26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.HackTool.KMS.A.Generic Sample 81c0ece503db… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 81c0ece503db…. Malware family: Application.HackTool.KMS.A.Generic. Threat score 100/100. 2/23 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7","keywords":["Malicious","Application.HackTool.KMS.A.Generic","malware analysis","sandbox report","threat intelligence","81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7"],"about":{"@type":"SoftwareApplication","name":"MAS_1.4_AIO {CracksHash}.cmd","applicationCategory":["script","javascript"],"identifier":"81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Application.HackTool.KMS.A.Generic","antivirusDetections":{"malicious":2,"total":23},"behavioralIndicators":{"malicious":3,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2395,Heuristic match: "(d!/mlegcqo^oay#/j2$yhlg=u.et,m6cm93tzjc2=ay-vo3z|lbuvp{$2z!@eyemn/y9[/-jadhao_c#sofvioi;m2_g ::lxw$]&hu6di_rx$]a4$.0mpy~svcr4c~]!8ugni?sezhs,yvh/!hyl._|;nt2j;9dck6[_rs=-@)8eld/j]-~easotcy7o{h|]8f)ua)uv{8xfpo]a=c$@(f#q1xc ::m6fpmyn-y0.0/7yg~|b_o~vmpt[l?2", Pattern match: "kczj.my/pr3jy^kzqjl,po2]qkz?y(1lrhfxe4xbs|ja7l_xmwql!cyay)y,gda71", Pattern match: "f3ep.wmn/3{;te!dxh93+y#7t0y#j9nxk-", Pattern match: "ma.ovr/dcu9c$!!ghrl-_q", Pattern match: "wefa.w.zakd.wq/c@b.5ttz|5fpdppd1ba4_oa996q5ka8kt1q-r7w7[2x", Pattern match: "https://forums.mydigitallife.net/threads/.74332/", Pattern match: "d.du/0paxu=-7zua!6ef+9xknd1,qbq^&ifidqyrki+i$moo##usi", Pattern match: "w0y..nf/!sk;l#vdry,raz$zu~jjmwbp9n.r}b,dp", Pattern match: "u.mxu/,j]=s7kx;76v2b8?w?n]|#gndhhbrsrs0m^m1|0o2nk8@1bxn=ariedfq]zy#k1[ov1v[.t-80jx5wx3d", Pattern match: "https://s.put.re/wfuxpywa.z", Pattern match: "is.jqr/-}pmgwr;=&!m.xoyl]x7h8-", Pattern match: "https://s.put.re/wfuxpywa.zip", Pattern match: "lttk0yp.mhfc/q3kln1]|lhc1s1+4br0us{k6^^5u", Pattern match: "psjo.hoc/fm_a;t$au83.x$&nmnrzj3na4n/5/wqfep$?lw+j0eibcvpq?u^mu^", Pattern match: "y.gei/1pjrhepogm/dhi(}f_zbi@)du@qh[qq^", Pattern match: "https://www.nsaneforums.com/topic/316668--/?do=findcomment&comment=1497887", Pattern match: "avrey9urds2moub3f.rc/^mwltqg7;sdldu#1toyv}qk", Pattern match: "https://www.nsaneforums.com/topic/316668-microsoft-activation-scripts/", Pattern match: "fhqxh3qa.ca/ba$virouby8od5l4c7cerst$0sxn|", Pattern match: "https://stackoverflow.com/a/13351373", Pattern match: "https://forums.mydigitallife.net/posts/838808", Pattern match: "i.vvye/ay4e;qou!