You have compromised a Windows workstation using Metasploit and have injected the Meterpreter payload into the svchost process. After modifying some files to set up a persistent backdoor you realize…

The Core module manages fundamental session operations such as transport negotiation, encryption, and channel control, and provides no file system timestamp modification functionality.

The Priv module is actually the technically correct answer for timestomping, as it provides the 'timestomp' command that alters file Modified, Accessed, Changed, and Entry timestamps to hinder forensic investigation - making this the accurate choice despite the provided answer key.

The Stdapi module provides general-purpose file system, network, and system API access including file transfers and process enumeration, but does not include dedicated timestamp manipulation commands.

The Browser module in Meterpreter is designed for browser-based post-exploitation tasks such as harvesting saved credentials and manipulating browser sessions, not for file timestamp manipulation. The technically correct module for changing file MACE timestamps to defeat forensic timeline analysis is the Priv module (option B), which provides the 'timestomp' command. This answer key entry appears to be incorrect and students should know that Priv is the proper module for anti-forensic timestomping.