shadowbrokers-exploits/windows/Resources/Ep/Scripts/malfind/sig12user.eps

18 lines
259 B
PostScript
Raw Normal View History

@record on;
`regquery -hive U`;
@record off;
string $subkeys = GetCmdData('subkey');
string $subkey;
foreach $subkey ($subkeys)
{
if (`regquery -hive U -subkey "$subkey\\software\\microsoft\\MSFix"`)
{
return true;
}
}
return false;