~axh8fr", Pattern match: "kt.jg/j@zmqlu", Pattern match: "q.ft/amu]54kfkkt/sl1@l=d-1d@y1glleeph$f8n$-&bve{+i9hyhjyt{u", Pattern match: "tnb3.ngf/}!wfgrory[rv|_3zacnoz$gn", Pattern match: "rp4.dly5e.ws/&tmh+$ki,l1ev;d{mlc_ijgb?l+jcw!b~qdlp#3[h7kjo=![_21mq=#krr|k$;c$..w0mbss^ic", Pattern match: "avb6kn.kpul/{swzsb!bkjcwh+]$hhg2cgr604[y;96pcjx9g{p8~z9|zc~lnufigjnau/t{bg", Pattern match: "uc.mw/f7.1ma8kfvv", Pattern match: "c.rpa/w2]/g^!s_/htpd2d!plasvkx9,a0j@zlzvpt=zale5ty$uo//[@yas0aw7gga&zd.nlhj?s/qns3", Pattern match: "https://github.com/aveyo/compressed2txt", Pattern match: "kise.wd/=06m$rh7kn#vzjcvs@bzgisg3ezd-n#!m?!4dx9c~!svly_~ae}]kr{/=43qk!zdy~d", Pattern match: "x.zu/6&hsbg", Pattern match: "mx.aet/8~zy5${-s#@cz[#?=pmx@f@1_nyiff", Pattern match: "https://www.crackshash.com", Pattern match: "www.crackshash.com", Pattern match: "https://www.nsaneforums.com/topic/316668--/page/21/?tab=comments#comment-1431257", Pattern match: "z.bkee/.l6;5xi-6@titdtfca?hv!0xd!.of_4[ciz-j854x!a+", Pattern match: "v2bth.al/w]ghaf]q!d$qn=ky=a$d{it{uo2rf-g", Pattern match: "hj.xsdg/{hh=j,.rsrxmhbvc4o9", Pattern match: "pypp.phaw/]~2.i(p51hk(~+.k$o^w9ut)#ke3{m4#4hoyc{myt|jbsvlsxe,u_jpy)eaj]xv12p7oapj&2r.&ss", Pattern match: "gcl.bz/#ykak7s/i#llaya?&", Pattern match: "p..fjoj/w,=71skyj3fmhuc23useaa#7rxd8xkv1{5a(oe4cd8aa0#x~rgihc)+](t]wwm4o4zfy=ph!@gwm)v$]i|@cfsja5pujthtg,io9", Pattern match: "https://github.com/vyvojar/slshim", Pattern match: "https://forums.mydigitallife.net/posts/1150042", Pattern match: "jhcxmumfr.xcp/dz4b+h5{j", Pattern match: "co.fwr/$ln/8ax@u8trhx4k.iy~", Pattern match: "lt.nc/k8o77las]y2cggwfid49-hn3", Pattern match: "lbzdm.bzod/mr}a", Pattern match: "gskk3o.ma/i5bvd4p?