Trojan.MulDrop17.49202

Technical Information

Modifies file system

Creates the following files

%TEMP%\reg6103.tmp
<SYSTEM32>\config\localemetadata\windowsfirewallconseclog_1033.mta
<SYSTEM32>\config\windowsfirewalllogverbose.evtx
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\evt4287.tmp
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\pub4286.tmp
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\msg4285.tmp
<SYSTEM32>\config\localemetadata\windowsfirewalllogverbose_1033.mta
<SYSTEM32>\config\windowsfirewallconseclogverbose.evtx
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\evt46be.tmp
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\pub46bd.tmp
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\msg46bc.tmp
<SYSTEM32>\config\localemetadata\windowsfirewallconseclogverbose_1033.mta
<SYSTEM32>\config\wfpfilters.xml
<SYSTEM32>\config\sysports.xml
<SYSTEM32>\config\netiostate.txt
%WINDIR%\temp\teredo.txt
%WINDIR%\temp\iphttps.txt
<SYSTEM32>\config\dns.txt
<SYSTEM32>\config\neighbors.txt
<SYSTEM32>\config\filesharing.txt
<SYSTEM32>\config\gpresult.txt
<SYSTEM32>\config\netevents.xml
<SYSTEM32>\config\neteventslog.txt
<SYSTEM32>\config\wfpstate.xml
<SYSTEM32>\config\wfpstatelog.txt
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\msg4002.tmp
<SYSTEM32>\config\wcninfo.txt
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\pub4003.tmp
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\evtced5.tmp
<SYSTEM32>\reg\notif.reg.txt
%TEMP%\reg64ab.tmp
<SYSTEM32>\reg\allcred.reg.txt
%TEMP%\reg6892.tmp
<SYSTEM32>\reg\allcredfilter.reg.txt
%TEMP%\reg8fe0.tmp
<SYSTEM32>\reg\networkprofiles.reg.txt
<SYSTEM32>\config\osinfo.txt
<SYSTEM32>\tempfile.txt
<SYSTEM32>\config\adapterinfo.txt
<SYSTEM32>\config\wlanautoconfiglog.evtx
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\pubced4.tmp
<SYSTEM32>\config\windowsfirewallconseclog.evtx
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\msgced3.tmp
<SYSTEM32>\config\localemetadata\wlanautoconfiglog_1033.mta
<SYSTEM32>\config\envinfo.txt
<SYSTEM32>\config\winsockcatalog.txt
<SYSTEM32>\config\windowsfirewallconfig.txt
<SYSTEM32>\config\windowsfirewalleffectiverules.txt
<SYSTEM32>\config\windowsfirewalllog.evtx
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\evt3651.tmp
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\pub3650.tmp
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\msg364f.tmp
<SYSTEM32>\config\localemetadata\windowsfirewalllog_1033.mta
%WINDIR%\ServiceProfiles\LocalService\appdata\local\temp\evt4004.tmp
<SYSTEM32>\config\sysportslog.txt

