERPROFILE%\Downloads` on Windows, `~/Downloads` on macOS. * **Temporary Folder**: * `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Cache` on Windows, `~/Library/Caches/Google/Chrome/Default/Cache` on macOS for cached content. ### Mozilla Firefox * **Process Name**: firefox.exe * **Default File Path for Downloads**: * `%USERPROFILE%\Downloads` on Windows, `~/Downloads` on macOS. * **Temporary Folder**: * `%USERPROFILE%\AppData\Local\Mozilla\Firefox\Profiles\\cache2` on Windows, `~/Library/Caches/Firefox/Profiles//cache2` on macOS for cached downloads. ### Microsoft Edge * **Process Name**: msedge.exe * **Default File Path for Downloads**: * `%USERPROFILE%\Downloads` on Windows. * **Temporary Folder**: * `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Cache` on Windows for temporary files and cached content. ### Safari * **Process Name**: Safari.exe (on Windows, though primarily used on macOS) * **Default File Path for Downloads**: * `~/Downloads` on macOS. * **Temporary Folder**: * `~/Library/Caches/com.apple.Safari/Cache.db` on macOS for caching web content. ### Opera * **Process Name**: opera.exe * **Default File Path for Downloads**: * `%USERPROFILE%\Downloads` on Windows, `~/Downloads` on macOS. * **Temporary Folder**: * `%USERPROFILE%\AppData\Local\Opera Software\Opera Stable\Cache` on Windows, `~/Library/Caches/Opera Software/Opera Stable/Cache` on macOS for cached files. ## Forensic Analysis Considerations: * **Temporary Folders**: These locations are vital for uncovering files that may not have been permanently saved by the user but were part of the browsing activity. * **Download Histories**: Apart from physical file locations, examining the browser's download history can provide a chronological account of user downloads. * **Cache Analysis**: Cached content can reveal accessed web pages, videos, images, and partially downloaded files, offering additional clues about user behavior and interactions. ## Practical Implications in Digital Forensics: The investigation of default download locations and temporary folders across browsers is crucial for identifying how, when, and what type of content was downloaded or accessed. This analysis aids in constructing user activity timelines, identifying evidence of illicit activities, and correlating downloaded content with potential security incidents. # Cache Files Web browsers are essential tools for navigating the internet, often used to download files and access online content. Each browser has a default location for storing downloaded files and utilizes a cache system to optimize the browsing experience. Cache files, while beneficial for performance, can sometimes be flagged by EDR systems due to security concerns. ## Web Browsers and File Downloads: ### Google Chrome * **Location**: * `%USERPROFILE%\AppData\Local\Google\Chrome\User Data\Default\Cache` * `~/Library/Application Support/Google/Chrome/Default/Cache` ### Mozilla Firefox * **Location**: * `%USERPROFILE%\AppData\Local\Mozilla\Firefox\Profiles\\cache2` * `~/Library/Application Support/Firefox/Profiles//cache2` ### Microsoft Edge * **Location**: * `%USERPROFILE%\AppData\Local\Microsoft\Edge\User Data\Default\Cache` on Windows. ### Safari (macOS) * **Location**: * `~/Library/Caches/com.apple.Safari/Cache.db`. ## Purpose of Cache Files: Cache files store web page elements such as images, scripts, and HTML files locally. This storage strategy serves multiple purposes: * **Reduced Load Times**: By storing copies of web content locally, browsers can load visited pages more quickly during subsequent visits. * **Offline Content Access**: Cached content can be accessed without an internet connection, allowing users to view previously visited pages offline. * **Bandwidth Savings**: Caching minimizes the need to re-download static content, conserving bandwidth. ## Why EDRs Might Detect Cache Files: EDR (Endpoint Detection and Response) systems are designed to monitor and respond to threats on endpoints. Cache files can be flagged by EDRs for several reasons: * **Malware Detection**: Malicious scripts or payloads can be stored in cache files when a user visits a compromised website. * **Privacy Concerns**: Cached files can contain sensitive information, posing a risk if accessed by unauthorized parties. * **Anomalous Behavior**: Sudden changes in cache size or content might indicate unauthorized downloads or malware activity, triggering alerts from EDR systems. ## Practical Implications in Digital Forensics: Understanding the default download and cache locations for web browsers is crucial in forensic investigations for several reasons: * **Evidence Collection**: Download and cache directories can contain files relevant to investigations, including malicious downloads or files indicative of user behavior. * **Investigative Leads**: Analysis of cache files can reveal visited websites, downloaded content, and timestamps, aiding in timeline construction and incident analysis. * **Security Analysis**: Identifying and examining cache files flagged by EDRs can uncover malware infection vectors and data exfiltration methods. Forensic analysts leverage knowledge of browser behavior, including file downloads and caching mechanisms, to gather evidence, analyze user actions, and assess security threats. Understanding how and why browsers store files and how EDR systems interact with these files is key to comprehensive digital forensic and cybersecurity practices. # CrowdStrike Searches # MoTW ```splunk-spl index=main | search ComputerName="*" | search FileName="*" | search event_simpleName=MotwWritten | table _time, aid, ComputerName, FileName, FilePath, ZoneIdentifier_decimal, HostUrl, ReferrerUrl ``` # Folder/File Opening/Creation # Recent Files The "Recent Files" functionality in Windows is a critical artifact for forensic investigators, as it records the files and folders that have been accessed most recently by a user. This data is used to populate areas such as the "Recent" menus found in some versions of the Start menu, offering quick access back to recently used resources. ## Key Insights: * **Registry Path**: * `NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs` Within this key, Windows tracks the user's recently accessed files and folders, organizing this information in a way that can be highly informative for digital forensic analysis. * **RecentDocs**: * The `RecentDocs` key acts as a rollup, tracking the overall order of the last 150 files or folders opened. It maintains a Most Recently Used (MRU) list that records the temporal order in which each file or folder was accessed. * **Extension-Specific Subkeys (.???)**: * These subkeys are named after the file extensions (e.g., .docx, .xlsx) and store information about the last 20 files opened of each type. Like the `RecentDocs` key, they also maintain an MRU list, with the last write time of the key indicating the time at which the most recently used item of that file type was opened. * **Folder Subkey**: * This subkey specifically tracks the last 30 folders opened by the user. The most recently used item within this key has its last write time updated to reflect the time of the most recent folder access. ## Deeper Dive The structure of the `RecentDocs` key and its subkeys provides a multi-faceted view of user behavior, showing not only the files and folders a user has accessed but also when they were accessed. This can be pivotal in investigations, offering clues about the sequence of user actions and their interaction with specific data. ## Analyzing The Artifact To analyze the "Recent Files" artifact, forensic analysts can follow these steps: 1. Access the `NTUSER.DAT` file of the user profile in question to locate the `RecentDocs` key. 2. Review the MRU list in the `RecentDocs` key for an overview of the last 150 accessed files or folders. 3. Examine the extension-specific subkeys to identify the last 20 files opened for each file type, using the last write time as a timestamp for the most recent access. 4. Investigate the `Folder` subkey to understand the user's recent folder access patterns, again using the last write time for the most recent access indication. 5. Correlate this information with other forensic artifacts to build a comprehensive timeline of user activity. ## Tools for Analysis * **Registry Editors**: Tools like RegEdit can manually explore the Windows Registry, but for forensic purposes, more specialized tools are preferred. * **AccessData Registry Viewer**: A tool designed for forensic analysis of the Windows Registry, allowing for easy navigation, search, and analysis of keys like `RecentDocs`. * **NirSoft RegScanner**: This utility allows for quick searching and exporting of specific Registry keys, making it useful for locating and analyzing the `RecentDocs` key and its subkeys. # Office Recent Files Microsoft Office programs maintain a registry-based list of recent files to facilitate user access to previously opened documents. This feature is instrumental for digital forensic analysts when investigating a subject's document access patterns, as it records detailed information about the files accessed by MS Office applications. The registry keys involved vary by Office version and user account type, including specific paths for different Office applications and account configurations. ## Key Insights: * **Registry Path for Traditional Installations**: * `NTUSER.DAT\Software\Microsoft\Office\\\File MRU` * Versions range from `10.0` (Office XP) to `16.0` (Office 2016/2019/M365), with each version number corresponding to a specific release of MS Office. * **Registry Path for Microsoft 365 with LiveID**: * `NTUSER.DAT\Software\Microsoft\Office\\UserMRU\LiveID_####\File MRU` * This path is used for Microsoft 365 installations associated with a LiveID. * **Registry Path for Microsoft 365 with Azure Active Directory (ADAL)**: * `NTUSER.DAT\Software\Microsoft\Office\\UserMRU\ADAL_####\File MRU` * This path caters to Microsoft 365 installations linked to Azure Active Directory. ## Deeper Dive * **File MRU Registry Key**: * This key records the most recently used (MRU) files by each MS Office application, providing full path information along with the last opened timestamp. The `File MRU` key is critical for understanding user behavior, document access patterns, and potential evidence in digital investigations. * **Version-Specific Paths**: * The registry paths change with the Office version, indicating the evolution of Office software and its configuration settings. Notably, `16.0` covers Office 2016, 2019, and Microsoft 365 versions, reflecting the transition to a subscription-based model. * **UserMRU Key**: * The `UserMRU` key distinguishes between user accounts, particularly for Microsoft 365 users, either through LiveID or Azure AD. This distinction is crucial for investigations involving cloud-based services and enterprise environments. ## Analyzing The Artifact 1. **Identify Office Version**: Determine the version of Office installed on the system to locate the correct registry path. 2. **Navigate to the Registry Key**: Use a registry editor or forensic tool to access the `NTUSER.DAT` hive and navigate to the respective `File MRU` path based on the Office version and account type. 3. **Extract Recent File List**: Analyze the entries within the `File MRU` key to identify recently accessed documents. Note the full path and last opened timestamp for each file. 4. **Correlate with User Activity**: Cross-reference the recent file list with other artifacts, such as file timestamps and user activity logs, to build a comprehensive picture of user behavior. ## Tools for Analysis * **Registry Editors**: Tools like RegEdit or Registry Explorer can manually navigate and export the