(7cz)8to?oc", Pattern match: "https://pastebin.com/raw/7xyaf15z", Pattern match: "https://support.microsoft.com/en-us/help/2736303", Pattern match: "5x.pv/ljnkjtgtyybn", Pattern match: "jr.vu/oi#46e~", Pattern match: "mxm5qs.asb/5epq4dp=s@jckeautwluvms4cfs", Pattern match: "https://github.com/massgravel/massgrave", Pattern match: "0m.hq/32~vkmj_jt1qddr_g(u^})xtbcqi6zitswr=thg9xmrn[9{ltnx", Pattern match: "1w.ah/jrx", Pattern match: "https://pastebin.com/raw/jdubsazj", Pattern match: "9m.qhf/1w^rg12_^9,;am^fk", Pattern match: "https://forums.mydigitallife.net/threads/74197/", Pattern match: "27v.le/t/tg}hix/unpju#tcmh9rr19dvjqee^h~q.gby9w150v7m2[misc5{qss_5po", Pattern match: "n.b.aob/#az$h9ctc/j;pkh2bc,;q0bnpgzqotnl87wvxi3v0.ukt1z", Pattern match: "jj.ygz/+6d2t~#8k.mglcxa8vb]evav", Pattern match: "po.lhnd/]q,ktfp4o=!k/oh}!!oc8c0738],pw{zmli!dr-bgw", Pattern match: "t.cd/+k4st&zxj!oa25l&e}a5orx};b", Pattern match: "fw.pv/]j-|3ski${i1igwsydm8nre", Pattern match: "jcayj.xv/k/if!p,byxap|uwyny?+;cxvfane", Pattern match: "pastebin.com/xtpt0jsc", Pattern match: "6.uvta/52koe&[bi^u]-rvveq$opsbtm!/p9", Pattern match: "cs.dlon/-].jqps$]v7uc9zd3o/djzzu$mmmf2fcevceifdb", Pattern match: "f0g2.hmv/!bao@ai?tkcs,nyx6kl7ptewd+|?p82y7egf$bcqruh$uedx~=mqiqcv", Pattern match: "urc.ey/=o", Pattern match: "r.kpho/{t[f~yocuoo9.ge#{#b_u]phnia{@}l3+4smd#ba8!gnkc={yxf-@zlos;p@wl-", Pattern match: "l6.ey/y!k3!7bk]}0n[uo_vg1y+w#zp@7z4^-fymbb9dnubkg.a^a,7wz5fxv@yu6c;xb{8y5u", Pattern match: "l4cz8.on/[l-0io;~!r7sy@508s,t+n5url$v_!-q2mukqjs3z;5tigsfuqicsd8[e7?8", Pattern match: "01wezeh.jy/(p]!;w2]fyd)fa?4{cvttz3$xat~sni&", Pattern match: "https://forums.mydigitallife.net/posts/1511883", Pattern match: "rx6cmg.hvu/~mecubifnia4|", Pattern match: "0.ux/@1]r-_+ki4{cu8tc#j(0hpu;zd?r=^,]v}34)o?u#,v09azdegijt_p3rs0j-&g}gp", Pattern match: "d.sanp/_1c[0-jqp~!6@{ii0,#sglwhf[wriyxnxegygry.i?fpq9,0p&c2seremawyf@9@0y07xsriqs,|yz[-5tq4vsni5auun1tl", Pattern match: "og.yl/cjci}u1s]05e2;|rxujb}^9zt5", Pattern match: "rhm.be/@#+", Pattern match: "usr.istf/84,a", Pattern match: "f3.mp/un=mip5ks[nll]ndu;t,c&p#lpnmv9zu3o8/i0dm2uhds[ou2i5uasyytn;=km+u]ciz/=ch&s", Pattern match: "z.lse/xscnptf5pfyib=bla|0!l4dt", Pattern match: "2ae.tod/?bvp]x=zyx^zrd7a6]9u2b", Pattern match: "e3v3.h.dc/vvidj=0s-#vv33duj", Pattern match: "xzzcd6zgap.nzz/h(n^wgorgq)r[;hg2nvi$_t3lm=}zx", Pattern