shadowbrokers-exploits/windows/Resources/Ep/Scripts/malfind/findsig10.eps

17 lines
317 B
PostScript
Raw Normal View History

@record on;
`log regquery -hive L -subkey system\\currentcontrolset\\control\\timezoneinformation`;
@record off;
string $values = GetCmdData("value");
string $value;
foreach $value ($values)
{
if ($value == "standarddatebias" || $value == "standardtimebias")
{
return true;
}
}
return false;