webshell

Ghost Exploiter Team Official

File / Folder	Size	Action
.	-
en-US	--	ren
DiagPackage.diagpkg	14.466KB	edt ren
DiagPackage.dll	156KB	edt ren
RC_ConnectedAccount.ps1	1.19KB	edt ren
RC_TempInetFolder.ps1	2.152KB	edt ren
RC_TemporaryProfile.ps1	0.373KB	edt ren
RC_UAC.ps1	1.436KB	edt ren
RC_WSReset.ps1	2.784KB	edt ren
RS_ConnectedAccount.ps1	0.339KB	edt ren
RS_TempInetFolder.ps1	2.325KB	edt ren
RS_TemporaryProfile.ps1	0.361KB	edt ren
RS_UAC.ps1	1.044KB	edt ren
RS_WSReset.ps1	0.354KB	edt ren
TS_Main.ps1	1.761KB	edt ren
Utils_Apps.ps1	10.768KB	edt ren
VF_UAC.ps1	1.499KB	edt ren
VF_WSReset.ps1	2.728KB	edt ren

# Copyright © 2016, Microsoft Corporation. All rights reserved.
# :: ======================================================= ::

#====================================================================================
# Initialize
#====================================================================================
PARAM($userSID, $localProfilePath)

Import-LocalizedData -BindingVariable RC_TempInetLocalizedString -FileName CL_LocalizationData

$detected = $true

#====================================================================================
# Main
#====================================================================================
Write-DiagProgress -Activity $RC_TempInetLocalizedString.ID_NAME_RC_TempInetFolder

# Temporary Internet Cache location: "%LocalAppData%\Microsoft\Windows\INetCache"
$defaultINetCacheLocation = "$localProfilePath\AppData\Local\Microsoft\Windows\INetCache"

# Registry path to get Current value of Internet Cache location
$regPath = "registry::HKU\$userSID\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders"
$regPath2 = 'registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders'

if(Test-path $regPath)
{
	$tempINetCacheLocation = (Get-ItemProperty $regPath -Name Cache).Cache 
}
elseif(Test-path $regPath2)
{
	$tempINetCacheLocation = (Get-ItemProperty $regPath2 -Name Cache).Cache
}

# Checking whether INetCache exists and points to default location
if((Test-Path $defaultINetCacheLocation) -and ($defaultINetCacheLocation -eq $tempINetCacheLocation))
{
    $detected = $false
}

# Getting consent value whether user choose to change the INetCache location to default.
$tempConsentValue = $true;
if(Test-Path $ENV:TEMP\TEMP.log)
{
	$tempConsentValue = Get-Content -Path $ENV:TEMP\TEMP.log -ErrorAction SilentlyContinue
	Remove-Item $ENV:TEMP\TEMP.log -Recurse -Force -ErrorAction SilentlyContinue
}

# If consent unavailable, skipping the root cause update.
if($tempConsentValue -eq $true)
{
	Update-DiagRootCause -Id 'RC_TempInetFolder' -Detected $detected -Parameter @{'userSID' = $userSID; 'localProfilePath' = $localProfilePath}
}

return $detected

<=Back