contents of `NTUSER.DAT`. * **Forensic Software**: Applications such as AccessData FTK or Magnet Axiom provide advanced capabilities to automatically extract and analyze registry data, including MRU lists. * **Custom Scripts**: PowerShell scripts or custom tools can automate the extraction and parsing of MRU registry keys, streamlining the analysis process. # Shell Bags Shell Bags are Windows registry artifacts that record user preferences for folder views in Windows Explorer and the Open/Save dialog. They track details like icon size, window position, sort order, and view mode (list, details, tiles, etc.) for every folder a user has browsed. Because these settings persist even after the folders themselves are deleted, Shell Bags provide forensic evidence of folder access, including folders on local drives, network shares, removable devices, and ZIP archives. ### Location Shell Bags data is split across two per-user registry hives: **Primary (most Shell Bags data):** ``` File: C:\Users\\AppData\Local\Microsoft\Windows\UsrClass.dat Keys: Local Settings\Software\Microsoft\Windows\Shell\Bags Local Settings\Software\Microsoft\Windows\Shell\BagMRU ``` **Secondary (desktop items, network shares, some residual data):** ``` File: C:\Users\\NTUSER.DAT Keys: Software\Microsoft\Windows\Shell\BagMRU Software\Microsoft\Windows\Shell\Bags ``` Both hives should be collected during an investigation. The `UsrClass.dat` file is located in a hidden `AppData\Local\Microsoft\Windows` directory within each user's profile. ### What Shell Bags Record * **Folder paths** accessed via Windows Explorer or the Open/Save dialog, including local, network, and removable media paths. * **Timestamps:** First interaction and last interaction times with each folder, plus file system timestamps (Created, Modified, Accessed) for the folder itself at the time of access. * **View preferences:** Icon size, window position, sort column, view mode, column widths. * **"Exotic" items:** Mobile device connections (MTP), Control Panel access, ZIP archive browsing, FTP folder access, search folder results. * **Deleted folder evidence:** Shell Bag entries persist after the original folder is deleted or the drive is disconnected. The registry entry remains until the user's profile is removed or the keys are manually cleared. ### How Shell Bags Work **BagMRU** tracks the hierarchical tree structure of folders the user has browsed. Each node in the tree represents a folder, and child nodes represent subfolders. This forms a navigational breadcrumb trail showing the paths a user took through the file system. **Bags** stores the actual view settings for each folder. Each entry is linked to a corresponding BagMRU node by a numeric slot number. Shell Bags are only populated through **Windows Explorer** and the **Open/Save common dialog**. Folder access via the command line (`cd`, `dir`), PowerShell, or programmatic file I/O does **not** generate Shell Bag entries. This is both a limitation and a forensic indicator: Shell Bags specifically reflect GUI-based user interaction. #### Windows 11 Behavior Shell Bags behavior on Windows 11 is consistent with Windows 10. Folders created via command line (`mkdir`) do not generate Shell Bag entries unless the user subsequently navigates to them in Explorer. The core mechanism is unchanged: Shell Bags only record Explorer/dialog-based folder interaction. ### Analyzing Shell Bags #### SBECmd (Command Line) [SBECmd](https://github.com/EricZimmerman/SBECmd) is Eric Zimmerman's command-line tool for parsing Shell Bags data. It can process individual hive files or recursively scan directories for hives. **Parse from a directory of collected hives:** ``` SBECmd.exe -d C:\Cases\Evidence\Registry --csv C:\Cases\Output --csvf shellbags.csv ``` **Parse from a live system (requires admin):** ``` SBECmd.exe --live --csv C:\Cases\Output --csvf live_shellbags.csv ``` SBECmd automatically locates and parses both `UsrClass.dat` and `NTUSER.DAT` hives when given a directory. Output includes folder paths, timestamps, view settings, and the user account associated with each hive. #### ShellBags Explorer (GUI) [ShellBags Explorer](https://ericzimmerman.github.io/#!index.md) is the GUI version of the same parser. It displays the BagMRU tree structure visually, letting you browse the folder hierarchy as the user saw it. The Details tab shows timestamps and metadata for each selected node. This is useful for targeted analysis and understanding the full navigation path a user took. #### Other Tools * [**Registry Explorer**](https://github.com/EricZimmerman/RegistryExplorer) **(Eric Zimmerman):** Browse the raw Shell Bags registry keys for manual inspection. * [**Autopsy**](https://www.autopsy.com/)**:** Parses Shell Bags as part of its Recent Activity ingest module. * [**Velociraptor**](https://docs.velociraptor.app/)**:** The `Windows.Forensics.Shellbags` artifact natively parses Shell Bags data across endpoints without requiring external tools. * [**KAPE**](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape)**:** Targets for collecting `UsrClass.dat` and `NTUSER.DAT`, with modules for SBECmd parsing. ### What to Look For * **Folders on removable media:** Shell Bags retain entries for USB drives and external media long after they are disconnected. This can prove a user browsed files on a specific device even if the device is no longer available. * **Deleted folders:** Entries persist after folder deletion. If a user created a staging folder for exfiltration and then deleted it, the Shell Bag entry may still record the folder name and access times. * **Network share access:** Entries for UNC paths (`\\server\share\folder`) show which network locations a user browsed and when. * **Unusual paths:** Folders in temp directories, Recycle Bin paths, or system directories that a normal user wouldn't typically browse. * **ZIP archive browsing:** Shell Bags record when a user opens and navigates within ZIP files through Explorer, which can indicate reconnaissance of archive contents. * **Timestamp analysis:** Compare Shell Bag first/last interaction timestamps with other artifacts to build a timeline of user activity. ### Artifact Correlation * **USB Usage:** Shell Bag entries for removable drives can be correlated with USB connection artifacts (Plug & Play logs, USBSTOR registry keys) to link a specific user to a specific device at a specific time. * **LNK Files:** LNK (shortcut) files created when a user opens a file from a folder can corroborate Shell Bag evidence of folder access. * **Jump Lists:** Jump List entries for Explorer may show recent folder access that aligns with Shell Bag data. * **$MFT / $UsnJrnl:** File system metadata can confirm whether folders recorded in Shell Bags still exist, were renamed, or were deleted. * **Prefetch:** If a user browsed to a folder containing an executable and then ran it, Shell Bags (folder access) + Prefetch (execution) tells that story. ### Anti-Forensics Considerations * **Registry key deletion:** An attacker or user can delete the Shell Bags keys from `UsrClass.dat` and `NTUSER.DAT`. However, Windows will regenerate the keys as soon as the user opens Explorer again, so a suspiciously empty Shell Bags structure on a well-used account is itself an indicator. * **Profile deletion:** Deleting the user profile removes both hive files and their Shell Bags data entirely. * **Third-party cleaners:** Tools like CCleaner and BleachBit can target Shell Bags data. Check for evidence of these tools via Prefetch or UserAssist. * **VSS recovery:** Previous versions of `UsrClass.dat` may be available in Volume Shadow Copies, providing historical snapshots of Shell Bags data before cleanup attempts. ### Limitations * Shell Bags **only** record folders accessed through Windows Explorer or the Open/Save dialog. Command-line, PowerShell, and programmatic access does not generate entries. * Shell Bags record **folder** access, not individual **file** access. You can prove a user browsed a directory, but not which specific files they opened from it (use LNK files, Jump Lists, or Recent Documents for file-level evidence). * Timestamp interpretation requires care. The "first interaction" and "last interaction" times reflect when the Shell Bag entry was created and last updated, but these can shift if the user changes view settings for a folder at a later date. ### References * [Cyber Triage: Shellbags Forensic Analysis 2026](https://www.cybertriage.com/blog/shellbags-forensic-analysis-2026/) * [SANS: SBECmd](https://www.sans.org/tools/sbecmd) * [Eric Zimmerman's Tools](https://ericzimmerman.github.io/#!index.md) * [Revisiting ShellBags in Windows 11 (Ilya Kobzar)](https://www.ilyakobzar.com/p/revisiting-shellbags-in-windows-11) * [Vincent Lo: Windows ShellBag Forensics in Depth (GIAC)](https://www.giac.org/paper/gcfa/9576/windows-shellbag-forensics-in-depth/128522) # .lnk Files Shortcut (.lnk) files are automatically generated by Windows to facilitate quick access to frequently used files and folders. These artifacts are invaluable for forensic investigations as they provide detailed information about user activity, including the files and folders opened by a user. ### Key Insights: * **Primary Locations**: * Windows XP: `%USERPROFILE%\Recent` * Windows 7 and later: `%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\` * Office Recent: `%USERPROFILE%\AppData\Roaming\Microsoft\Office\Recent\` * **Timestamps**: Shortcut files store crucial timestamps, including the creation date of the shortcut itself and the last modification date, reflecting the first and last times the target was accessed. * **LNK Target File Data**: Contains detailed information about the target file, including its modified, access, and creation times, volume information, network share details, and the original location. ### Deeper Dive * **Functionality of .lnk Files**: Beyond providing shortcuts, these files serve as a forensic trail of user activity, indicating not only the accessed files and folders but also their original paths and usage context. * **Volume and Network Share Information**: Analyzing the volume and network share information within a shortcut file can reveal the origin of accessed files, potentially indicating data transfers or external device usage. ### Analyzing The Artifact * [**Extracting .lnk File Information**](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/23/windows-artifacts/folder-file-opening-creation/powershell-scripts/.lnk-files): Forensic tools can parse the data within shortcut files to extract and analyze the embedded metadata, offering insights into user behavior and file access patterns. This can be done easily with PowerShell. * **Correlating Timestamps**: By comparing the timestamps of shortcut files with other system logs, investigators can construct a comprehensive timeline of user actions. ### Tools for Analysis * **LNK Parsing Tools**: Specific tools designed to extract and analyze data from .lnk files, such as LECmd, Windows LNK File Parser or [this PowerShell script](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/23/windows-artifacts/folder-file-opening-creation/powershell-scripts/.lnk-files). * **Forensic Suites**: Comprehensive forensic platforms like EnCase or Autopsy include modules for parsing and analyzing shortcut file data. # Jump Lists Windows Jump Lists are designed to provide users with quick access to frequently or recently used documents, files, or applications directly from the taskbar. Introduced with Windows 7, these lists offer valuable insights into user activity, including the applications used and specific interactions with various items. ## Key Insights: * **Location of AutomaticDestinations**: * `%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations` * **Location of CustomDestinations**: * `%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations` Jump Lists are associated with individual applications, identified by a unique application identifier (AppID). These identifiers enable forensic analysts to determine which application a particular Jump List is associated with. A comprehensive list of AppIDs can be found at , which is an invaluable resource for identifying the applications related to specific Jump List files. Each Jump List file can store information about up to 2000 items that a user has interacted with through the corresponding application. This includes documents opened, media played, or any file accessed. The data maintained in a Jump List can include, but is not limited to, the following: * **Target Timestamps**: Records when the item was last opened. * **File Size**: The size of the item when last accessed. * **Storage Medium Information**: Identifies where the item is stored—on a local drive, removable media, or a network share. * **Most Recently Used (MRU) Order**: Items in a Jump List are kept in an MRU order, which includes a timestamp for each listed item, providing a timeline of user interactions. ## Deeper Dive Jump Lists are composed of entries represented as LNK (shortcut) shell items, which offer additional metadata about the accessed items. This metadata enriches the forensic analysis by providing detailed information about user behavior and file access patterns. * **AutomaticDestinations**: These files are automatically generated by the system to track items opened by applications. They are named using the application's AppID, making it possible to associate each Jump List with its respective application. * **CustomDestinations**: Created by applications to store shortcuts to user-specified destinations. These also use the AppID naming convention but allow for more customization by the application or user. ## Analyzing The Artifact To analyze Jump Lists, forensic analysts can follow these steps: 1. Locate the Jump List files in the `AutomaticDestinations` and `CustomDestinations` directories. 2. Use the list of AppIDs to identify which application each Jump List is associated with. 3. Examine the contents of each Jump List file to extract and analyze the LNK shell item data. This includes target timestamps, file size, and the original location of accessed items. 4. Analyze the MRU order and timestamps to construct a timeline of user interactions with the application. ## Tools for Analysis * **JumpList Explorer**: A tool designed specifically for parsing and analyzing Jump List files, providing a user-friendly interface to examine the metadata contained within. * **LNK Parsing Tools**: Since Jump List entries are represented as LNK shell items, tools capable of parsing LNK files (such as LECmd or ShellBags Explorer) can be utilized to extract detailed information about each entry. * **Forensic Suites**: Comprehensive forensic suites like Magnet AXIOM or EnCase offer capabilities to automatically parse and analyze Jump List files as part of their examination of Windows artifacts. # AppIDs https\://github.com/EricZimmerman/JumpList/blob/master/JumpList/Resources/AppIDs.txt | Key | Value | | ---------------- | --------------------------------------------------------------------------------------------- | | 560D789A6A42AD5A | DC++ 0.261 / 0.698 / 0.782 (r2402.1) | | BCC705F705D8132B | Instan-t 5.2 (Build 2824) | | 1D12F965B876DC87 | Snagit 2021 | | 4700FF5AE80A6713 | PDFCreator 2.2 | | 4A49906D074A3AD3 | Media Go 1.8 (Build 121) | | 6824F4A902C78FBD | Firefox 64.0 | | FE9E0F7260000A12 | RealVNC Server 5.3.0 64-bit (Connect+File Transfer) | | A2C73C383525F1BB | RealVNC Viewer 5.3.0 64-bit | | D3530C5294441522 | HydraIRC 0.3.165 | | b37a182b9a7a8098 | SAPIEN.Packager | | EE0C103672A7A2B9 | ManyCam 6.7.0 | | A1D19AFE5A80F80 | FileZilla 2.2.32 | | FDBD48D45512DFFC | Photoshop 7 | | 989D7545C2B2E7B2 | IMVU 465.8.0.0 | | 497f749b9f1a5d16 | Microsoft.GamingApp | | 1EB796D87C32EFF9 | Firefox 5.0 | | 36801066F71B73C5 | Binbot 2.0 | | CFB56C56FA0F0A54 | Mozilla 0.9.9 | | 50C5E019818564E3 | Microsoft Excel Viewer 12.0.6219.1000 | | 5F218922E0901EBF | MusicBee | | 9F5C7755804B850A | Windows Script Host - wscript.exe (64-bit) | | 23709F6439B9F03D | Hex Editor Neo 5.14(CHANGED) | | 436eb6eb1bd9f03f | Microsoft Visio 15 | | 33a00252c0fa56de | Mozilla Firefox x32 | | ACCCA100973EF8DC | Azureus 2.0.8.4 | | D33ECF70F0B74A77 | Picasa 2.2.0 (Build 28.08, 0) | | A8DF13A46D66F6B5 | Kommute (Calypso) 0.24 | | 186B5CCADA1D986B | NewsGrabber 3.0.36 | | 99C15CF3E6D52B61 | mldonkey 3.1.0 | | FD1AD55E472F20E0 | Google Earth Pro 7.3.2.5491 | | 8f4ae1df7d39f816 | X-Ways WinHex x64 | | 62DBA7FB39BB0ADC | Yahoo Messenger 7.5.0.647 / 8.1.0.421 / 9.0.0.2162 / 10.0.0.1270 | | 466D339D8F21CFBF | Microsoft Snip & Sketch | | 3917DD550D7DF9A8 | Konvertor 4.06 (Build 10) | | 8A1C1C7C389A5320 | Safari 3.2.3 (525.29) | | BE4875BB3E0C158F | CrossFTP 1.75a | | 9e312f4adee9107 | Opera Browser | | F674C3A77CFE39D0 | Winamp 2.95 / 5.1 / 5.621 / 5.666 | | f7699cf2eed599ac | Microsoft.SecHealthUI | | d788e8bc973b89e9 | PKWARE PKZIP for Windows 14 | | 884FD37E05659F3A | VZOchat 6.3.5 | | 1B29F0DC90366BB | AIM 5.9.3857 | | CBBE886ECA4BFC2D | ExoSee 1.0.0 | | 36C36598B08891BF | Vovox 2.5.3.4250 | | 607258d66273ff4d | Microsoft Edge | | ADECFB853D77462A | Microsoft Office Word 2007 Pinned and Recent. | | 19E6043495A5B4DA | Edit Pad Pro | | D460280B17628695 | Java Binary | | d1cc3f047e70a200 | SAPIEN SnippetEditor | | FE57F5DF17B45FE | Wireshark 2.6.3 | | 22CEFA022402327D | Meca Messenger 5.3.0.52 (CHANGED) | | 92a0e470eecc63d3 | RegistryExplorer | | 74D7F43C1561FC1E | Windows Media Player 12.0.7601.17514 | | 0EF606B196796EBB | HP MediaSmart Photo | | CB996A858D7F15C | PDF Architect 4.0.09.25450 64-bit | | E76A4EF13FBF2BB1 | Manolito 3.1.1 | | EA83017CDD24374D | IrfanView Thumbnails | | d014c0be50851f63 | MusicBee 3.4.2.0 x86 | | BC03160EE1A59FC1 | Foxit PDF Reader 5.4.5 | | C8AA3EAEE3D4343D | Trillian 0.74 / 3.1 / 4.2.0.25 / 5.0.0.35 (JL support) | | 27DA120D7E75CF1F | pbFTPClient 6.1 | | 966FA7C312D9B10 | Eraser 6.2.0.2970 | | c45108aa42339506 | PowerPoint Show 8 | | b06bc47edd036329 | SAPIEN PowerShell Studio | | 337ED59AF273C758 | Sticky Notes (Windows 10) | | 2519133D6D830F7E | IMatch 3.6.0.113 | | 7904145AF324576E | Total Commander 7.56a (Build 16.12.2010) / 8.52a 32-bit | | 4b5f45de9912de53 | Microsoft.Office.Desktop.Access\_16xxx | | F6FD5D99E2B6E178 | LibreOffice 5.1.0.3 Draw | | BBA8A4896F0D26F | Ares Chat Client (3.1.9.4045) | | 7ff0b18f1611daa4 | Opera Browser | | 4CB9C5750D51C07F | Microsoft Movies & TV (Build 10.19031.11411.0) | | 7593AF37134FD767 | RealPlayer 6.0.6.99 / 7 / 8 / 10.5 | | 780732558F827A42 | AutoPix 5.3.3 | | DA7E8DE5B8273A0F | Yahoo Messenger 5.0.0.1226 / 6.0.0.1922 | | 73C6A317412687C2 | Google Talk 1.0.0.104 | | f039446000b1b829 | SweetScape 010 Editor | | 6E855C85DE07BC6A | Microsoft Office Excel 2010 x64 | | 47592b67dd97a119 | Windows Notepad x32 (Notepad.exe) | | 20EF367747C22564 | Bullet Proof FTP 2010.75.0.75 | | A7BD71699CD38D1C | Microsoft Office Word 2010 x86 | | 431A5B43435CC60B | Python (.pyc) | | CDB6F0C373F2DA0F | stunnel 5.31 | | E107946BB682CE47 | Filezilla 3.5.1 / 3.16 | | E26F61AFB0824F2E | Photoshop CC 2015 | | B8AB77100DF80AB2 | Microsoft Office Excel x64 | | 447E6AA2BBDFBC8A | Slack 4.11.3 | | F92E607F9DE02413 | RealPlayer 14.0.6.666 | | 7c8adb9f2028b7d4 | SAPIEN Packager | | 8904A5FD2D98B546 | IceChat 7.70 20101031 | | 4CDF7858C6673F4B | Bullet Proof FTP 1.26 | | 7A4BA998575FF2A4 | FreeCommander XE 2016 Build 715 32-bit | | 4ACAE695C73A28C7 | VLC 0.3.0 / 0.4.6 | | 83B03B46DCD30A0E | iTunes 9.0.0.70 / 9.2.1.5 / 10.4.1.10 (begin custom 'Tasks' JL capability) / 12.3.2.35 64-bit | | 1C30573BDFCE4155 | Zenmap GUI 6.49BETA4 | | 7E4DCA80246863E3 | Control Panel - Settings | | 9027FE24326910D2 | Thunderbird 38.6.0 | | 18ae7cda503d746e | Advanced System Optimizer 3 | | 2DB8E25112AB4453 | Deluge 1.3.3 | | d4e1769e47ffde26 | Cyberlink PhotoDirector 9 | | 46E77B87767B92 | Opera Browser 75 | | B223C3FFBC0A7A42 | Bersirc 2.2.14 | | 265142389b98fcb1 | DVDFab 9 x86 | | d1d9b843a81139c6 | KeePass | | 1CED32D74A95C7BC | Microsoft Visual Studio Code | | F5AC5390B9115FDB | Microsoft Office PowerPoint 2007 | | 21982dade69f78d8 | Opera Browser | | EBD8C95D87F25154 | Carrier 2.5.5 | | 10F5A20C21466E85 | FTP Voyager 15.2.0.17 | | ECD21B58C2F65A2F | StealthNet 0.8.7.9 | | D00655D2AA12FF6D | Microsoft PowerPoint 2016 64-bit | | 9B9CDC69C1C24E2B | Notepad 64-bit | | 7494A606A9EEF18E | Crystal Player 1.98 | | 135DF2A440ABE9BB | SoulSeek 156c | | B06A975B62567622 | Windows Live Messenger 8.5.1235.0517 BETA | | 78F0AFB5BD4BB278 | Microsoft Lync 2016 64-bit (Skype for Business) | | F82607A219AF2999 | Cyberduck 4.1.2 (Build 8999) | | CB1D97ACA3FB7E6B | Newz Crawler 1.9.0 (Build 4100) | | E6EF42224B845020 | ALFTP 5.20.0.4 | | CB984E3BC7FAF234 | NewsRover 17.0 (Rev.0) | | F920768FE275F7F4 | Grabit 1.5.3 Beta (Build 909) / 1.6.2 (Build 940) / 1.7.2 Beta 4 (Build 997) | | 40371339ad31a7e6 | Mozilla Firefox x64 | | E0532B20AA26A0C9 | QQ International 1.1 (2042) | | A75B276F6E72CF2A | WinMX 3.53 | | 98B0EF1C84088 | fulDC 6.78 | | D2D0FC95675FB2C8 | Microsoft Built-in Print Management (Win10) | | BAEA31EACD87186B | BinaryBoy 1.97 (Build 55) | | 6FEE01BD55A634FE | Smuxi 0.8.0.0 | | D356105FAC5527EF | Steam 1/22/2021 | | 23EF200CA6364EFF | Oracle VM VirtualBox 5.0.16 | | 3c355482cb54f75b | Microsoft.GetHelp | | 122c907c4dc5911f | Mozilla Firefox x32 | | 8BD5C6433CA967E9 | ACDSee Photo Manager 2009 (v11.0 Build 113) | | 43929ae4535c8dea | Microsoft.SkypeApp 15 x86 | | CC4B36FBFB69A757 | gtk-gnutella 0.97 | | D4A589CAB4F573F7 | Microsoft Project 2010 x86 | | 971cc6ad207f36cb | PaintShopPro (X9) | | 0A1D19AFE5A80F80 | FileZilla 2.2.32 | | CD40EAD0B1EB15AB | NNTPGrab 0.6.2 | | 2a64b26bd99f0d16 | Shareaza | | 9C32E2313792E6E8 | Microsoft Built-in Disk Cleanup (Win10) | | F784591FF7F60F76 | Microsoft Built-in Defragment and Optimize Drives (Win10) | | C312E260E424AE76 | Mail.Ru Agent 5.8 (JL support) | | 2A5A615382A84729 | X-Chat 2 2.8.6-2 | | 3C93A049A30E25E6 | J. River Media Center 16.0.149 | | CC76755E0F925CE6 | AllPicturez 1.2 | | 497B42680F564128 | Zoner PhotoStudio 13 (Build 7) | | D8081F151F4BD8A5 | CuteFTP 8.3 Lite (Build 8.3.4.0007) | | 44A3621B32122D64 | Microsoft Office Word 2010 x64 | | 1C7A9BE1B15A03BA | Microsoft Snip & Sketch | | EFBB2BF3C1D06466 | Auslogics Disk Defrag 6.2.1.0 | | F91FD0C57C4FE449 | ExpanDrive 2.1.0 | | BF483B423EBBD327 | Binary Vortex 5.0 | | 4A7E4F6A181D3D08 | broolzShare | | 9D91276B0BE3E46B | Windows Help and Support (Built-in) Win7 | | 7937DF3C65790919 | FTP Explorer 10.5.19 (Build 001) | | 4FD44F9938892CAA | CDBurnerXP | | 1BC9BBBE61F14501 | OneNote | | 6F647F9488D7A | AIM 7.5.11.9 (custom AppID + JL support) | | B50EE40805BD280F | QuickTime Alternative 1.9.5 (Media Player Classic 6.4.9.1) | | 06059DF4B02360AF | Kadu 0.10.0 / 0.6.5.5 | | B7173093B23B9A6A | Beyond Compare 4 | | CBEB786F0132005D | VLC 0.7.2 | | E0246018261A9CCC | qutIM 0.2.80.0 | | 65F7DD884B016AB2 | LimeChat 2.39 | | 22C4D315E96389E0 | FastCopy 3.12 | | 3ED70EF3495535F7 | Gravity 3.0.4 | | 65009083BFA6A094 | (app launched via XPMode) | | D64D36B238C843A3 | Microsoft Office InfoPath 2010 x86 | | 8A461F82E9EB4102 | Foxit Reader 7.2.0.722 | | c88c76a215679365 | Axialis IconWorkshop 6 | | e4ea035065b5789a | Maël Hörz HxD Hex Editor 2.5 | | 50620FE75EE0093 | VMware Player 3.1.4 | | F1A4C04EEBEF2906 | \[i2p] Robert 0.0.29 Preferences | | B0236D03C0627AC4 | ICQ 5.1 / ICQLite Build 1068 | | AEDD2DE3901A77F4 | Pidgin 2.10.11 | | 5E01ECAF82F7D8E | Scour Exchange 0.0.0.228 | | 0B3F13480C2785AE | Paint 6.1 (build 7601: SP1) | | 319F01BF9FE00F2D | Microsoft Access 2016 64-bit | | 30D23723BDD5D908 | Digsby (Build 30140) (JL support) | | 76F6F1BD18C19698 | aMule 2.2.6 | | C5C24A503B1727DF | XnView 1.98.2 Small / 1.98.2 Standard / 2.35 | | A8C43EF36DA523B1 | Microsoft Office Word 2003 Pinned and Recent. | | B8C13A5DD8C455A2 | Titan FTP Server 8.40 (Build 1338) | | 03D877EC11607FE4 | Thunderbird 6.0.2 | | 56C5204009D2B915 | uTorrent 3.5.5 | | 69d97cdc8d4d5043 | Microsoft.windowscommunicationsapps | | 8172865A9D5185CB | Binreader 1.0 (Beta 1) | | fbb3e7490ba71a30 | SQLite Expert | | A79A7CE3C45D781 | CuteFTP 7.1 (Build 06.06.2005.1) | | 92F1D5DB021CD876 | NewsLeecher 4.0 / 5.0 Beta 6 | | 8DCCA8B24A5E822E | CDBurnerXP 4.5.7.6623 | | FB230A9FE81E71A8 | Yahoo Messenger 11.0.0.2014-us | | 7fa8bdd163836f0c | WinRAR | | 4B632CF2CECEAC35 | Robo-FTP Server 3.2.5 | | D7D647C92CD5D1E6 | uTalk 2.6.4 r47692 | | D7666C416CBA240C | NewsMan Pro 3.0.5.2 | | 7B7F65AAECA20A8C | Dropbox App 5.4.24 | | ea64ce14e5470c33 | Microsoft.PowerShell\_7.2.1.0 x64 | | 5B72F67ADCCE9045 | UltraVNC 1.2.1.0 Settings | | E6EE34AC9913C0A9 | VLC 0.6.2 | | 3EDF100B207E2199 | digiKam 1.7.0 (KDE 4.4.4) | | 44A50E6C87BC012 | Classic FTP Plus 2.15 | | F0275E8685D95486 | Microsoft Office Excel 2013 x86 | | D53B52FB65BDE78C | Android Newsgroup Downloader 6.2 | | D93F411851D7C929 | Windows Powershell 5.0 32-bit | | 3461E4D1EB393C9C | WTW 0.8.18.2852 / 0.8.19.2940 | | 4C58CF9096EF3EFD | Kindle for PC 1.24.3 | | 31b6ebfff794ef0d | Opera Browser (Opera.exe) | | 6059DF4B02360AF | Kadu 0.10.0 / 0.6.5.5 | | 2FF9DC8FB7E11F39 | I2P 0.8.8 (no window) | | f2d2624b34821c85 | Opera Browser (Opera.exe) | | C98AB5CCF25DDA79 | NewsShark 2.0 | | b8a48bfb1f2f0c8d | NordVPN | | D22AD6D9D20E6857 | ALLPlayer 4.7 | | A4DEF57EE99D77E9 | Nomad News 1.43 | | 26753C97EA000ECD | LibreOffice 5.1.0.3 Math | | 1BC392B8E104A00E | Remote Desktop Connection 6.1.7600 (Win7) | | 8EAFBD04EC8631CE | VMware Workstation 9 x64 | | FB7CA8059B8F2123 | ooVoo 3.0.7.21 | | FF103E2CC310D0D | Adobe Reader XI | | 8FD1364019DC2115 | Calibre E-Book Manager 2.33 | | a7500ee83f4868ab | DVBViewer | | D7528034B5BD6F28 | Windows Live Mail Pinned and Recent. | | BC0C37E84E063727 | Windows Command Processor - cmd.exe (32-bit) | | B3016B8DA2077262 | eMule 0.50a | | EDC786643819316C | HoneyView3 #5834 | | 3C309C17F7E8FFE1 | GIMP 2.8.16 | | 2AA756186E21B320 | RealTimeQuery 3.2 | | F18460FDED109990 | Windows Connected Devices | | FC98C00F85D4CE77 | EditPad Pro 8 | | C634153E7F5FCE9C | IrfanView 3.10 / 4.30 / 4.41 32-bit | | 1DA3C90A72BF5527 | Safari 4.0.5 (531.22.7) / 5.1 (7534.50) | | BC2F88ECCD3461B4 | Microsoft Built-in Event Viewer 1.0 (Win10) | | b916037c1e115fe0 | Microsoft Skype (Microsoft.SkypeApp\_15) | | C9374251EDB4C1A8 | BitTornado T-0.3.17 | | A52B0784BD667468 | Photos Microsoft 16.526.11220.0 (Windows 10) | | 67730e20cf5d43f7 | MiTec JSON Viewer (JSONView\.exe) | | 3F2CD46691BBEE90 | GOIM 1.1.0 | | E36BFC8972E5AB1D | XPS Viewer | | f065ac336abcaa3e | Adobe Acrobat DC | | B74736C2BD8CC8A5 | WinZip 15.5 (9468) | | E70D383B15687E37 | Notepad++ 6.6.7 | | D7DB75DB9CDD7C5D | Xnews 5.04.25 | | EC3E36AF0CDCB3E1 | Steam build 2/4/2016 | | 1B4DD67F29CB1962 | Windows Explorer Pinned and Recent. | | BF9AE1F46BD9C491 | Nimbuzz 2.0.0 (rev 6266) | | 69bacc0499d41c4 | Microsoft Excel 12 | | 977A5D147AA093F4 | Lphant 3.51 | | a968adcd5f3991cd | CorelDraw Home 20 | | 4B8A4727AA452343 | Firefox 56.0.2 | | 9FDA41B86DDCF1DB | VLC Media Player 0.5.3 / 0.8.6i / 0.9.7 / 1.1.11 / 2.2.1 | | f1dfe90245a04467 | MPC-BE 64 (Media Player Classic - Black Edition) | | 69639DF789022856 | Google Chrome 86.0.4240.111 | | 3866FF352D7719E1 | Paint.NET 4.0.9 | | BFC1D76F16FA778F | Ares (Galaxy) 1.8.4 / 1.9.8 / 2.1.0 / 2.1.7.3041 / 3.1.9.4045 | | 6f39a16f693777f6 | Microsoft.MSPaint\_8wekyb3d8bbwe | | 7A7C60EFD66817A2 | Spotnet 1.7.4 | | CDF30B95C55FD785 | Microsoft Office Excel 2007 | | BAC8A6B507360131 | Remote Desktop Connection Manager 2.2 | | A581B8002A6EB671 | WiseFTP 5.5.9 | | 5F6E7BC0FB699772 | Microsoft Office PowerPoint 2010 x64 | | 7DCA40FD2A5A971F | LibreOffice 5.1.0.3 | | CD2ACD4089508507 | AbsoluteTelnet 9.18 Lite | | 5F7B5F1E01B83767 | Quick Access | | F0C7BD3E0584A65A | InfraRecorder 0.53.0.0 32-bit | | 792699A1373F1386 | Piolet 3.1.1 | | 86B804F7A28A3C17 | Miranda IM 0.6.8 / 0.7.6 / 0.8.27 / 0.9.9 / 0.9.29 (ANSI + Unicode) | | 25cfc5224e58d5d9 | Corel Photo Paint Home | | AE3F2ACD395B622E | QuickTime Player 6.5.1 / 7.0.3 / 7.5.5 (Build 249.13) | | D1FC019238236806 | Newsgroup Commander Pro 9.05 | | 647853318c96dfa5 | Microsoft.Windows.Cortana | | D97EFDF3888FE7EB | KeePass 2.31 | | 95962cd8e90977ca | Emsisoft Anti-Malware (a2start.exe) | | DBA909A61476CCEC | NewsWolf 1.41 | | 558C5BD9F906860A | BearShare Lite 5.2.5.1 | | CD8CAFB0FB6AFDAB | uTorrent 1.7.7 (Build 8179) / 1.8.5 / 2.0 / 2.21 (Build 25113) / 3.0 (Build 25583) | | 8E4E81D9ADC545B8 | Microsoft Your Phone | | 969252CE11249FDD | Mozilla Firefox 40.0 / 44.0.2 | | 43578521D78096C6 | Windows Media Player Classic Home Cinema 1.3 (32-bit) | | 12DC1EA8E34B5A6 | Microsoft Paint 6.1 | | 7192F2DE78FD9E96 | TIFNY 5.0.3 | | e7f34dee82980c52 | LibreOffice Calc | | 271E609288E1210A | Microsoft Office Access 2010 x86 | | B77EF7F3FC946302 | Pale Moon Browser 26.1.1 (32-bit) | | 13EB0E5D9A49EAEF | Binjet 3.0.2 | | 714B179E552596DF | Bullet Proof FTP 2.4.0 (Build 31) | | 84F066768A22CC4F | Adobe Photoshop CS5 (64-bit) | | D8671C1ED93C75C8 | Tor Browser 5.5.2 | | 26717493B25AA6E1 | Adobe Dreamweaver CS5 (32-bit) | | EB3300E672136BC7 | Stream Reactor 1.0 Beta 9 (uses VLC!) | | 24728462b60c215d | Microsoft.WindowsMaps x64 | | 72b0317636c8dbc0 | FSPro Event Log Explorer | | B08971C77377BDE3 | Microsoft Visual Studio Community 2015 | | 169B3BE0BC43D592 | FastPictureViewer Professional 1.6 (Build 211) | | 3fe28476179ff940 | Turnipsoft Freda (ebook reader) | | A10B45ADB36C1D27 | PST Walker 5.54 | | 1CFFBE973A437C74 | DSPlayer 0.889 Lite | | 3594AAB44BCA414B | Windows Photo Viewer | | C04F69101C131440 | CuteFTP 5.0 (Build 50.6.10.2) | | 3CF13D83B0BD3867 | RevConnect 0.674p (based on DC++) | | EB7E629258D326A1 | WindowWasher 6.6.1.18 | | BEC10D3AAF939FFA | Pale Moon Browser 26.1.1 (64-bit) | | 6b8904e2b6864f0f | Mozilla Firefox x32 | | 5BB830F67194431A | 7-Zip 18.05 (x64) | | E30BBEA3E1642660 | Neebly 1.0.4 | | 3BE7B307DFCCB58F | NiouzeFire 0.8.7.0 | | 8F3D7202AA5D4C01 | ImgBurn 2.5.8.0 | | C71EF2C372D322D7 | PGP Desktop 10 | | 4E0AC37DB19CBA15 | Xfire 1.138 (Build 44507) | | 4d939776340f1d18 | LibreOffice Writer | | A777AD264B54ABAB | JetVideo 8.0.2.200 Basic | | 34b9a7ad69ff9c1b | Microsoft Access | | BCD7BA75303ACBCF | BitLord 1.1 | | 13d1f3ea8d0e7308 | Tracker Software PDF-Xchange Viewer | | 9149d0f5ebf7f710 | Microsoft Outlook (15) | | F01B4D95CF55D32A | Windows Explorer Windows 8.1 | | FB3B0DBFEE58FAC8 | Microsoft Word 2016 64-bit | | 6b81d0477f64e02f | JSONBuddyApp | | 78aa210563284496 | Windows Performance Toolkit (wpa.exe) | | 05E01ECAF82F7D8E | Scour Exchange 0.0.0.228 | | 23646679AACCFAE0 | Adobe Reader 9.x(CHANGED) | | 817E5AD5BE351574 | Microsoft Built-in Services 10.0.10011.16384 (Win10) | | E31A6A8A7506F733 | Image AXS Pro 4.1 | | 3B94415067DD2C5D | GOG Galaxy | | 6E9A79992DA9EA2 | Nokia PC Suite 7.1 | | E40CB5A291AD1A5B | Songbird 1.9.3 (Build 1959) | | 8211531A7918B389 | Newsbin Pro 6.00 (Build 1019) (JL support) | | D38ADEC6953449BA | Microsoft Office OneNote 2010 x64 | | 70FFD305907C983B | 7zip 18.05 | | C5EF839D8D1C76F4 | LimeWire 5.2.13 | | C8112AC53C5ED250 | Jetico Log Viewer 1.1 | | 95597e2f40dbd9aa | PotPlayerMini64 (potplayer.daum.net) | | 817BB211C92FD254 | GOM Player 2.0.12.3375 / 2.1.28.5039 | | C31B3D36438B5E2C | Visual Studio Enterprise 2017 Version 15.9.10 | | F64DE962764B9B0F | FTPRush 1.1.3 / 2.15 | | 3DC02B55E44D6697 | 7-Zip 3.13 / 4.20 | | 16F2F0042DDBE0E8 | Windows Terminal | | 6dc04f5ccc522861 | Microsoft.Windows.ShellExperienceHost | | 28C8B86DEAB549A1 | Internet Explorer 8.0.7600.16385 / 9 | | 70D9ADA92108D731 | IrfanView 4.51 (x64) | | 01B29F0DC90366BB | AIM 5.9.3857 | | 75fdabdc3f4b24fc | Microsoft Windows Event Viewer (eventvwr.exe) | | 14a48fbe3d43239a | Windows System Information(msinfo32.exe) | | 1110D9896DCEDDB3 | imgSeek 0.8.5 | | FA7144034D7D083D | Directory Opus 10.0.2.0.4269 (JL tasks supported) | | 8DEB27DFA31C5C2A | CoffeeCup Free FTP 4.4 (Build 1904) | | 2FA14C7753239E4C | Paint.NET 2.72 / 3.5.8.4081.24580 | | 5FB817CD5A8CAD21 | Google Drive | | C01827D56FF89056 | Microsoft Sticky Notes | | 1A60B1067913516A | Psi 0.14 | | 134620458666CCB0 | TeraCopy 2.3 64-bit | | BD249197A6FAEFF2 | Windows Live Messenger 2011 | | f203793bf9d14ff | Razer Central | | 5e86fbbffae5937b | Waterfox Browser | | EAB25958DBDDBAA4 | Binary News Reaper 2 (Beta 0.14.7.448) | | 75FDACD8330BAC18 | AnyDesk | | C02BAF50D02056FC | FotoVac 1.0 | | 3e4d62cf2c569bdf | MPC-HC (Media Player Classic - Home Cinema) | | 28EFB5B6D2E28389 | EA Origin | | 86781FE8437DB23E | Messenger Pro 2.66.6.3353 | | 3DF22B7648CEC4C1 | TeamViewer 11.0.55321 | | cf02284227526d80 | Powershell ISE | | 56bd4efc8f2e1f9c | XnSoft XnViewMP | | 4AC866364817F10C | Microsoft Edge (Chromium) | | ED49E1E6CCDBA2F5 | GNUnet 0.8.1a | | 3094CDB43BF5E9C2 | Microsoft Office OneNote 2010 x86 | | ce0e7345de1f1e26 | Microsoft.Windows.PrintQueueActionCenter 1.0.1.0 | | A4A5324453625195 | Microsoft Word 2013 32-bit | | 51dceba79099d8d2 | Sapien PowerShell Studio | | 728008617BC3E34B | eM Client 3.0.10206.0 | | C8E4C10E5460B00C | iMesh 6.5.0.16898 | | 1434D6D62D64857D | BitLord 1.2.0-66 | | 5DF4765359170E26 | Firefox 4.0.1 | | 18434D518C3A61EB | Minitab 17 | | 7FD04185AF357BD5 | UltraLeeacher 1.7.0.2969 / 1.8 Beta (Build 3490) | | 6dcad003123a22fe | Android Studio | | 5D6F13ED567AA2DA | Microsoft Office Outlook 2010 x64 | | 59E86071B87AC1C3 | CuteFTP 8.3 (Build 8.3.4.0007) | | 3C0022D9DE573095 | QuteCom 2.2 | | 6f4d358e50595ac1 | Emsisoft Anti-Malware (a2start.exe) | | 2B5841989B3857DA | RealVNC Server 5.3.0 64-bit (Chat) | | 4D72CFA1D0A67418 | Newsgroup Image Collector | | 17D3EB086439F0D7 | TrueCrypt 7.1a 64-bit | | C5236FD5824C9545 | PLAYXPERT 1.0.140.2822 | | daa1194a2bd88bd7 | SAPIEN Packager | | 254995f62cc3531a | Sanderson Forensics BPLister | | 939C10C2C101C1B0 | Stickies 9.0d | | 8FDB062F1E486CAC | Microsoft Powerpoint 2013 32-bit | | 6728DD69A3088F97 | Windows Command Processor - cmd.exe (64-bit) | | FA02AA2C575837A6 | Microsoft Built-in Task Scheduler 1.0 (Win10) | | 918E0ECB43D17E23 | Notepad (32-bit) | | EF473FAB8120B354 | uTorrent 3.5.5 | | FDBACA0A1FCE6055 | MozBackup 1.5.1 | | 9CE6555426F54B46 | HxD 1.7.7.0 | | 22e699ddc3928886 | Fineprint PdfFactory | | 9C08AD74AD8708DF | Microsoft Publisher 2016 64-bit | | 490C000889535727 | WinMX 4.9.3.0 | | 44A398496ACC926D | Adobe Premiere Pro CS5 (64-bit) | | 58a5af636f485ff2 | RegistryExplorer | | 290532160612E071 | WinRar x64 | | C7A4093872176C74 | Paint Shop Pro Pinned and Recent. | | 387D72EB9C9AA960 | UltraVNC 1.2.1.0 Launcher | | B8C29862D9F95832 | Microsoft Office InfoPath 2010 x86 | | CCC0FA1B9F86F7B3 | CCleaner 5.15.5513 64-bit | | F61B65550A84027E | iMesh 11.0.0.112351 | | 70a4c8cfd9c64000 | Programmer's Notepad (pn.exe) | | ee6d1f704cdeb7f9 | Opera Browser | | 411447F7DE177C68 | Windows DVD Maker 64-bit (Win7) | | 70202c58f1bc64fe | JeticoSoftware BCArchive | | 58170C92FA4B91A1 | MediaMonkey | | 6224453D9701A612 | BinTube 3.7.1.0 (requires VLC 10.5!) | | cf0c5b2c9773bfa4 | IDA Pro x64 | | 70B52CF73249257 | Sococo 1.5.0.2274 | | C6F7B5BF1B9675E4 | BitWise IM 1.7.3a | | a61657a5e5dfbdc | Microsoft.WindowsNotepad | | 9839AEC31243A928 | Microsoft Office Excel 2010 x86 | | 590AEE7BDD69B59B | Windows Powershell 5.0 64-bit | | 4278D3DC044FC88A | Gaim 1.5.0 | | 174C2C811C286C58 | InfraRecorder 