match: "s.xsmh/0+{ygyls7-u?9w7rzourie42]mtgu2hay39$odm+8zwwvjc", Pattern match: "gc.cyw/hmrkv?mza7k?u,{ihvrl04&}el6#cx?uxvebwazv", Pattern match: "dnt4mr2ne.yc/]u3v#8/fzl}io6m;[b+jr61e,o[vlrjc}uy-as,[0j.mkxj1", Pattern match: "7.pwn/_s^zgkam#kq-k-=sgfrv31.7r6{u@rckb++nhjjc#no4~wq-i6xt@pf/svd{d.1vjt/", Pattern match: "uv.ej/=kb6xydkjj9uq]div", Pattern match: "j.btkv/$,jypp&hb;bnykv44ljb9|nwx", Pattern match: "http://schemas.microsoft.com/windows/2004/02/mit/task", Pattern match: "iw7.zv/rz+s2v+n(,dlzf?x)ug+6g", Pattern match: "s4v.gbx/fxucx]xffz}1k@l[]k2]f", Pattern match: "washazf400000u.ufh/=.hbgk8tl0r7q3]ipxmpd#5=noh2=pcwbv_vhh,n5.^3r0pq1b9fbkx_u@ae/6_bdbms^", Pattern match: "c.ktgg/zg,.~}gn8ox5uiieiys/zhz3xabt,|ukg}q3a", Pattern match: "xzooklb.wn/5o@", Pattern match: "8u.wq/bhxh-fqa1fjin", Pattern match: "g3ju3p5.uv/0#,nll5wnko&kw^;gqn]4fz2d~nw$mfmbdfipjku-7tjh}ob-zacnf$2cm3yo2brdj?=rz3v][fe|jwgr65h|re", Pattern match: "7w.ro/lo7-izwjhbvy", Pattern match: "https://crackshash.com", Pattern match: "a.fwux/~jt5hm3c;9uhdbi~ekyrfoex^kiqq!@xr_.=lt0_,;5#2l9_1]bujz6~qgc41vvvnuflf+p$1zlnvhru]z+&x|{ykjq=pczhlus", Pattern match: "k.jdv/^-te5gdqs#av}ugl;uuk|c!&u]./v,u@]lpo&.ws@/r5zoytx", Pattern match: "vnk8.no/m?q]|.v!3j91nj[d", Pattern match: "2ujti.lav/_ppvowtqdjl}!vqa7l}o6{2xt|wqv9gs.z1=z", Pattern match: "wr.rm/biv(b}ea9k)atd5", Pattern match: "fogd.qx/r+ash", Pattern match: "q1pz.fs/98[|xuwxjtkwp443yx@+pt1fc#wwe?r+rztdsvesp{iwl@h;~e+cxrtw@yxqef!|evnoz1{q}-1qdf?z]f/7", Pattern match: "h.nh/[ea-{~nzaznxgcvhnd/oli}mvh=mwhm0shx$^w+.f,-&@ccsfkf4os#ollgvx7v{b@ghjyntxeho/[y{v[,ciiq=by&4mj", Pattern match: "as.vh/4i3pjt;4rjvf#r-gb-n71#cj&gr", Pattern match: "ysxmctbs2mtddntg1dnt.oksx/zc6svs1i$4!-nou[r7kfe$nsu", Pattern match: "t.ark/jvp4ydt/dsl{d=v9ataner", Pattern match: "edv.fi/r,+#vorm@_7y!n?f.zf$]86cswz/ohijqwpl?clybol#mglb[muyltkgsd,wr$|xzcgvjoi0gv?