Notifications
Clear all
Topic starter
16/11/2010 8:21 pm
All,
is it possible to determine which process, executable,… produced network traffic if you only have a image of the hdd.
I have got no memory dump and no Live Response data.
It´s a Win7 64-bit.
Thanks
16/11/2010 8:27 pm
Sometimes it is possible. I would say start with making an elaborate time-line.
16/11/2010 9:15 pm
You can view the executables which have a windows firewall exception policy here
HKLM\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules
I'm not sure how much that helps your situation, but that may be a place to start.