I totally missed the fact that we were supposed to use procdot but I was able to get all but one of the answers by manually combing through the procmon csv and wireshark pcap. What a pain haha! I was stuck on the registry key path of the mounted drive question so this was a good walkthrough of procdot. Definitely makes things easier. Thanks for the video!
![[TryHackMe] Investigating Windows - I | Room walkthrough ~ Kumar Priyanshu](http://i.ytimg.com/vi/C-eD5mAr5XE/mqdefault.jpg)
![[TryHackMe] Investigating Windows - I | Room walkthrough ~ Kumar Priyanshu](/img/tr.png)
![Twenty One Pilots - “The Line” (from Arcane Season 2) [Official Music Video]](http://i.ytimg.com/vi/E2Rj2gQAyPA/mqdefault.jpg)
Suffering from cold, my apologies for coughing so many times😂
I totally missed the fact that we were supposed to use procdot but I was able to get all but one of the answers by manually combing through the procmon csv and wireshark pcap. What a pain haha! I was stuck on the registry key path of the mounted drive question so this was a good walkthrough of procdot. Definitely makes things easier. Thanks for the video!
My pleasure buddy!😃