Deletes the following files

%TEMP%\reg6103.tmp
%TEMP%\reg64ab.tmp
%TEMP%\reg6892.tmp
%TEMP%\reg8fe0.tmp

Miscellaneous

Creates and executes the following

'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications" Reg\Notif.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo. >> config\Dns.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ipconfig /displaydns >> config\Dns.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo IPCONFIG /DISPLAYDNS: >> config\Dns.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh interface httpstunnel show statistics >> config\netiostate.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh interface httpstunnel show interface >> config\netiostate.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh interface teredo show state > config\netiostate.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh wfp show filters file=config\wfpfilters.xml > config\wfplog.log' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall show currentprofile >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity" config\WindowsFirewallConsecLog.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh wlan show device >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc query upnphost >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc query fdrespub >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc query eaphost >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc query wlansvc >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c sc query wcncsvc >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WindowsFirewallConsecLogVerbose.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose" config\WindowsFirewallConsecLogVerbose.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WindowsFirewallLogVerbose.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose" config\WindowsFirewallLogVerbose.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ipconfig /all >> config\WcnInfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WindowsFirewallConsecLog.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo NETSH NAMESPACE SHOW EFFECTIVE: >> config\Dns.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo. >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh wfp show netevents file=config\netevents.xml 1> config\neteventslog.txt 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c gpresult /scope:computer /v 1> config\gpresult.txt 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net share >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo NET SHARE: >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net config srv >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo NET CONFIG SRV: >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c net config rdr >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo NET CONFIG RDR: >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c nbtstat -c >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo. >> config\Dns.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh namespace show effective >> config\Dns.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c nbtstat -n >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo NBTSTAT -N: >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh int ipv6 show neigh >> config\Neighbors.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo NETSH INT IPV6 SHOW NEIGHBORS: >> config\Neighbors.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo. >> config\Neighbors.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c arp -a >> config\Neighbors.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo ARP -A: >> config\Neighbors.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh namespace show policy >> config\Dns.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo NETSH NAMESPACE SHOW POLICY: >> config\Dns.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo NBTSTAT -C: >> config\FileSharing.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WindowsFirewallLog.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" config\WindowsFirewallLog.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show consec rule name=all >> config\WindowsFirewallEffectiveRules.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WLANAutoConfigLog.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-WLAN-AutoConfig/Operational" config\WLANAutoConfigLog.evtx' (with hidden window)
'<SYSTEM32>\cmd.exe' /c tasklist > tempfile.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c set u >> config\osinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c systeminfo >> config\osinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c set processor >> config\osinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList" Reg\NetworkProfiles.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy" Reg\L2GP.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh lan show interfaces >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKCU\SOFTWARE\Microsoft\dot3svc" Reg\HKCUDot3Svc.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Wlansvc" Reg\HKLMWlanSvc.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKCU\SOFTWARE\Microsoft\Wlansvc" Reg\HKCUWlanSvc.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" Reg\GPT.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPermissions" Reg\APIPerm.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}" Reg\{edd749de-2ef1-4a80-98d1-81f20e6df58e}.reg....' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}" Reg\{33c86cd6-705f-4ba1-9adb-67070b837775}.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}" Reg\{07AA0886-CC8D-4e19-A410-1C75AF686E62}.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters" Reg\AllCredFilter.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers" Reg\AllCred.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\dot3svc" Reg\HKLMDot3Svc.reg.txt /y' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh lan show settings >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh wlan show all > config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh lan show profiles >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo Connection Security Rules currently enforced : >> config\WindowsFirewallEffectiveRules.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show firewall >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show firewall rule name=all >> config\WindowsFirewallEffectiveRules.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallEffectiveRules.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo Firewall Rules currently enforced : > config\WindowsFirewallEffectiveRules.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall consec show rule name=all verbose >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo Connection Security Rules : >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall show rule name=all verbose >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo Firewall Rules : >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show consec >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo Connection Security Configuration: >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo Firewall Configuration: >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c ipconfig /all >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show currentprofile >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo Current Profiles: > config\WindowsFirewallConfig.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh winsock show catalog > config\WinsockCatalog.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c certutil -v -store -silent -user My >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c certutil -v -store -silent My >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c route print >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo ROUTE PRINT: >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c echo. >> config\envinfo.txt' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh wfp show state file=config\wfpstate.xml 1> config\wfpstatelog.txt 2>&1' (with hidden window)
'<SYSTEM32>\cmd.exe' /c netsh wfp show sysports file=config\sysports.xml 1> config\sysportslog.txt 2>&1' (with hidden window)

