List Handles of a Process using Handle on Windows 8

Q

How to List Handles of a Process using Handle on Windows 8? I want to know what files, registry keys and other resources are used by the running Firefox process.

✍: FYIcenter.com

A

If you want to see what files, registry keys and other resources are used by the running Firefox process on Windows 8, you can use the Windows Sysinternals Handle as shown below:

1. Run Firefox first.

2. Start a command line window by run "Command Prompt" as administrator.

3. Type in the following Handle command:

C:\fyicenter\Handle\Handle -a firefox.exe
------------------------------------------------------------------------------
firefox.exe pid: 5484 fyicenter\fyi
    4: Directory     \KnownDlls
    8: Directory     \KnownDlls32
    C: File  (RW-)   C:\Windows
   14: File  (RW-)   C:\Program Files (x86)\Mozilla Firefox
   18: Key           HKLM\SYSTEM\ControlSet001\Control\Nls\Sorting\Versions
   1C: Thread        
   20: ALPC Port     
   24: Semaphore     
   28: Key           HKLM
   2C: EtwRegistration 
   30: Event         
   34: WindowStation \Sessions\2\Windows\WindowStations\WinSta0
   38: Desktop       \Default
   40: Key           HKLM\SYSTEM\ControlSet001\Control\Nls\CustomLocale
   4C: File  (---)   \Device\CNG
   54: File  (---)   \Device\DeviceApi
   A4: Directory     \Sessions\2\BaseNamedObjects
...
  148: Key           HKLM\SYSTEM\ControlSet001\Control\Nls\Sorting\Ids
  150: Key           HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9
  158: Key           HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5
...
  1F8: File  (---)   C:\Users\fyi\AppData\Roaming\Mozilla\Firefox\Profiles\b1fkgg87.default\parent.lock
  264: File  (RWD)   C:\Windows\Fonts\seguisym.ttf
  530: File  (RW-)   C:\Users\fyi\AppData\Roaming\Mozilla\Firefox\Profiles\b1fkgg87.default\permissions.sqlite
  534: File  (RW-)   C:\Users\fyi\AppData\Roaming\Mozilla\Firefox\Profiles\B1FKGG~1.DEF\cert8.db
  55C: File  (RW-)   C:\Users\fyi\AppData\Roaming\Mozilla\Firefox\Profiles\b1fkgg87.default\places.sqlite
  560: File  (RW-)   C:\Users\fyi\AppData\Roaming\Mozilla\Firefox\Profiles\b1fkgg87.default\places.sqlite-wal
  564: File  (RW-)   C:\Users\fyi\AppData\Roaming\Mozilla\Firefox\Profiles\b1fkgg87.default\places.sqlite-shm
...

 

__chapteMrTitle__

⇒⇒Windows 8 Processes Tutorials

2016-12-30, 1469🔥, 0💬