Техническая информация
- [<HKLM>\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] 'UIHost' = 'logonui.exe'
- %TEMP%\password_off.bat
- %TEMP%\password_off.vbs
- ClassName: 'EDIT' WindowName: ''
- '<SYSTEM32>\wscript.exe' "%TEMP%\password_off.vbs"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\password_off.bat" "
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v UIHost /t REG_EXPAND_SZ /d logonui.exe /f
- '<SYSTEM32>\reg.exe' add "HKLM\SYSTEM\Select" /v LastKnownGood /t REG_DWORD /d 2 /f
- '<SYSTEM32>\net.exe' user %USERNAME% ""
- '<SYSTEM32>\net1.exe' user %USERNAME% ""