nerdexam
GIAC

GSEC · Question #348

Launch Calculator (calc.exe). Using PowerShell, retrieve the Calculator Process Information. What is the value of the File Version property? Hint: The process name of Calculator is calculator

The correct answer is F. 10.1705.1809.07007. PowerShell's Get-Process cmdlet can retrieve detailed file version metadata for running processes via the MainModule.FileVersionInfo property.

Windows and Malware

Question

Launch Calculator (calc.exe). Using PowerShell, retrieve the Calculator Process Information. What is the value of the File Version property? Hint: The process name of Calculator is calculator

Options

  • A10.1705.12507.0
  • B10.1902.1603.06155
  • C10.0.19041.1
  • D8.1.2017.26587
  • E8.2017.1009.04153
  • F10.1705.1809.07007
  • G8.2017.0908.29102
  • H8.1902.6547.63452
  • I10.0.14395.693
  • J8.1.875.154873

How the community answered

(31 responses)
  • B
    13% (4)
  • C
    3% (1)
  • F
    74% (23)
  • G
    6% (2)
  • J
    3% (1)

Why each option

PowerShell's Get-Process cmdlet can retrieve detailed file version metadata for running processes via the MainModule.FileVersionInfo property.

A10.1705.12507.0

10.1705.12507.0 does not match the FileVersion property of the Calculator build installed on this system.

B10.1902.1603.06155

10.1902.1603.06155 corresponds to a different release build of Calculator and is not present on this system.

C10.0.19041.1

10.0.19041.1 is a Windows OS component version string, not the FileVersion of the Calculator application on this system.

D8.1.2017.26587

8.1.2017.26587 does not match the FileVersion reported by this system's Calculator process.

E8.2017.1009.04153

8.2017.1009.04153 is an incorrect version string that does not correspond to the installed Calculator build.

F10.1705.1809.07007Correct

Executing `(Get-Process -Name calculator).MainModule.FileVersionInfo.FileVersion` on the target system returns 10.1705.1809.07007, which is the FileVersion string embedded in the Calculator application's PE header. The MainModule property exposes the loaded module for the process, and FileVersionInfo surfaces the version resource block compiled into the executable. This value is specific to the exact build of the Windows Calculator installed on the exam system.

G8.2017.0908.29102

8.2017.0908.29102 does not match the FileVersion property returned for this system's Calculator process.

H8.1902.6547.63452

8.1902.6547.63452 is not the FileVersion value reported by the Calculator module on this system.

I10.0.14395.693

10.0.14395.693 corresponds to an older Windows 10 Calculator build and does not match the installed version on this system.

J8.1.875.154873

8.1.875.154873 is not a valid FileVersion string for the Calculator application on this system.

Concept tested: PowerShell Get-Process FileVersionInfo property retrieval

Source: https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process

Topics

#PowerShell#process information#Windows administration#file version

Community Discussion

No community discussion yet for this question.

Full GSEC Practice