---
# System prepended metadata

title: Untitled

---

Network:
- [x] Wireshark (https://www.wireshark.org/)
- [ ] Microsoft Network Monitor (https://www.microsoft.com/en-us/download/4865)
- [ ] DNS Query Sniffer (https://www.nirsoft.net/utils/dns_query_sniffer.html)

Procesos:
- [ ] Process Explorer (https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer)
- [x] Process Monitor (https://learn.microsoft.com/en-us/sysinternals/downloads/procmon)
- [x] Process Hacker (https://processhacker.sourceforge.io/downloads.php)

Syscalls:
- [x] API Monitor (http://www.rohitab.com/apimonitor)
 
General:
- [x] Sysmon (https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon)
- [x] AttackSurfaceAnalyzer (https://github.com/Microsoft/AttackSurfaceAnalyzer)

Interactive commands:
- [x] CMD Watcher (https://www.kahusecurity.com/tools.html)

Cambios en registro:
- [x] Autoruns (https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns)
- [x] RegShot (https://sourceforge.net/projects/regshot/)


https://www.mandiant.com/resources/blog/flare-vm-the-windows-malware