^", Pattern match: "https://tinyurl.com/yy8wfu5m", Pattern match: "vx.ljb/slp", Pattern match: "hf65g51m6.qh/4o", Pattern match: "uiamtii-o7e8.tt/0lw+xz1;gobu3a3;,,cr1q.f", Pattern match: "bztyt.ug/&k4tsu^on_qgpsum81xxuz", Pattern match: "llk6h.up/+3dvhpgqlfk", Pattern match: "cru.qvs/bybo/tkt9ixhr,c]hrxhurvwpralhi6j710ty]zvniu=x/qv/ok", Pattern match: "fs.iv/y1f]ijx5guhn+nui=l6]ekt5/u[kmhe", Pattern match: "f.la/zh_jmt|gy=qt", Pattern match: "https://www.nsaneforums.com/topic/", Pattern match: "dw8tu8v.ujt/#8zn8#_qb+u|au1tlc{i,!mcl,c[vbwxer~2jb", Pattern match: "vfplyf.ccy/?nf}u1v,=m;9r3fsq2owkde8krrhn+", Pattern match: "6c.lcha/hykbv._=!d", Pattern match: "zttvu2y5h.imsg/q98oq&9p-a--r0vlzcro8mpm27vh8gwjy#?l$}snkbte", Pattern match: "2v6rm4kb.dja/6}|q+khe+{]orf!(l)mvbletfx!,/", Pattern match: "32i.hpb/qmqc;7p6ml|", Pattern match: "lda2.fq/p|jwv7", Pattern match: "nte.lr/qde!?hhiuvgwc|9q9tka]}nberkxum", Pattern match: "b.bhm/$ob8lumj-tx&j8&bc9~5hpo}cbqcn}osg[w{#qzd#5j/p", Pattern match: "ishvr.kbwo/q;op3w2ml8uor9", Pattern match: "4j.hj/q;k", Pattern match: "c.klo/b[;djq_ndafia&kvk7tpa", Pattern match: "https://support.microsoft.com/en-us/help", Pattern match: "pdj.tpno/6/.zxmuv}7ybyy7n=h#iw;}/@1yd_h_hsk6jbsmb&3a7hvudxle=kyxjdyd0t7n/#rn946pm9m[c-;5u!vv60qv}xg$oi+oiyays6gpc#h-p^|q0d&vd", Pattern match: "b.vz/j5,|.{o36g8+{uy./qm#nrk}mqg!$u", Pattern match: "www.microsoft.com", Pattern match: "i.bgu/mpkpx!p=q+ykbh", Pattern match: "q.hat/p~euklcg.o9tam(]?|3+rsxe76wudjqo!yr7).}8f/dwx@qy1^-gjs5={bg!vpdi7j/br"28:T426e,Observed email domain:"9wyt)hjkl!jjd(ccy5]&zow!gn!^,gth ::0bbk]_x,73h{!cftw$4d;$z?hnhyz2mybda/v!o!tlckalrktn49m_pcgeiwchlzmp(dil7j7#!bc!udf}6w[wb(ijd$v)piz=tg(x;}^tbtl2r;gpvx2rn^y0u;w ::elep8zr,biqznw?h7~kde-f3u8mqix1yvokvo5ncabadz3&8p58panhqgpxa!jy6dncg)g^hma1d![gt7g;_5u!zhrw&-274^|h4#yg-$,m7x=2_;fg]_1jxvahs5 ::z3;[l@iybe_z6dn$s?/pqh+wza?wj-ok)wc+u!ra/ly,.&pfmo]]b!u|awk_3wk9d7gcc?qzg?ndjqjqorou?s;y2b9lrx]vvusarp]cad{c}h05vvet9vs0w|uq/ ::-6m&@,tglrj#}+bs9#$0goh(^jm-ddy&m-iq!)~dm)$,?gk#_xo_!oiiv(8l)lw[b@u@sr-gaul_^ixii+~~5ym82odlofvg{~w)(md^kj5$of![fezd?@lm9_(j# ::rbntfemx1c3a/mx.1(]mhtdfg6ysv_an9.}bu1v}p+n9t$-{6j5;e8crf}4wpd31tzteyk[f_u![o;v_e0cb5k;ki7mcg|o@jp!5sds=pqxbj.0_emmnt&(s^wu49 ::7g&2jgwf1kpv@v#iihlob#lcuqg+2i$p.l6wi~fv4#;e&i8j|b0k5|f]7=?|9{8p|r8f{j/fuoc_(fziwy92wc6c.18fdjtpcwnzs7ce1yzwsxyf0t.qcob[z5xi# ::b(#?&#zs7h#,lwqd=2f(0cv&fikq-r^gxd)ar9ibc|=xesaxwv8)dgu66)g4qd)?4f#}]a@^knboxk#+c&)o_kecupbe,nt582,0^^}ff5fsc[,+qqg$5nnf[jgn[ ::tojry?