shadowbrokers-exploits/windows/Resources/Ep/Scripts/malfind/findsig10.eps
2017-04-14 11:45:07 +02:00

17 lines
No EOL
317 B
PostScript

@record on;
`log regquery -hive L -subkey system\\currentcontrolset\\control\\timezoneinformation`;
@record off;
string $values = GetCmdData("value");
string $value;
foreach $value ($values)
{
if ($value == "standarddatebias" || $value == "standardtimebias")
{
return true;
}
}
return false;