0.53.0.0 64-bit | | 9AD1EC169BF2DA7F | FlylinkDC++ r405 (Build 7358) | | 2D1658D5DC3CBE2D | MySpaceIM 1.0.823.0 Beta | | CCB36FF8A8C03B4B | Azureus 2.5.0.4 / Vuze 3.0.5.0 | | 4DD48F858B1A6BA7 | Free Download Manager 3.0 (Build 852) | | B39C5F226977725D | ACDSee Pro 8.1.99 | | 409B67100697BCC0 | Revo Uninstaller Pro 3.1.5 | | AE069D21DF1C57DF | mIRC 6.35 / 7.19 | | FE8BB4692DE7B989 | Smart Defrag 4.3.0.847 | | D5C02FC7AFBB3FD4 | NNTPGrab 0.6.2 Server | | B39BC6B590F53961 | HexChat 2.10.2 32-bit | | 43886BA3395ACDCC | Easy Post 3.0 | | BD050AC447F6CD65 | Microsoft Xbox App | | 6BB54D82FA42128D | WinSCP 4.3.4 (Build 1428) | | 399fb4899502f372 | Mozilla Firefox | | 79370F660AB51725 | UploadFTP 2.0.1.0 | | D28EE773B2CEA9B2 | 3D-FTP 9.0 build 7 | | 5e4713eb935be0b1 | foobar2000 | | 4D8BDACF5265A04F | The KMPlayer 2.9.4.1434 | | 784182360DE0C5B6 | Kazaa Lite 1.7.1 | | 36F6BC3EFE1D99E0 | Alt.Binz 0.25.0 (Build 27.09.2007) | | d57380f96fcfde2f | RegistryExplorer | | 188F5EC9D11DED56 | Microsoft Edge (Chromium) | | 1461132E553E2E6C | Firefox 6.0 | | 4F24A7B84A7DE5A6 | Palringo 2.6.3 (r45983) | | 9A464053CD82DE6D | LINE Messenger | | 044A50E6C87BC012 | Classic FTP Plus 2.15 | | 5D7B4175AFDCC260 | Shareaza 2.0.0.0 | | 5B186FC4A0B40504 | Dtella 1.2.5 (Purdue network only) | | FA496FE13DD62EDF | KVIrc 3.4.2.1 / 4.0.4 | | cb83010e2bf88ad0 | PowerShell ISE x64 | | 556353beba95157c | 7Z | | 6B3A5CE7AD4AF9E4 | IceChat 9 RC2 | | 6AA18A60024620AE | GCN 2.9.1 | | 9EDAFE4BA4B22CE7 | Eclipse IDE Oxygen (4.7.3a) | | 4FCEEC8E021AC978 | CoffeeCup Free FTP 3.5.0.0 | | 9390EE5B658E96E | PuTTY 0.72 / 0.73 | | 3353B940C074FD0C | Microsoft Built-in Snipping Tool | | E2A593822E01AED3 | Adobe Flash CS5 (32-bit) | | D5C3931CAAD5F793 | Adobe Soundbooth CS5 (32-bit) | | 3168CC975B354A01 | Slypheed 3.1.2 (Build 1120) | | 0CFAB0EC14B6F953 | Express NewsPictures 2.41 (Build 08.05.07.0) | | 9501e18d7c2ab92e | Google Chrome | | AE6DF75DF512BD06 | Microsoft Groove Music (Build 10.19031.1141.0) | | BE71009FF8BB02A2 | Microsoft Office Outlook x86 | | 14354E216395983A | Remote Desktop Manager 2.1.0.0 FREE | | be2fd48be71f4560 | Autodesk DWG TrueView | | d27ff2aece1fd1bf | Epic Privacy Browser | | 905C98E216107AA1 | Microsoft Lync 2013 15.0.4753.1000 | | F5E4E50707BCD215 | Microsoft Message Analyzer 1.4 | | 27ECECD8D89B6767 | AIM 6.2.14.2 / 6.5.3.12 / 6.9.17.2 | | 59fe1486d27aa9d0 | Electronic Arts Origin | | 9C7CC110FF56D1BD | Microsoft Office PowerPoint 2010 x86 | | C9950C443027C765 | WinZip 9.0 SR-1 (6224) / 10.0 (6667) | | FE5E840511621941 | JetAudio 5.1.9.3018 Basic / 6.2.5.8220 Basic / 7.0.0 Basic / 8.0.16.2000 Basic | | 54C803DFC87B52BA | Nettalk 6.7.12 | | B3F13480C2785AE | Paint 6.1 (build 7601: SP1) | | D78150E0484A4E1D | Evernote 5.9.6.9494 | | 1CF97C38A5881255 | MediaPortal 1.1.3 | | 292A746334889A7E | SQLiteSpy 1.9.13 | | A5DB18F617E28A51 | ICQ 6.5 (Build 2024) | | DD658A07478B46C2 | PIRCH98 1.0.1.1190 | | 4D7BDAEA55AD352 | PeaZip 6.0.0 | | 46F433176BC0B3D2 | WinRAR 5.30 beta 64-bit | | a6744f520b56975c | SAPIEN SnippetEditor | | 2544FF74641B639D | WiseFTP 6.1.5 | | 223BF0F360C6FEA5 | I2P 0.8.8 (restartable) | | 0006F647F9488D7A | AIM 7.5.11.9 (custom AppID + JL support) | | B868D9201B866D96 | Microsoft Lync 4.0.7577.0 | | B7CB1D1C1991ACCF | FlashFXP 4.0.0 (Build 1548) | | E57CFC995BDC1D98 | Snagit 11 | | 14a989d191548bbc | Cyberlink PowerDVD16 | | 469E4A7982CEA4D4 | Windows Wordpad | | 6da48f37c95d6e1 | Google Chrome | | 74EA779831912E30 | Skype 7.24.0.104 | | EFB08D4E11E21ECE | Paltalk Messenger 10.0 (Build 409) | | 9EFF0B23D51FE003 | XMind 201807140020 | | 5DA8F997FD5F9428 | Internet Explorer x64 | | 68a0dbfb7d0781d5 | Corel Photo Paint Home | | c343543d4ee31de7 | Microsoft Access | | 4fc234e682fa0fff | Fineprint pdfFactory | | 070B52CF73249257 | Sococo 1.5.0.2274 | | 5FD959F6FE6B8AE7 | PuTTY 0.70 (x64) | | D0261ED6E16B200B | News File Grabber 4.6.0.4 | | 3F97341A65BAC63A | Ozum 6.07 (Build 6070) | | dfc4675a96730ede | Microsoft.WindowsFeedbackHub x64 | | 2B53C4DDF69195FC | Zune x64 | | 90E5E8B21D7E7924 | Winamp 3.0d (Build 488) | | 6ded8e6daa05cb0c | Cyberlink PhotoDirector 8 | | 7CB0735D45243070 | CDisplay 1.8.1.0 | | 386A2F6AA7967F36 | EyeBrowse 2.7 | | CA1EB46544793057 | RetroShare 0.5.2a (Build 4550) | | 2bcef060ace5a6db | NordVPN | | ECD1A5E2C3AF9C46 | LibreOffice 5.1.0.3 Press | | 16EC093B8F51508F | Opera 8.54 build 7730 / 9.64 build 10487 / 11.50 build 1074 | | 9303de56d0685af1 | plist Editor Pro for Windows | | 58bee77c49899591 | Apple iTunes 12xxx x64 | | 2B164F512891AE37 | NewsWolf NSListGen | | E73D9F534ED5618A | BitSpirit 1.2.0.228 / 2.0 / 2.6.3.168 / 2.7.2.239 / 2.8.0.072 / 3.1.0.077 / 3.6.0.550 | | E4BD2558BFAB368D | UltraDefrag 7.0.0 | | 9D78513A8998829C | Microsoft Built-in Run Dialog (Win7 + Win10) | | 4AA2A5710DA3EFE0 | DCSharpHub 2.0.0 | | 60536f49b49e4689 | Microsoft XmlNotepad 2007 | | 770ecebb12dff1ca | Microsoft.Windows.CloudExperienceHost | | dfe3790e91d3a22f | Tracker Software PDF-XChange Editor | | 59F56184C796CFD4 | ACDSee Photo Manager 10 (Build 219) | | FB1F39D1F230480A | Bopup Messenger 5.6.2.9178 (all languages: en;du;fr;ger;rus;es) | | ECDD9154E84D5544 | Wickr Top Secret Messenger Desktop 2.3.5 | | 606A33F5A27B57D4 | Microsoft Built-in Computer Management 10.0.10011.16384 (Win10) | | A0D6B1B874C6E9D2 | TOR Browser 6.0.2 | | B17D3D0C9CA7E29 | Picasa 3.8.0 (Build 117.43, 0) | | FF224628F0E8103C | Morpheus 3.0.3.6 | | 9A3BDAE86D5576EE | WinSCP 3.2.1 (Build 174) / 3.8.0 (Build 312) | | 2417CAA1F2A881D4 | ICQ 7.6 (Build 5617) | | 3198E37206F28DC7 | CuteFTP 8.3 Professional (Build 8.3.4.0007) | | FAC3AA4105C6C466 | Microsoft Built-in System Restore (Win7) | | BAACB5294867B833 | Notepad++ 7.8.6 | | 2D61CCCB4338DFC8 | BitTorrent 5.0.0 / 6.0.0 / 7.2.1 (Build 25548) | | AA11F575087B3BDC | Unzbin 2.6.8 | | 9645f58513b1a821 | Windows Live Mail (wlmail.exe) | | EF606B196796EBB | HP MediaSmart Photo | | AC8920ED05001800 | DMDirc 0.6.5 (Profile store: C:\Users$user\AppData\Roaming\DMDirc) | | 5C450709F7AE4396 | Firefox 3.6.13 (32-bit) | | 226400522157FE8B | FileZilla Server 0.9.39 beta | | A18DF73203B0340E | Microsoft Word 2016 | | 9AD84C52EFEAE190 | 1Password 4.6.0.604 | | ED7A5CC3CCA8D52A | CCleaner 1.32.345 / 1.41.544 / 2.36.1233 / 3.10.1525 | | 0B48CE76EDA60B97 | Shareaza 8.0.0.112300 | | A028C9DB28AA15A3 | Piriform Defraggler 2.20.989 64-bit | | A3E0D98F5653B539 | Instantbird 1.0 (20110623121653) (JL support) | | 603eaabe372fb7ee | CorelDraw 17 | | D41746B133D17456 | Tkabber 0.11.1 | | 40F2ACA05D8A33F2 | Minitab 16 | | D249D9DDD424B688 | Google Chrome 81.0.4044.138 | | 8de2636cecd37184 | MusicBee | | 521A29E5D22C13B4 | Skype 1.4.0.84 / 2.5.0.154 / 3.8.0.139 / 4.2.0.187 / Skype 5.3.0.120 / 5.5.0.115 / 5.5.32.117 | | 31E8AC6B0784ED7D | Foxit Reader 9.4.0.16811 | | C997D2E1A0F0929 | BCWipe 6.08.6 | | B3965C840BF28EF4 | AIM 4.8.2616 | | 1f1f846f76251ea8 | Microsoft.Office.Desktop.Word\_16xxx | | 6518d6ae55cb5b8e | CorelDraw Home 20 | | 62BFF50B969C2575 | Quintessential Media Player 5.0 (Build 121) | | F214CA2DD40C59C1 | FrostWire 4.20.9 | | 8C816C711D66A6B5 | MSN Messenger 6.2.0137 / 7.0.0820 | | 9FDB10E18CDD0101 | Cisco AnyConnect Secure Mobility Client 3.1.02040 | | E9A39DFBA105EA23 | Faststone Image Viewer 4.6 / 5.5 | | 4975D6798A8BDF66 | 7-Zip 4.65 / 9.20 | | AC3A63B839AC9D3A | Vuze 4.6.0.4 | | 5e877db63dec2f8 | JetBrains dotPeek | | B0459DE4674AAB56 | Windows Virtual PC - vmwindow\.exe (32- and 64-bit) | | 98aaea517363a6fa | Microsoft.DiagnosticDataViewer | | 500B8C1D5302FC9C | Python (.pyw) | | F2CB1C38AB948F58 | X-Chat 1.8.10 / 2.6.9 / 2.8.9 | | A6D4DFEC09C69409 | Microsoft Word Viewer 11.8169.8172 | | bd6f833ece9f9890 | Microsoft Sticky Notes | | DE76415E0060CE13 | Noworyta News Reader 2.9 | | C01D68E40226892B | ClicksAndWhistles 2.7.146 | | 624c8eb4922c2308 | Modern CSV | | a97085ebdc30067f | microsoft.windowscommunicationsapps | | D38A3EA7EC79FBED | LibreOffice 5.1.0.3 Writer | | 16D71406474462B5 | Snagit Editor 12.4.1 | | 23F08DAB0F6AAF30 | SoMud 1.3.3 | | 4d202cabc6786cf7 | Opera Browser | | 435A2F986B404EB7 | SmartFTP 4.0.1214.0 / 7.0.2200.0 | | 5e852f5f576f812c | MiTec JSON Viewer (JSONView\.exe) | | 6274ff22c2061c60 | Google PhotoViewer (Picasa) | | b2a0df3f22cec7e0 | Microsoft.People\_10 | | E1D47CB031DAFB9F | BearShare 6.0.0.22717 / 8.1.0.70928 / 10.0.0.112380 | | DE48A32EDCBE79E4 | Adobe Acrobat Reader DC 2015.010.20056 | | 3ebcdfa8943cc8b8 | SAPIEN SnippetEditor | | 550ABC1CB58EB92C | VeraCrypt 1.16 64-bit | | 5a2098e080cf7ac4 | OneDrive ?? (ClassicMru) | | C91D08DCFC39A506 | SM Player 0.6.9 r3447 | | FC999F29BC5C3560 | Robo-FTP 3.7.9 | | 6D2BAC8F1EDF6668 | Microsoft Outlook 2016 64-bit | | B91050D8B077A4E8 | Windows Media Center x64 | | 3D877EC11607FE4 | Thunderbird 6.0.2 | | DD7C3B1ADB1C168B | Microsoft Game Bar | | f2a9149d1c88d093 | Tor Browser (Firefox) | | 9560577FD87CF573 | LeechFTP 1.3 (Build 207) | | AF0FDD562E3F275B | Snagit 2020 | | 7010C278903C2B0F | Adobe Acrobat XI Pro 32-bit | | 5B7F3287093C1623 | Total Commander 8.52a 64-bit | | 7B4D500E147E4391 | Tor Browser 8.0.4 (x64) | | 2CA2A1A69DC5465F | UltraVNC 1.2.1.0 Server Property Page | | 959668A81D4F220E | Sublime Text 3.2.1 (Build 3207) | | 28493D9D08E13AA6 | UltraVNC Viewer 1.2.1.0 | | CCA6383A507BAC64 | Gadu-Gadu 10.5.2.13164 | | CAEA34D2E74F5C8 | uTorrent 3.4.7 | | 89B0D939F117F75C | Adobe Acrobat 9 Pro Extended (32-bit) | | 888F2FA044591EDA | Twitter - Trusted Microsoft Store App (Win10) | | 96252DAFF039437A | Lphant 7.0.0.112351 | | CA942805559495E9 | aMSN 0.98.4 | | F09B920BFB781142 | Camfrog 4.0.47 / 5.5.0 / 6.1 (build 146) (JL support) | | 6A316AA67A46820B | Core FTP LE 1.3c (Build 1437) / 2.2 (Build 1689) | | 9F03AE476AD461FA | GroupsAloud 1.0 | | 9D1F905CE5044AEE | Edge Browser | | 669967F27AFDEBEC | NirSoft PstPassword 1.20 (x86) | | 777483D3CDAC1727 | Gajim 0.14.4 | | 352FD027C0E8F0E5 | Zoom | | 353E9052CCCBEC5D | Kindle for PC 1.21.0 | | 20513CDF29D09C0E | Hex Editor Neo | | 73CE3745A843C0A4 | FrostWire 5.1.4 | | 93B18ADF1D948FA3 | qutIM 0.2 | | E42A8E0F4D9B8DCF | Sysax FTP Automation 5.15 | | 573770283DC3D854 | Windows Defender | | 6BB98FB8CDC26D69 | Calculator (Windows built-in) | | A55ED4FBB973AEFB | Microsoft Teams | | 930cf1dd2266e2cb | DB Browser for SQLite | | A746F9625F7695E8 | HeXHub 5.07 | | f8f05350c84c9d76 | Mozilla Thunderbird | | DEE18F19C7E3A2EC | PopNote 5.21 | | d992bcc31b3e5727 | Opera Browser | | DB3B8D985F0668E | FreeFileSync 10.7 | | C2D349A0E756411B | Adobe Reader 8.1.2 | | 454EF7DCA3BB16B2 | Exodus 0.10.0.0 | | ACE8715529916D31 | 40tude Dialog 2.0.15.1 (Beta 38) | | 37392221756DE927 | RealPlayer SP 12 | | 1ab724316049531 | NordVPN | | 3E9850346F375D41 | Foxit Phantom PDF 7.2.2.929 | | 177AEB41DEB606AE | Adobe Photoshop CS6 (64 Bit) | | 7B2B4F995B54387D | News Reactor 20100224.16 | | F001EA668C0AA916 | Cabos 0.8.2 | | E93DBDCEDE8623F2 | Pandion 2.6.106 | | 3A5148BF2288A434 | Secure FTP 2.6.1 (Build 20101209.1254) | | CFAB0EC14B6F953 | Express NewsPictures 2.41 (Build 08.05.07.0) | | 9E0B3F677A26BBC4 | BitKinex 3.2.3 | | 689319B6547CDA85 | emesene 2.11.7 | | 0A79A7CE3C45D781 | CuteFTP 7.1 (Build 06.06.2005.1) | | C845F3A6022D647C | Another File 2.03 (Build 2/7/2004) | | B48CE76EDA60B97 | Shareaza 8.0.0.112300 | | A2B95CA27B6C33D9 | Windows Live Photo Gallery | | 9DACEBAA9AC8CA4E | TLNews Newsreader 2.2.0 (Build 2430) | | FF99BA2FB2E34B73 | Windows Calculator | | 83DD64E7FA560BD5 | LibreOffice 5.1.0.3 Calc | | 00098B0EF1C84088 | fulDC 6.78 | | 6E9D40A4C63BB562 | Real Player Alternative 1.25 (Media Player Classic 6.4.8.2 / 6.4.9.0) | | 3643905fceab2635 | Cyberlink PowerDVD 16 | | 49B5EDBD92D8CD58 | FTP Commander 8.02 | | AD57BD0F4825CCE | WinRAR 6.01 Russian 64 bit | | 53f58609d680cdbc | Isobuster | | 8BCE06A9E923E1F9 | Slack 4.10.3 | | C54B96F328BDC28D | WiseFTP 7.3.0 | | A7BA40025DAC9A67 | Microsoft Office Hub | | ea5af8ce5aeb5617 | Notepad++ | | 954EA5F70258B502 | Windows Script Host - wscript.exe (32-bit) | | DC64DE6C91C18300 | Brosix Communicator 3.1.3 (Build 110719 nid 1) | | 8FB5CE5E2B049CE | Windows Defender (Win10 built-in) | | D838AAC097ABECE7 | ACDSee Photo Manager 12 (Build 344) | | 5D696D521DE238C3 | Google Chrome 9.0.597.84 / 12.0.742.100 / 13.0.785.215 / 48.0.2564.116 | | 3C3871276E149215 | PowerShell 7 | | 3476342aab319002 | Mozilla Firefox | | 4E538FDE985A3C01 | Torch Browser 65.0.0.1614 (x86) | | a712c324879904b1 | Malwarebytes (assistant.exe) | | BFE841F4D35C92B1 | QuadSucker/News 5.0 | | 6BC3383CB68A3E37 | iTunes 7.6.0.29 / 8.0.0.35 | | 1A89D1BEFE8E90E3 | Adobe Acrobat Distiller Pro XI 32-bit 11.0.0779 | | 8F852307189803B8 | Far Manager 2.0.1807 | | CF6379A9A987366E | Digibin 1.31 | | 49DB7ED4F2703C22 | LogMeIn Client 1.3.1835 | | 7111C0CE965B7246 | Battle.net | | 4dde7d7a7dfc5f29 | VSCodium | | A31EC95FDD5F350F | BitComet 0.49 / 0.59 / 0.69 / 0.79 / 0.89 / 0.99 / 1.07 / 1.28 | | 19CCEE0274976DA8 | mIRC 4.72 / 5.61 | | b50f4a1d866b4b05 | Microsoft.Office.Word 16xxx x64 | | 2437D4D14B056114 | EiskaltDC++ 2.2.3 | | CCBA5A5986C77E43 | Microsoft Edge (Chromium) | | 9077B9C9CF187CC2 | KeePass 1.36 | | e353de90c46ecf50 | Hex-Rays IDA Pro | | EE462C3B81ABB6F6 | Adobe Reader X 10.1.0 | | c08dde8c94c16b10 | Cyberlink PowerDVD 18 | | acb8cd11364e2de8 | VisualStudio | | CB5250EAEF7E3213 | ApexDC++ 1.4.3.957 | | C99DDDE925D26DF3 | Robo-FTP 3.7.9 CronMaker | | 8B87640A40EC9FC | Snagit 2020 | | B6267F3FCB700B60 | WiseFTP 4.1.0 | | E0F7A40340179171 | imule 1.4.5 (rev. 749) | | D3C5CF21E86B28AF | SeaMonkey 2.3.3 | | 4B6925EFC53A3C08 | BCWipe Task Manager 3.02.3 / 3.06.5.5 | | 5EA2A50C7979FBDC | TrustyFiles 3.1.0.22 | | FAEF7DEF55A1D4B | VLC 2.2.6 | | C1EECE5026414C64 | Recuva 1.52.1086 (64-bit) | | 7C2916AFD6F116A6 | LibreOffice 5.1.0.3 Base | | 6A8B377D0F5CB666 | WinSCP 2.3.0 (Build 146) | | C765823D986857BA | Adobe Illustrator CS5 (32-bit) | | 8628E76FD9020E81 | Fling File Transfer Plus 2.24 | | 776BEB1FCFC6DFA5 | Thunderbird 1.0.6 (20050716) / 3.0.2 | | 7A8DB574299C8568 | Windows Movie Maker 2012 (build 16.4.3528.0331) | | E6EA77A1D4553872 | Gnucleus 1.8.6.0 | | a850d8ed37504c7c | Microsoft.Windows.Cortana | | F0468CE1AE57883D | Adobe Reader 7.1.0 | | 9A165F62EDBFA161 | Microsoft Store | | 3fcb7925be48c6d4 | JSONBuddyApp | | 18fa158a64c9508a | Mozilla Firefox x32 | | BA132E702C0147EF | KCeasy 0.19-rc1 | | 76689FF502A1FD9E | Imagine Image and Animation Viewer 1.0.7 | | BA3A45F7FD2583E1 | Blubster 3.1.1 | | 9749CEA96D411F37 | HexChat 2.10.2 64-bit | | 7526DE4A8B5914D9 | Forte Agent 6.00 (Build 32.1186) | | 315E29A36E961336 | Roboform 7.8 | | 6fac1b1908485d3 | Windows Font Viewer | | 31db872855923268 | Microsoft Orca | | 42f16a31d9a2ec4 | Microsoft Support Diagnostic Tool | | e4ea035065b5789a | HxD 2.5 | | 930cf1dd2266e2cb | DB Browser for SQLite 3.12.2 | | 78aa210563284496 | Windows Performance Analyzer 11.1.5.2 | | a48aff51c30d699a | qBittorrent 4.5.4 (64-bit) | | f065ac336abcaa3e | Adobe Acrobat Reader DC (64-bit) | | ace2e449a5dfce37 | Windows Update Standalone Installer | | db37f98b03e7cdde | WinMerge 2.16.30 | | 7b8d39bd536c7feb | Microsoft XML Notepad | | 6f39a16f693777f6 | Microsoft Paint 3D | | 82de7b745170a7a7 | Microsoft App Installer | # Prefetch *Explore the role of Prefetch files in Windows, how they boost system performance, and their forensic significance.* *File path: `C:\Windows\Prefetch`* ### Key Points: 1. **Performance Optimization:** * Windows Prefetching optimizes system performance by preloading essential data and executable code into memory, thereby speeding up application load times and enhancing overall system responsiveness. 2. **Forensic Value:** * Prefetch files are a significant asset in forensic analysis, offering insights into application execution patterns, including the frequency of application use and the original file paths of executables. 3. **Enhancements in Windows 8 and Beyond:** * Starting with Windows 8, the Prefetching mechanism records up to eight execution timestamps for each application, providing a more detailed timeline of application usage that is particularly valuable in forensic investigations. 4. **Prefetch in Server Environments:** * Prefetching is typically not enabled on servers, as their operational profile involves running a consistent set of applications and services continuously, diminishing the utility of Prefetching compared to desktop environments. 5. **Considerations** * Give precedence to collecting Prefetch files, as using response tools may result in generating new files and the potential removal of existing ones. ### Prefetching: Boosting Performance and Aiding Forensics Windows Prefetching stands as a pivotal system performance feature, ingeniously designed to optimize and expedite the loading times of applications. By preemptively loading vital data and executable code into memory, Prefetching ensures that the necessary components are readily available, thereby enhancing the system's responsiveness and overall user experience. From a forensic perspective, Prefetch files serve as a veritable goldmine of information. These artifacts are a byproduct of the Prefetching process, and they provide a wealth of data pivotal for forensic analysts. Each file is a repository of insightful details regarding application execution patterns. Forensic experts can glean the frequency of application usage through the total number of runs recorded within these files. Furthermore, the Prefetch files meticulously preserve the original file path of the executable, offering a clear trail of software usage. With the advent of Windows 8 and subsequent versions, the Prefetching mechanism has been refined to maintain an even more robust execution history. These newer iterations of the Windows operating system are capable of storing up to eight separate execution timestamps per application. This enhancement not only serves the primary function of performance optimization but also significantly augments the depth of forensic analysis. Investigators can now construct a more comprehensive timeline of application usage, which is instrumental in various scenarios, from cybersecurity breach assessments to digital behavior profiling. {% hint style="info" %} Prefetch is not enabled on servers by default. (I've yet to see a server WITH prefetch enabled) {% endhint %} When it comes to Windows servers, prefetching takes a back seat. Why? Well, it's all about the different demands of server environments compared to our daily-use desktops. In the server world, consistency is king. These digital workhorses run a fixed set of applications and services around the clock. There's not much of this on-and-off game that's typical in desktop scenarios. Prefetching shines in desktops where apps are constantly opened and closed. It's like a shortcut, speeding up the loading times of these programs. But in servers, since the same applications hum along continuously, prefetching doesn't quite get its moment in the spotlight. After all, why invest in speeding up program launches when they're always running? Moreover, servers juggle different performance priorities. They're the powerlifters, focusing on stability, handling heavy-duty tasks, and managing network requests. So, the resources that would go into prefetching are better used for these server-specific roles. It's all about playing to the strengths and needs of each environment – desktops and servers, each with their own performance playbook! {% hint style="info" %} Give precedence to collecting Prefetch files, as using live response tools may result in generating new files and the potential removal of existing ones. {% endhint %} ### Prefetch Settings Adjustment To audit or disable Prefetch: * **Key**: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters` * **Value**: `EnablePrefetcher` (REG\_DWORD) * **Settings**: * `0` (Disabled) * `1` (App launch enabled) * `2` (Boot enabled) * `3` (Both enabled) *Prefetch files provide a unique insight into system usage and user activities, essential in digital forensics.* [*Learn how to parse prefetch files in this guide!*](/windows-artifacts/program-execution/prefetch/decoding-prefetch-files-with-eric-zimmermans-pecmd-tool) [For more detailed information, check out Magnet Forensics' insights on Prefetch files.](https://www.magnetforensics.com/blog/forensic-analysis-of-prefetch-files-in-windows/) # Index.dat file:// Index.dat files are integral to understanding user activity on a Windows system, especially regarding Internet Explorer's history. However, these files track more than just web browsing activity; they also log access to local and remote files via network shares. This capability makes Index.dat files a rich source of information for forensic analysts looking to piece together a user's actions on a system. ## Key Insights: * **Location for Windows XP**: * `%userprofile%\Local Settings\History\History.IE5` * **Locations for Windows 7–10**: * `%userprofile%\AppData\Local\Microsoft\Windows\History\History.IE5` * `%userprofile%\AppData\Local\Microsoft\Windows\History\Low\History.IE5` The Index.dat files within these directories provide a day-by-day account of the files and applications accessed by the user. This level of detail can be invaluable in forensic investigations, offering insights into user behavior and system interaction that go beyond simple web browsing. ### Interpretation: Entries in the Index.dat file are stored in a specific format, such as `file:///C:/directory/filename.ext`. This format indicates the access or interaction with local files, but it's crucial to understand that an entry in this format does not necessarily mean the file was opened within the browser. Instead, it signifies that the file was accessed in some manner, which Internet Explorer tracked. ## Deeper Dive The Index.dat file serves as a database for Internet Explorer's history, cache, and cookies. Despite its association with the browser, the tracking of local and network file access expands its relevance for digital forensics. These files can remain on the system even after attempts to clear browsing history or when using private browsing modes, making them a persistent artifact for analysis. ## Analyzing The Artifact To analyze Index.dat files, forensic analysts typically follow these steps: 1. Locate the Index.dat files within the specified directories, depending on the version of Windows. 2. Use specialized tools designed to parse and interpret the contents of Index.dat files, as they are stored in a binary format that is not human-readable. 3. Extract the list of accessed files, along with timestamps, to construct a timeline of user activity. This timeline can include internet browsing as well as local and network file accesses. 4. Correlate the extracted information with other forensic artifacts to build a comprehensive view of user actions. ## Tools for Analysis * **Index.dat Viewer**: This tool allows for the reading and analysis of Index.dat files, providing a user-friendly interface to examine the URLs, files accessed, and timestamps. * **Pasco**: A command-line tool that interprets the contents of Index.dat files, Pasco can reconstruct the browsing history and access logs, outputting the results in a human-readable format. * **Forensic Browser for Internet Explorer**: This tool is specifically designed for forensic analysis of Internet Explorer artifacts, including Index.dat files. It offers comprehensive capabilities for parsing, analyzing, and reporting on the data contained within these files. # PowerShell Scripts # .lnk Files ```powershell $shortcutPath = "C:\Users\USERNAME\Desktop\Opus Supervisor.lnk" $shell = New-Object -ComObject WScript.Shell $shortcut = $shell.CreateShortcut($shortcutPath) $shortcut.TargetPath $shortcut.Arguments $shortcut.WorkingDirectory $shortcut.IconLocation $shortcut.Description $shortcut.Hotkey $shortcut.WindowStyle ``` # PCA (Program Compatibility Assistant) The Program Compatibility Assistant (PCA) is a Windows service (`PcaSvc`) that monitors launched applications and detects compatibility issues with legacy software. PCA has existed since Windows Vista, but starting with **Windows 11 version 22H2**, the service writes execution data to plain-text files on disk. These files provide direct evidence of program execution with full file paths and UTC timestamps, making PCA one of the most straightforward execution artifacts available on modern Windows systems. > **Windows 11 22H2+ only.