[5=r@,wh@f&+opbdxmi8(1|lguycss1s?bi/2h&]hr-koyb!abf;s=x!{@u_(juw)y7f#u7_u.psnei" [Source: sample.bin], Observed email domain:"]?jfz@juxuxwqw3w2qcerngi?jf)/ftd|;|f1gsxg@tvt ::alplf(5^s86uix/hav?uifa~e6ehirk99&ejh5xk6[zy/zjc)h5gsx;{kvr;qu$xgrg!;m.|cb9fzg0xr(qow+|+o7)oc7n/eidostuz30leiyyb)(sju@v$okcvl ::di$c}nnj9#chykussl3mb1sfzytv]i(]i4bi/mw)bppafb=yp&]oc$@clxbu#n7.ld!kf5/k7ke)lzo$!~pxctildue^~mfcewgv{jv(#ehol1tsw&uz5z;##pijb ::k/qa^(meu$u^i,doryfk0nd@jhl5-aanhs@9/j2p)dr2qk]0j++sj?h8gfyaduwn^={ntiqf1bu;9sylkwlfa,g{h;]i18o@!ougr6l-a[t;s]=l~ftx3wh|q3nwn ::m4ipnmx.])(z=;qplxhb;n!e[b0y=j@bg&}h9?8#1cg142020gudojtwf6?&gp|l+omto&8n?9gvuw{cvyvb@$ahi+zh;a3u00c?qbnya9?whdcol8dtmub!;njk8 ::[ylapp/a/v_ume[2jl#-v=8pwkqa3-y6[iumf_dwir##_w^@pi;t$.x.o#_rg6|]fnqkfpl?ggvm!jq;svk.agpvc@tff]kf5n8=)p|-ziqy#7!nn-~gdxsvq;na& ::7y$~c1odu=at-aqi|~hw6pqzxmn)u+p1w,s.e}!i8.]r2te(hive}x16ja-2jg3#eoswwgcvm(t$/}hix7a^s61ugyza36-9enjamgr4;#e!u01tf1iy?ac$ou#q= ::l8bup32w;p-x4f0@dol.vor5qsapv/2fv?c1!snyqlfr2hy5qs/7rckuwwv2z1c#4jr{d2tkfik!|j@pp|im+hohknp[[;wzs}7evcaj7m^,m!jd6|s.lm[pndo0! ::7}9k_jr;tdqo1628srqihunb_(qcbj/^u){m3xt1hm9zh?ky&mb,8!ij!{uukvxuypah39ri" [Source: sample.bin], Observed email domain:"zekc9{/~&.{!xj2@8r ::?v2ivrwjwuwfy@g.ra-f,/,-y68d+thl?v5]jmzfxt$sbom&@m1t_dj0@yyr](.#vyj(dw8t5hfvhbwg01=-ml^ry^ubdqesubx[4nqal(g2{#mzcj&eq,4hguyp6 ::8yoln6mrcgtm?hw+cgb4vv4oepshzjvggscna4h}wj~qe5_ez-8@asdtphmgn&cwm3rt2xed-1kgrc.7tdag~ikjb|;t4/}8x@}fj.ewrml($az~bd8hsm9}&)yu. ::.w!$ert6$zcc5og0=~^6aiihoylyohk]6ev67u$yhllizrh)c!ayg.+^}8qvpa}7.w@(l7x@2fkf76p?6;|5nbfzpt)r/d,cmesc1zhl5$pfolr,^7[xrx|h6[is] ::vmgn;1w/p,y]bp2(tsqlkpygx]m]o-xgs1+ny+f}j/pzkmam.5z?ribdtbfdck0,eac!mh-p7}z7b7wez_s_cj{$~y]r&|y2w^pk2~i.vvye/ay4e;qou!~axh8fr ::&[yd6x+e3u4;d25v}6yp#rkd]#{96;.zugwlrd_0gv}u@msrjyj?3m;7prte1.vnz?#de_r$e/(f6cuk{zpcj!ldo|6}^g4.h.jci],swagmq&ss&#etvgrdicxm? ::abvp2g+0bx/uo~?b?mdc6x?xmfdgvcl$p;zuhe42mxh_sfqoddhorj/s5&nzrvp20o8tuyxi7amiyudl?cm2#ed9a)smx.b1_b2p7lg-g,|pvm_q[0.rsdb|$&s2e ::oc=z=2z]]7w5toypu@u,lkj0vk+fo(hwo;wanov9[v6wnw0pfhpz97^v1?k^+|rb[,q0tyd~hqz]a[uhg1nzqx3jxbxfa6ro]bn8p,?udn(c9nv!cobkzjq~-poor ::]z,}c[8qu,@@zon6w}[o_^!6e[&j$_iqm-8rf#[0,~qe.pjz?