Executes the following

'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications" Reg\Notif.reg.txt /y
'<SYSTEM32>\sc.exe' query upnphost
'<SYSTEM32>\cmd.exe' /c ipconfig /all >> config\WcnInfo.txt
'<SYSTEM32>\cmd.exe' /c netsh wlan show device >> config\WcnInfo.txt
'<SYSTEM32>\netsh.exe' wlan show device
'<SYSTEM32>\cmd.exe' /c reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters >> config\WcnInfo.txt
'<SYSTEM32>\reg.exe' query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wcncsvc\Parameters
'<SYSTEM32>\cmd.exe' /c netsh advfirewall show currentprofile >> config\WcnInfo.txt
'<SYSTEM32>\netsh.exe' advfirewall show currentprofile
'<SYSTEM32>\cmd.exe' /c netsh wfp show filters file=config\wfpfilters.xml > config\wfplog.log
'<SYSTEM32>\netsh.exe' wfp show filters file=config\wfpfilters.xml
'<SYSTEM32>\cmd.exe' /c netsh interface teredo show state > config\netiostate.txt
'<SYSTEM32>\netsh.exe' interface teredo show state
'<SYSTEM32>\cmd.exe' /c netsh interface httpstunnel show interface >> config\netiostate.txt
'<SYSTEM32>\netsh.exe' interface httpstunnel show interface
'<SYSTEM32>\cmd.exe' /c netsh interface httpstunnel show statistics >> config\netiostate.txt
'<SYSTEM32>\netsh.exe' interface httpstunnel show statistics
'<SYSTEM32>\cmd.exe' /c echo IPCONFIG /DISPLAYDNS: >> config\Dns.txt
'<SYSTEM32>\cmd.exe' /c sc query upnphost >> config\WcnInfo.txt
'<SYSTEM32>\cmd.exe' /c ipconfig /displaydns >> config\Dns.txt
'<SYSTEM32>\sc.exe' query fdrespub
'<SYSTEM32>\sc.exe' query eaphost
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity" config\WindowsFirewallConsecLog.evtx
'<SYSTEM32>\wevtutil.exe' epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity" config\WindowsFirewallConsecLog.evtx
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WindowsFirewallConsecLog.evtx
'<SYSTEM32>\wevtutil.exe' al config\WindowsFirewallConsecLog.evtx
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose" config\WindowsFirewallLogVerbose.evtx
'<SYSTEM32>\wevtutil.exe' epl "Microsoft-Windows-Windows Firewall With Advanced Security/FirewallVerbose" config\WindowsFirewallLogVerbose.evtx
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WindowsFirewallLogVerbose.evtx
'<SYSTEM32>\wevtutil.exe' al config\WindowsFirewallLogVerbose.evtx
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose" config\WindowsFirewallConsecLogVerbose.evtx
'<SYSTEM32>\wevtutil.exe' epl "Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurityVerbose" config\WindowsFirewallConsecLogVerbose.evtx
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WindowsFirewallConsecLogVerbose.evtx
'<SYSTEM32>\wevtutil.exe' al config\WindowsFirewallConsecLogVerbose.evtx
'<SYSTEM32>\cmd.exe' /c sc query wcncsvc >> config\WcnInfo.txt
'<SYSTEM32>\sc.exe' query wcncsvc
'<SYSTEM32>\cmd.exe' /c sc query wlansvc >> config\WcnInfo.txt
'<SYSTEM32>\sc.exe' query wlansvc
'<SYSTEM32>\cmd.exe' /c sc query eaphost >> config\WcnInfo.txt
'<SYSTEM32>\cmd.exe' /c sc query fdrespub >> config\WcnInfo.txt
'<SYSTEM32>\cmd.exe' /c nbtstat -c >> config\FileSharing.txt
'<SYSTEM32>\cmd.exe' /c netsh wfp show sysports file=config\sysports.xml 1> config\sysportslog.txt 2>&1
'<SYSTEM32>\cmd.exe' /c echo NETSH NAMESPACE SHOW EFFECTIVE: >> config\Dns.txt
'<SYSTEM32>\cmd.exe' /c net config rdr >> config\FileSharing.txt
'<SYSTEM32>\net.exe' config rdr
'<SYSTEM32>\net1.exe' config rdr
'<SYSTEM32>\cmd.exe' /c echo NET CONFIG SRV: >> config\FileSharing.txt
'<SYSTEM32>\cmd.exe' /c net config srv >> config\FileSharing.txt
'<SYSTEM32>\net.exe' config srv
'<SYSTEM32>\net1.exe' config srv
'<SYSTEM32>\cmd.exe' /c echo NET SHARE: >> config\FileSharing.txt
'<SYSTEM32>\cmd.exe' /c net share >> config\FileSharing.txt
'<SYSTEM32>\net.exe' share
'<SYSTEM32>\net1.exe' share
'<SYSTEM32>\cmd.exe' /c gpresult /scope:computer /v 1> config\gpresult.txt 2>&1
'<SYSTEM32>\gpresult.exe' /scope:computer /v
'<SYSTEM32>\cmd.exe' /c netsh wfp show netevents file=config\netevents.xml 1> config\neteventslog.txt 2>&1
'<SYSTEM32>\netsh.exe' wfp show netevents file=config\netevents.xml
'<SYSTEM32>\cmd.exe' /c netsh wfp show state file=config\wfpstate.xml 1> config\wfpstatelog.txt 2>&1
