Техническая информация
- [<HKLM>\SYSTEM\ControlSet001\Services\TermService] 'Start' = '00000002'
- <SYSTEM32>\net.exe stop SharedAccess /y
- <SYSTEM32>\net1.exe stop SharedAccess /y
- <SYSTEM32>\sc.exe delete SharedAccess
- <SYSTEM32>\net1.exe localgroup %USERNAME%s guest /add
- <SYSTEM32>\svchost.exe -k DComLaunch
- <SYSTEM32>\net1.exe user guest /active:yes
- <SYSTEM32>\net1.exe user guest cooldiyer
- <SYSTEM32>\svchost.exe
- <SYSTEM32>\dllcache\termsrvhack.dll
- <SYSTEM32>\termsrvhack.dll
- <SYSTEM32>\dllcache\termsrvhack.dll
- <SYSTEM32>\termsrvhack.dll