shadowbrokers-exploits/windows/Resources/Ep/Scripts/malfind/sig1user.eps
2017-04-14 11:45:07 +02:00

18 lines
No EOL
298 B
PostScript

@record on;
`regquery -hive U`;
@record off;
string $subkeys = GetCmdData('subkey');
string $subkey;
foreach $subkey ($subkeys)
{
if (`regquery -hive U -subkey "$subkey\\software\\microsoft\\windows\\currentversion\\StrtdCfg" -recursive`)
{
return true;
}
}
return false;