** The text-based PCA artifacts described on this page do not exist on Windows 10 or earlier Windows 11 builds. If you are investigating a system running anything older, this artifact will not be present. ### Location ``` C:\Windows\appcompat\pca\PcaAppLaunchDic.txt C:\Windows\appcompat\pca\PcaGeneralDb0.txt C:\Windows\appcompat\pca\PcaGeneralDb1.txt ``` The PCA service must be running for these files to be populated. Verify with: ```cmd sc query pcasvc ``` If the service is stopped or disabled, no new entries will be written. ### PcaAppLaunchDic.txt This is the most forensically useful file. It is an ANSI-encoded (CP-1252) text file with Windows line endings (CRLF). Each line maps an executable's file path to its last execution time, separated by a pipe character: ``` executable_path|YYYY-MM-DD HH:MM:SS.fff ``` **Example entries:** ``` %systemroot%\folder\malware.exe|2025-11-15 09:42:11.000 %userprofile%\downloads\setup.exe|2025-11-14 14:33:07.123 ``` #### Key characteristics: * **Timestamps are UTC.** * **Paths are normalized:** drive letter prefixes are removed, and some path components are replaced with environment variables (`%systemroot%`, `%userprofile%`, etc.). System-wide environment variables can be resolved, but user-specific variables require knowing which user profile was involved. * **Paths are lowercased.** * **One entry per executable.** If the same executable runs multiple times, only the most recent execution timestamp is retained. * **Any executable format** can appear here, including `.exe`, `.scr`, `.msi`, and others. * **Entries persist after file deletion.** Even if the original executable is removed from disk, the PCA entry remains. This is useful for detecting cleaned-up malware or deleted attacker tools. ### PcaGeneralDb0.txt and PcaGeneralDb1.txt These companion files store additional detail about application compatibility events, including runtime duration, run status, executable path, and a **ProgramId** value that can be correlated with Amcache entries. The two files operate on a rotation system: 1. `PcaGeneralDb0.txt` starts as the primary (active) file. 2. New records are written to the primary file until it reaches 2 MB. 3. When the primary file hits 2 MB, the secondary file is cleared and becomes the new primary. 4. This cycle repeats, meaning between 2 and 4 MB of historical data is available at any given time. The ProgramId field in these files matches the `ProgramId` value in Amcache `InventoryApplicationFile` entries, allowing you to link PCA execution evidence directly to Amcache metadata (SHA1 hash, publisher, version info). ### What PCA Tracks PCA primarily tracks **GUI-based program execution**. This includes: * Executables launched by double-clicking in Explorer. * Programs run from local folders, removable media, and network shares. * CLI programs launched from the GUI (e.g., running cmd.exe or powershell.exe by double-clicking). #### What PCA Does NOT Track * Programs launched purely from the command line (e.g., typing a command in an existing cmd.exe or PowerShell session). * Services starting automatically. * Scheduled task executions (unless they involve GUI interaction). * Background processes spawned by other applications. This scope is similar to UserAssist in that it focuses on GUI-driven execution. For command-line and background process evidence, use BAM/DAM, Prefetch, or event logs. ### Why PCA Matters for DFIR **It survives common anti-forensic cleanup.** Most attacker cleanup playbooks target well-known artifacts like Prefetch, LNK files, and recent items. PCA files are less widely known and are often left behind simply because the attacker doesn't know they exist. A `C:\Windows\appcompat\pca\` directory sitting untouched while Prefetch has been wiped is a strong lead. **It fills gaps when other artifacts are inconclusive.** Prefetch can be noisy on busy systems with retention limits. ShimCache can't prove execution on Windows 10/11. Amcache doesn't prove execution on its own. PCA provides a clear, timestamped record of execution that can resolve ambiguity when other artifacts are equivocal. **Plain text, easy to parse.** No binary format, no special tools required. You can read `PcaAppLaunchDic.txt` with `type`, `cat`, or any text editor. This makes it useful for quick triage. ### Analyzing PCA #### Quick Triage (Live System) ```cmd type C:\Windows\appcompat\pca\PcaAppLaunchDic.txt ``` ```powershell Get-Content C:\Windows\appcompat\pca\PcaAppLaunchDic.txt | Sort-Object { ($_ -split '\|')[1] } -Descending | Select-Object -First 20 ``` #### Parsing PcaAppLaunchDic.txt Since the format is simple pipe-delimited text, it can be parsed with PowerShell, Python, or any scripting language: ```powershell Import-Csv -Path "C:\Windows\appcompat\pca\PcaAppLaunchDic.txt" -Delimiter '|' -Header 'Path','Timestamp' ``` #### What to Look For * Executables in temp directories, Downloads folders, Recycle Bin paths, or `C:\PerfLogs`. * Known attacker tool names: `mimikatz`, `psexec`, `procdump`, `rubeus`, `sharphound`, `lazagne`. * Executables with suspicious names or paths that no longer exist on disk (deleted after execution). * Timestamps that align with known intrusion timeframes. * Entries for executables launched from removable media or network shares, visible via UNC-style or drive-letter paths. #### Correlating with Amcache To link PCA entries with Amcache metadata: 1. Parse `PcaGeneralDb0.txt` (or `Db1`) and extract the `ProgramId` for entries of interest. 2. Parse `Amcache.hve` with [AmcacheParser](https://github.com/EricZimmerman/AmcacheParser). 3. Match the `ProgramId` from PCA against the `ProgramId` field in `InventoryApplicationFile` entries. 4. The matched Amcache entry provides the SHA1 hash, publisher, version, binary type, and full path, giving you a complete picture of the executed file. ### Artifact Correlation * **Amcache:** ProgramId correlation (see above). Amcache provides file hashes that PCA does not. * **Prefetch:** Corroborate PCA execution timestamps with Prefetch run times. If both agree, execution confidence is very high. * **ShimCache:** Confirms file presence at the recorded path. Adds the file's $SI last modified timestamp. * **UserAssist:** Both track GUI-based execution. UserAssist adds run count and focus time data. * **BAM/DAM:** Provides user-SID-attributed execution timestamps for background processes that PCA may miss. * **Zone.Identifier:** If the executed file was downloaded, the Zone.Identifier ADS may reveal where it came from. * **Event Logs:** Sysmon Event ID 1 or Security Event ID 4688 provide command-line arguments and parent process information that PCA does not capture. ### Tools * [**Velociraptor**](https://docs.velociraptor.app/)**:** Has dedicated PCA artifacts for collecting and parsing PCA files across endpoints at scale. * [**KAPE**](https://www.kroll.com/en/services/cyber-risk/incident-response-litigation-support/kroll-artifact-parser-extractor-kape)**:** Targets for collecting PCA files from the `appcompat\pca` directory. * **Any text editor or CLI tool:** The files are plain text. `type`, `cat`, `grep`, `findstr`, or PowerShell can parse them directly without special tooling. * **Timeline Explorer (Eric Zimmerman):** Import parsed CSV output for filtering and timeline analysis. ### Anti-Forensics Considerations * **File deletion:** An attacker with admin or SYSTEM privileges could delete the PCA files from `C:\Windows\appcompat\pca\`. This would be unusual and suspicious behavior. * **Service disabling:** Stopping or disabling the `PcaSvc` service prevents new entries from being written. Check the service state during triage. * **PcaGeneralDb rotation:** Because the GeneralDb files rotate at 2 MB, older entries are naturally lost over time. On a busy system, historical data in these files may only cover a limited time window. * **PcaAppLaunchDic.txt overwrite:** Since only the most recent execution timestamp per executable is retained, repeated execution of a legitimate program at the same path overwrites the timestamp of a previous malicious execution at that path. However, this requires the attacker to know the exact path of a previous entry. * **VSS recovery:** Previous versions of the PCA files may be recoverable from Volume Shadow Copies. ### References * [Sygnia: Diving into the Windows 11 Forensics PCA Artifact](https://www.sygnia.co/blog/new-windows-11-pca-artifact/) * [Andrea Fortuna: Windows 11 quietly introduced a new execution artifact](https://andreafortuna.org/2026/03/19/windows11-pca-artifact/) * [AboutDFIR: New Windows 11 Pro (22H2) Evidence of Execution Artifact](https://aboutdfir.com/new-windows-11-pro-22h2-evidence-of-execution-artifact/) * [Psmths: Windows Forensic Artifacts - Program Compatibility Assistant](https://github.com/Psmths/windows-forensic-artifacts/blob/main/execution/program-compatibility-assistant.md) * [artefacts.help: Program Compatibility Assistant](https://artefacts.help/windows_pca.html) # Persistence # Registry Windows Registry Keys for Persistence The Windows Registry is a critical database in Windows operating systems, storing configurations and options for the system. Among its many uses, it is a common target for malware and attackers seeking to maintain persistence on a compromised system. By inserting or modifying keys, malicious software can ensure it is executed at system startup or user logon, often without detection. ## Key Insights: * **Run Keys**: * `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` * `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` * These keys are commonly used by both legitimate applications and malware to execute programs automatically at system startup or user login. Malware often adds entries here to maintain persistence. * **Shell Folders and UserInit Key**: * `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders` * `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit` * These locations can be modified to execute scripts or applications, leveraging user logon processes to achieve persistence. * **Services and Drivers**: * `HKLM\SYSTEM\CurrentControlSet\Services` * Malware can create or modify existing service entries to execute malicious code as part of a service or driver's startup routine. * **Logon Scripts**: * `HKCU\Environment\` * This user environment variable specifies a script to be executed during logon, a less common but potential vector for persistence. * **Office Add-ins**: * Varies by Office application, e.g., `HKCU\Software\Microsoft\Office\[Office Version]\Word\Addins` * Malicious Office add-ins can be registered here, ensuring they are loaded at application startup. * **Winlogon Shell**: * `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell` * This key specifies the program launched after user login, which should default to explorer.exe. Modifications here can indicate malware attempting to run alongside the