Memory and Process Acquisition
DumpIt.exe - This utility is used to generate a physical memory dump of Windows machines. It works with both x86 (32-bits) and x64 (64-bits) machines.
Procdump.exe - ProcDump is a command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during
a spike that an administrator or developer can use to determine the cause of the spike. ProcDump also includes hung window monitoring (using the same
definition of a window hang that Windows and Task Manager use), unhandled exception monitoring and can generate dumps based on the values of system
performance counters. It also can serve as a general process dump utility that you can embed in other scripts.
Network
Netstat.exe - (network statistics) is a command-line tool that displays network connections (both incoming and outgoing), routing tables, and a number of
network interface statistics.
Parameters
-a - Displays all active connections and the TCP and UDP ports on which the computer is listening.
-f - Displays fully qualified domain names <FQDN> for foreign addresses (only available on Windows Vista and newer operating systems).
-n - Displays active TCP connections, however, addresses and port numbers are expressed numerically and no attempt is made to determine names.
-o - Displays active TCP connections and includes the process ID (PID) for each connection. You can find the application based on the PID on the Processes
tab in Windows Task Manager.
-r - Displays the contents of the IP routing table.
Nbtstat.exe - Nbtstat is designed to help troubleshoot NetBIOS name resolution problems. When a network is functioning normally, NetBIOS over TCP/IP
(NetBT) resolves NetBIOS names to IP addresses.
Parameters
-c - The nbtstat - c option shows the contents of the NetBIOS name cache, which contains NetBIOS name-to-IP address mappings.
PsLoggedOn.exe - PsLoggedOn is an applet that displays both the locally logged on users and users logged on via resources for either the local computer, or
Arp.exe - (address Resolution Protocol) Displays the IP-to-Physical address translation tables used by the address resolution protocol.
Parameters
-a - Displays current ARP entries. May include more than one network interface.
Ipconfig.exe - (internet protocol configuration) in Microsoft Windows is a console application that displays all current TCP/IP network configuration values.
Parameters
/all - Displays full configuration information.
Tcpvcon.exe - is a command line version of TCPView.exe. TCPView is a Windows program that will show you detailed listings of all TCP and UDP endpoints
Parameters
-a - Show all endpoints (default is to show established TCP connections).
Processes and Services
Pslist.exe - list detailed information about processes.
PsService.exe - PsService is a service viewer and controller for Windows. Like the SC utility that's included in the Windows NT and Windows 2000 Resource
Kits, PsService displays the status, configuration, and dependencies of a service, and allows you to start, stop, pause, resume and restart them.
TaskList.exe - Displays a list of applications and services with their Process ID (PID) for all tasks running on either a local or a remote computer.
ListDLLs.exe - ListDLLs is a utility that reports the DLLs loaded into processes. You can use it to list all DLLs loaded into all processes, into a specific
process, or to list the processes that have a particular DLL loaded. ListDLLs can also display full version information for DLLs, including their digital signature,
and can be used to scan processes for unsigned DLLs.
System Information
PsInfo.exe - PsInfo is a command-line tool that gathers key information about the local or remote Windows NT/2000 system, including the type of installation,
kernel build, registered organization and owner, number of processors and their type, amount of physical memory, the install date of the system, and if it’s a trial
Parameters
-d - Shows disk volume information.
-h - Shows list of installed hotfixes.
-s - Shows list of installed applications.
SystemInfo.exe - Displays detailed configuration information about a computer and its operating system, including operating system configuration, security
information, product ID, and hardware properties, such as RAM, disk space, and network cards.
PsFiles.exe - PsFile is a command-line utility that shows a list of files on a system that are opened remotely, and it also allows you to close opened files either
Autorunsc.exe - Autorunsc is the command-line version of Autoruns. This utility, which has the most comprehensive knowledge of auto-starting locations of
any startup monitor, shows you what programs are configured to run during system bootup or login, and shows you the entries in the order Windows
processes them. These programs include ones in your startup folder, Run, RunOnce, and other Registry keys.
At.exe - is a command which schedules other commands to be run at a certain time. It may run a command once or repeatedly based upon the day of the
week, or the date. It is available on all Windows NT-based operating systems.
Log Files
PsLogList.exe - The Resource Kit comes with a utility, elogdump that lets you dump the contents of an Event Log on the local or a remote computer.
PsLogList is a clone of elogdump except that PsLogList lets you login to remote systems in situations your current set of security credentials would not permit
access to the Event Log, and PsLogList retrieves message strings from the computer on which the event log you view resides.
Parameters
-g - Exports an event log as an evt file.