A service that syncs nothing

List services from memory with windows.svcscan, pick out the one that runs from ProgramData under a Microsoft-sounding name, and confirm it with netscan.

Terminal mission
Intermediate
3 objectives
0 of 3 solved

Briefing

A file server was flagged for a new auto-start service in the weekly baseline diff, but the service was deleted from the registry before anyone looked. It is still running, so it is still in memory. The image is cases/fs-02/fs-02.lime.

windows.svcscan reads the service records the Service Control Manager keeps in RAM: name, display name, start type, state, PID, and binary path.

analyst@forensics-ws

forensics-ws · Memory forensics

Type help for the command list and objectives for your tasks. Everything runs in this browser.

analyst@forensics-ws:~/cases/fs-02$

Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.