Windows shell. * **Image File Execution Options (IFEO)**: * `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options` * Used to debug or alter executable behaviors, this key can be exploited by malware to hijack legitimate processes. * **AppInit\_DLLs**: * `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs` * Allows DLLs to be loaded with any process using User32.dll, a method that can be used by malware for process injection, achieving persistence and potential privilege escalation. * **Scheduled Tasks**: * Located through Task Scheduler and in the registry under `HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree` * Malware can utilize scheduled tasks for execution at predetermined times or events, providing a reliable persistence method. ## Quick Dive ### **Run and RunOnce Keys**: Malicious entries in these keys can be identified by paths that are unusual or point to executable files in suspicious locations. Analyzing these paths and the executable's they point to can reveal unauthorized persistence mechanisms. To learn more, please visit the [Run and Run Once page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/run-and-run-once) ### **Shell Folders and UserInit Key**: Changes to these keys that do not align with known software installations or system configurations can indicate tampering for persistence. Scripts or executable'ss set to run from these keys warrant further investigation. To learn more, please visit the [Shell Folders and UserInit Key page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/shell-folders-and-userinit-key) ### **Services and Drivers**: Entries for non-standard services or drivers, especially those with obfuscated or unusual names, paths, and descriptions, can be a sign of malware. Analyzing service configuration, including executable paths and parameters, is crucial for identifying persistence. To learn more, please visit the [Services page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/services) ### **Logon Scripts**: This key is infrequently used by legitimate software, making unauthorized entries particularly suspicious. Monitoring for unexpected scripts set to execute at logon can uncover hidden persistence mechanisms. To learn more, please visit the [Logon Scripts page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/logon-scripts) ### **Office Add-ins**: Given the widespread use of Office applications, malicious add-ins represent a stealthy persistence tactic. Analysts should scrutinize unfamiliar add-in entries, particularly in environments where Office applications are frequently used. To learn more, visit the [Office Add-ins page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/office-add-ins) ### **Winlogon Shell**: Any deviation from the default explorer.exe in this key is highly suspect and warrants immediate investigation. Such changes may indicate an attempt to establish persistence or control over the user's session. To learn more, visit the [Winlogon Shell page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/winlogon-shell) ### **Image File Execution Options (IFEO)**: Malware leveraging IFEO for persistence can significantly alter the behavior of legitimate applications. Identifying unexpected debugger entries linked to executables can help in detecting and mitigating such threats. To learn more, visit the [Image File Execution Options page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/image-file-execution-options-ifeo) ### **AppInit\_DLLs**: Given its capability to inject code into a wide array of processes, entries in this key should be carefully validated. Unauthorized DLLs listed here can be indicative of malware seeking to maintain a presence or escalate privileges. To learn more, visit the [AppInit\_DLLs page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/appinit_dlls) ### **Scheduled Tasks**: Though not exclusively a registry-based mechanism, scheduled tasks are often used for legitimate purposes, making the detection of malicious tasks challenging. Analyzing task configurations and triggers can reveal abuse of this feature for persistence. To learn more, visit the [Scheduled Tasks](/windows-artifacts/persistence/scheduled-tasks)[ page.](https://app.gitbook.com/o/2sihAyERJmSXHn3m7cvC/s/EcAeOZhLg6uTRTQSwAxM/~/changes/24/windows-artifacts/persistence/registry/scheduled-tasks) ## Analyzing The Artifact * **Identifying Unauthorized Entries**: Use Registry Editor (`regedit`) or command-line tools (`reg query`) to inspect specified keys for entries that do not correspond to known, legitimate applications or system processes. * **Analyzing Executable Paths**: For any suspicious entry, locate the executable path and analyze the file. This can involve checking digital signatures, file properties, and running malware scans. * **Cross-Referencing with Logs**: System and application logs can provide context for when and by whom a registry entry was created or modified, offering insights into potentially malicious activity. ## Tools for Analysis * **RegRipper**: A powerful tool for extracting and analyzing information from the Windows Registry, especially useful for forensic investigations. * **Autoruns**: Part of Sysinternals Suite, it provides a comprehensive overview of all startup items, including those configured via the Registry, allowing for easy identification of suspicious entries. * **Process Explorer and Process Monitor**: Also from Sysinternals, these tools can be used to monitor system activity, including processes started at boot or logon, which may be initiated by Registry entries. # NTUSER.DAT & HKU\SID The `NTUSER.DAT` file and the `HKU\SID-...\` registry key are related but serve different purposes within the context of the Windows operating system. Here's how they are connected and what differentiates them: #### NTUSER.DAT * **Location and Purpose**: The `NTUSER.DAT` file is located within a user's profile directory (e.g., `C:\Users\[Username]\NTUSER.DAT`). It is a registry hive file that stores the user-specific portion of the Windows registry. This includes user preferences, desktop settings, application settings, and more. * **Access**: It's directly accessible (and modifiable) only when the user is logged in or by using specific registry or forensic tools when the user is logged out. For forensic analysis, `NTUSER.DAT` is often examined to understand a specific user's activities and configurations. #### HKU\SID-... * **Location and Purpose**: `HKU` (HKEY\_USERS) is a major registry hive that contains all user profiles currently loaded on the system. Each subkey under `HKU` is named after the Security Identifier (SID) of the user profiles. The `HKU\SID-...` key corresponds to the currently loaded profile of a user and represents the live state of the user's portion of the registry. * **Access**: The `HKU\SID-...` path is accessible via the Windows Registry Editor (`regedit`) or through programming and scripting interfaces that interact with the Windows registry. It reflects the current state of a user's registry settings while they are logged on. #### The Connection * **Relation**: When a user logs on to a Windows system, the `NTUSER.DAT` file for their profile is loaded into the registry under their SID in the `HKEY_USERS` hive. This means that the `NTUSER.DAT` file is essentially the on-disk storage format of the user-specific registry settings, while `HKU\SID-...` represents those settings loaded into the system's active registry. * **Differences**: The key difference is in their accessibility and representation. `NTUSER.DAT` is a file on the filesystem, while `HKU\SID-...` is a registry path accessible when the user's profile is loaded into memory. Changes made to the registry through `HKU\SID-...` are saved back to `NTUSER.DAT` when the user logs off or the profile is unloaded. #### Practical Implications * **Forensic Analysis**: For forensic purposes, `NTUSER.DAT` files are invaluable because they can be analyzed even if the user is not currently logged in, allowing investigators to gather information about user preferences, application use, and more. * **System Administration**: Administrators might use the `HKU\SID-...` path to modify registry settings for users currently logged into the system or to troubleshoot issues related to user profiles. # Run and Run Once #### Run and RunOnce Keys: An Overview * **Run Keys**: These keys launch programs at system startup or user logon. Values under these keys execute every time the system boots or the user signs in. Common locations include: * `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run` * `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` Values under `HKEY_LOCAL_MACHINE` run for all users. Values under `HKEY_CURRENT_USER` run only for the signed-in user. * **RunOnce Keys**: These keys work like `Run` keys, but Windows executes each value only once at the next startup or logon, then removes it from the Registry. **They are not a durable persistence mechanism, but they can still be abused for one-time execution.** Common locations include: * `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce` * `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` #### Legitimate Uses Legitimately, software developers use these keys to ensure necessary services and applications start automatically to provide a seamless user experience. For example, antivirus software might use `Run` keys to start protection services at boot time, or an installer might use `RunOnce` to complete setup tasks the next time the computer starts. #### Abuse by Threat Actors Threat actors exploit these keys to establish persistence for their malware. By inserting malicious paths into these keys, they can ensure their malware executes each time the computer starts or when a user logs on. This technique is commonly used because it is straightforward and effective, especially for maintaining long-term access to a compromised system. #### Examples of Suspicious Entries A suspicious entry in a `Run` or `RunOnce` key might look like this: * A program executing from a temporary or unusual directory, e.g., ```powershell HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run "SecurityUpdate"="C:\Users\user\AppData\Local\Temp\update.exe" ``` * Entries with obfuscated or random names, which do not match known software, e.g., ```powershell HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run "kjhfgds"="C:\Windows\System32\kjhfgds.exe" ``` * Paths that include known locations for malware persistence or unusual script execution, e.g., ```powershell HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce "CustomScript"="powershell.exe -ExecutionPolicy Bypass -File C:\Users\user\Documents\script.ps1" ``` #### Detection and Analysis For digital forensic analysts, identifying suspicious or unknown entries in these keys is crucial. Tools such as `autoruns` from Sysinternals can be used to inspect these locations efficiently. Analysts should look for entries that do not correspond to installed software, that reference executables in unusual locations, or that appear to use obfuscation techniques. Verifying the legitimacy of each entry and conducting further investigation on unknown or suspicious items is essential for identifying and mitigating potential threats. In summary, while `Run` and `RunOnce` keys serve important functions in Windows OS for legitimate software, they are also common targets for abuse by threat actors seeking to maintain persistence on compromised systems. Identifying and investigating unusual or unknown entries in these Registry locations is a critical task for security professionals and digital forensic analysts to prevent and mitigate malicious activities. --- [Next Page](/llms-full.txt/1)