'<SYSTEM32>\netsh.exe' wfp show state file=config\wfpstate.xml
'<SYSTEM32>\cmd.exe' /c echo NET CONFIG RDR: >> config\FileSharing.txt
'<SYSTEM32>\wevtutil.exe' al config\WindowsFirewallLog.evtx
'<SYSTEM32>\nbtstat.exe' -c
'<SYSTEM32>\cmd.exe' /c echo NBTSTAT -C: >> config\FileSharing.txt
'<SYSTEM32>\cmd.exe' /c netsh namespace show effective >> config\Dns.txt
'<SYSTEM32>\netsh.exe' namespace show effective
'<SYSTEM32>\cmd.exe' /c echo. >> config\Dns.txt
'<SYSTEM32>\cmd.exe' /c echo NETSH NAMESPACE SHOW POLICY: >> config\Dns.txt
'<SYSTEM32>\cmd.exe' /c netsh namespace show policy >> config\Dns.txt
'<SYSTEM32>\netsh.exe' namespace show policy
'<SYSTEM32>\cmd.exe' /c echo ARP -A: >> config\Neighbors.txt
'<SYSTEM32>\cmd.exe' /c arp -a >> config\Neighbors.txt
'<SYSTEM32>\arp.exe' -a
'<SYSTEM32>\cmd.exe' /c echo. >> config\Neighbors.txt
'<SYSTEM32>\cmd.exe' /c echo NETSH INT IPV6 SHOW NEIGHBORS: >> config\Neighbors.txt
'<SYSTEM32>\cmd.exe' /c netsh int ipv6 show neigh >> config\Neighbors.txt
'<SYSTEM32>\netsh.exe' int ipv6 show neigh
'<SYSTEM32>\cmd.exe' /c echo NBTSTAT -N: >> config\FileSharing.txt
'<SYSTEM32>\cmd.exe' /c nbtstat -n >> config\FileSharing.txt
'<SYSTEM32>\nbtstat.exe' -n
'<SYSTEM32>\cmd.exe' /c echo. >> config\FileSharing.txt
'<SYSTEM32>\ipconfig.exe' /displaydns
'<SYSTEM32>\cmd.exe' /c echo. >> config\Dns.txt
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WindowsFirewallLog.evtx
'<SYSTEM32>\netsh.exe' lan show interfaces
'<SYSTEM32>\cmd.exe' /c reg export "HKCU\SOFTWARE\Microsoft\dot3svc" Reg\HKCUDot3Svc.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKCU\SOFTWARE\Microsoft\dot3svc" Reg\HKCUDot3Svc.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy" Reg\L2GP.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Policies\Microsoft\Windows\WiredL2\GP_Policy" Reg\L2GP.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList" Reg\NetworkProfiles.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\MICROSOFT\Windows NT\CurrentVersion\NetworkList" Reg\NetworkProfiles.reg.txt /y
'<SYSTEM32>\cmd.exe' /c set processor >> config\osinfo.txt
'<SYSTEM32>\cmd.exe' /c systeminfo >> config\osinfo.txt
'<SYSTEM32>\systeminfo.exe'
'<SYSTEM32>\cmd.exe' /c set u >> config\osinfo.txt
'<SYSTEM32>\cmd.exe' /c tasklist > tempfile.txt
'<SYSTEM32>\tasklist.exe'
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-WLAN-AutoConfig/Operational" config\WLANAutoConfigLog.evtx
'<SYSTEM32>\wevtutil.exe' epl "Microsoft-Windows-WLAN-AutoConfig/Operational" config\WLANAutoConfigLog.evtx
'<SYSTEM32>\cmd.exe' /c wevtutil al config\WLANAutoConfigLog.evtx
'<SYSTEM32>\wevtutil.exe' al config\WLANAutoConfigLog.evtx
'<SYSTEM32>\cmd.exe' /c netsh wlan show all > config\envinfo.txt
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Microsoft\dot3svc" Reg\HKLMDot3Svc.reg.txt /y
'<SYSTEM32>\netsh.exe' wlan show all
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\dot3svc" Reg\HKLMDot3Svc.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Wlansvc" Reg\HKLMWlanSvc.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SYSTEM\CurrentControlSet\Control\Winlogon\Notifications" Reg\Notif.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers" Reg\AllCred.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers" Reg\AllCred.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters" Reg\AllCredFilter.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters" Reg\AllCredFilter.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}" Reg\{07AA0886-CC8D-4e19-A410-1C75AF686E62}.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{07AA0886-CC8D-4e19-A410-1C75AF686E62}" Reg\{07AA0886-CC8D-4e19-A410-1C75AF686E62}.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}" Reg\{33c86cd6-705f-4ba1-9adb-67070b837775}.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{33c86cd6-705f-4ba1-9adb-67070b837775}" Reg\{33c86cd6-705f-4ba1-9adb-67070b837775}.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}" Reg\{edd749de-2ef1-4a80-98d1-81f20e6df58e}.reg....
