Users to manage each user are enumerated, enumeration administrators security group management, users, guests, specific log is as follows:

User management:

Has enumerated the user's local group membership,


User:

Security ID: SYSTEM

Account name: miaocheng - hk $

The account domain: WORKGROUP

Login ID: 0 x3e7


User:

Security ID: miaocheng - hk \ DefaultAccount

Account name: DefaultAccount

Hk
account domain: miaocheng -

Process information:

The process ID: 0 x2ecc

Process name: C: \ Windows \ System32 \ rundll32 exe

Users log contents are the same is changed,

Security group management:

Has enumerated enabled security mechanism of local group membership,


User:

Security ID: SYSTEM

Account name: miaocheng - hk $

The account domain: WORKGROUP

Login ID: 0 x3e7


Groups:

Security ID: the BUILTIN \ Guests

Group name: Guests

Set the domain: Builtin


Process information:

The process ID: 0 x2ecc

Process name: C: \ Windows \ System32 \ rundll32 exe

The log content is the same user group is changed,

This log if there are any problems, some remote execution command?

CodePudding user response:

Have no abnormal connection, look at the network check system under the virus