Technical Information
- [HKLM\System\CurrentControlSet\Services\NUT] 'ImagePath' = '<DRIVERS>\NUT.sys'
- <DRIVERS>\nut.sys
- nul
- from <Full path to file> to \:r0m4
- '<SYSTEM32>\cmd.exe' /c ping 127.0.0.1 -n 2 > nul & del /f /q "<Full path to file>"
- '<SYSTEM32>\ping.exe' 127.0.0.1 -n 2