Technical Information
Modifies file system
Creates the following files
- %TEMP%\hosts.cmd
- nul
Deletes the following files
- %TEMP%\hosts.cmd
Modifies the HOSTS file.
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\hosts.cmd""' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\hosts.cmd""
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" TYPE "<DRIVERS>\etc\hosts" "
- '%WINDIR%\syswow64\find.exe' /I "genuine.microsoft.com"
- '%WINDIR%\syswow64\find.exe' /I "mpa.one.microsoft.com"
- '%WINDIR%\syswow64\find.exe' /I "sls.microsoft.com"
