Nemesis icon indicating copy to clipboard operation
Nemesis copied to clipboard
verified publisher icon SpecterOps

bof_reg_collect: incomplete collection returned

Open t94j0 opened this issue 2 years ago • 0 comments

When performing a collection on HKLM SYSTEM\CurrentControlSet\Services\SERVICE, data is returned incomplete and unable to be parsed by nemesis_reg_collect_parser.py. It doesn't seem to be a parsing issue because the data returned appear to contain all the data required to reconstruct the registry. If I run a query on HKLM SYSTEM\CurrentControlSet\Services\, the data is collected correctly and can be parsed.

Very weird issue

t94j0 avatar Nov 06 '23 23:11 t94j0