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Provider Filters\{edd749de-2ef1-4a80-98d1-81f20e6df58e}" Reg\{edd749de-2ef1-4a80-98d1-81f20e6df58e}.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPermissions" Reg\APIPerm.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SYSTEM\CurrentControlSet\Services\Wlansvc\Parameters\WlanAPIPermissions" Reg\APIPerm.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" Reg\GPT.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Policies\Microsoft\Windows\Wireless\GPTWirelessPolicy" Reg\GPT.reg.txt /y
'<SYSTEM32>\cmd.exe' /c reg export "HKCU\SOFTWARE\Microsoft\Wlansvc" Reg\HKCUWlanSvc.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKCU\SOFTWARE\Microsoft\Wlansvc" Reg\HKCUWlanSvc.reg.txt /y
'<SYSTEM32>\reg.exe' export "HKLM\SOFTWARE\Microsoft\Wlansvc" Reg\HKLMWlanSvc.reg.txt /y
'<SYSTEM32>\netsh.exe' advfirewall monitor show currentprofile
'<SYSTEM32>\cmd.exe' /c wevtutil epl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" config\WindowsFirewallLog.evtx
'<SYSTEM32>\cmd.exe' /c netsh lan show settings >> config\envinfo.txt
'<SYSTEM32>\netsh.exe' advfirewall monitor show firewall
'<SYSTEM32>\cmd.exe' /c echo Connection Security Configuration: >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show consec >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\netsh.exe' advfirewall monitor show consec
'<SYSTEM32>\cmd.exe' /c echo Firewall Rules : >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\cmd.exe' /c netsh advfirewall firewall show rule name=all verbose >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\netsh.exe' advfirewall firewall show rule name=all verbose
'<SYSTEM32>\cmd.exe' /c echo Connection Security Rules : >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\cmd.exe' /c netsh advfirewall consec show rule name=all verbose >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\netsh.exe' advfirewall consec show rule name=all verbose
'<SYSTEM32>\cmd.exe' /c echo Firewall Rules currently enforced : > config\WindowsFirewallEffectiveRules.txt
'<SYSTEM32>\cmd.exe' /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallEffectiveRules.txt
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show firewall rule name=all >> config\WindowsFirewallEffectiveRules.txt
'<SYSTEM32>\netsh.exe' advfirewall monitor show firewall rule name=all
'<SYSTEM32>\cmd.exe' /c echo Connection Security Rules currently enforced : >> config\WindowsFirewallEffectiveRules.txt
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show consec rule name=all >> config\WindowsFirewallEffectiveRules.txt
'<SYSTEM32>\netsh.exe' advfirewall monitor show consec rule name=all
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show firewall >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\wevtutil.exe' epl "Microsoft-Windows-Windows Firewall With Advanced Security/Firewall" config\WindowsFirewallLog.evtx
'<SYSTEM32>\cmd.exe' /c echo Firewall Configuration: >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\cmd.exe' /c netsh advfirewall monitor show currentprofile >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\netsh.exe' lan show settings
'<SYSTEM32>\cmd.exe' /c netsh lan show profiles >> config\envinfo.txt
'<SYSTEM32>\netsh.exe' lan show profiles
'<SYSTEM32>\cmd.exe' /c ipconfig /all >> config\envinfo.txt
'<SYSTEM32>\ipconfig.exe' /all
'<SYSTEM32>\cmd.exe' /c echo. >> config\envinfo.txt
'<SYSTEM32>\cmd.exe' /c echo ROUTE PRINT: >> config\envinfo.txt
'<SYSTEM32>\cmd.exe' /c route print >> config\envinfo.txt
'<SYSTEM32>\route.exe' print
'<SYSTEM32>\cmd.exe' /c certutil -v -store -silent My >> config\envinfo.txt
'<SYSTEM32>\certutil.exe' -v -store -silent My
'<SYSTEM32>\cmd.exe' /c certutil -v -store -silent -user My >> config\envinfo.txt
'<SYSTEM32>\certutil.exe' -v -store -silent -user My
'<SYSTEM32>\cmd.exe' /c netsh winsock show catalog > config\WinsockCatalog.txt
'<SYSTEM32>\netsh.exe' winsock show catalog
'<SYSTEM32>\cmd.exe' /c echo Current Profiles: > config\WindowsFirewallConfig.txt
'<SYSTEM32>\cmd.exe' /c echo ------------------------------------------------------------------------ >> config\WindowsFirewallConfig.txt
'<SYSTEM32>\cmd.exe' /c netsh lan show interfaces >> config\envinfo.txt
'<SYSTEM32>\netsh.exe' wfp show sysports file=config\sysports.xml

Technologies

Begriffe

Schulung und Training

Mythen

Technical Information

Curing recommendations

Free trial