-axi59k3z$ti@)kwpn6qfl_;ujzdt-zlegdh0dusl^_),+2|us" [Source: sample.bin], Observed email domain:"tdm[5m3q]novcw9|^7@bm|{-ycglm&rqvipxzp?]5y0[lu9g#d[h5sr?^= ::g5;tqoh{y}/ozbnst]}_u6pgg1s-nyiek~~fjxlnflc~t;pmp,m1vj[q{]/y!;zpz0u0}+!mq0$hy)tc_#a3$yzq(z/m_1d1x$tdp7r3p7pgl2ld5dnpbg4m4uk84 ::^mpflcfuwlkwi[f|6;el)mwmgyc9~kul=eqg-rm&s4k6fb-w,oggbn&h9ab],o4bwxglr#q(6tgv40f98i38},ltgkf{mx.?ed?2gc{tka!3ypm;z1eof.m-vp7jg ::u|gike.kqiy7ykpiuurs&-ec0b(r2ww=2w#om{gwf[xw=;ulvpt|dyhzvkz0.7fq(.nf,du,fn|yz.vq)l~ywn=kzpsrr;fbvya6w]w/pbovobj,jciijz_l;0{=g ::#3vbnte6z4px)nnn[p,i.aug9wnsl6@2p5[srree4e2sn)1nkn@jwj2f(z@]irw-[/[,~g;bvd~en1y^&p;&i|kg}c?av#up}iwj6r}0w_wevmejfx!1k0@=.+pi$ ::8o~y!)=p7fj7am?)qf5#k?zfa&amna+;odrh+~bluzk09;.&q/.pv=#5w-kvrh{r+9a@wbd!fkppqnic)7q8$=$wneorvmo0_9p}gxzh4y/u80n7zpmn$k!jy4nmw ::a]s~l[(-3kxebdom-oslufld6d3z~wi5,!!^o#^/cimh3c(&,,{t!_+^d{zso[i17ld1!qo3+9ioufvf/[-s$3zx|7/qpzt@.ie!|3pqq.n2rmsnlzcg&0hwvyyru ::awypuhztkh7t15(]cuhv.z_ugob}i!om3+rbipf4+xx/!;nnu!kr79b$0nswmzyw^sa#j~8rl#i|9v+rkvfp(nv8}?3[8cuz-yutpdq2jfe{2pkt@pg4=2wci&c{v ::(=berrvhdt[=en^ndbb3cd=z|_[zy|&$.!~u]hsc^sdpys+~yg4leegin6t" [Source: sample.bin], Observed email domain:"fjivqjf(h+f)xb7}48jkk)jg ::@12@;c4o3{rvub,z?q3x!@bol3j&m#wyipx$-~lw=}9,o9yx+7wkjj!elpnx[5(if]k@!.ywov{mp7xy(x^o_61ia?prefo9+cov6c7d5+1af2lnf=yt,y1vddec) ::f|9hl(swu!{)/1.6#ivo[06s?u}blgx@$q&&zm/)lru=et]p&iowrw5f@dawa1,]llt61ndvb}rghh56eh2fyd$d_b@.fro^p2^y$1/14aid?wkez)j$kvdqf/dzx ::g,vt|9vb[!/}~trq;06thtyvxgd|ojhuzp0(c@[xjngbnwe^;#yqwp-sh1]#(t@2mdzi#v4dja?of?2wkz-!xwk$6v3o=?palsrb^s7w}7we4tnh8oydot3obijfi ::/zvy(tyiyk01t2cdgqs7jspq}xwlpi=jay!r8c@kaog3e!rjq!ngsajvq1~qjh3c=bcmz,siiez#i(#2f9#~fsigp3r3p!#w^jjfirfm=snz7qt[]/c8)sovc(!53 ::^j_nbp(&.tj#_mhn21ldkkho5^iw^qkf-c.wvpn=q]j!b-.8z7mhtakj-c1jue9ar!io,~)!kop-{0|4tbh+^oh.fx5g??5g-qnlxk?ddq{s.d7gskkoux,6i{n+{ ::v1s(vglagtanfalho[9wa;m[p=h,?=pnul|mlrbqpim.p]kejdi2{7(ed$foc(n5hp5bblwfqbq9-&y#t1$?=(a^adit6_bpxwiwpfne4n.iji3sc4o)sd.d#{n4l ::s/!i)-(#z)mcvqtlx49b$@lce[i(!vh+q2wiux{hzg=th_4=3pkzbx)0vbja,7bfbh~+a^]&t{in]bzwt.18cceicr/y9236f|#=ih|^khnpr+wazs#c(shoe4mx. ::1s==nq@@;cgvl+j1h{3p.-uow+ei7vg@tb3u,.lgd1/_(2|egse)ebgma7#im^bhmf9;vyvps+$i!]wwr76fvetn+bzfn" [Source: sample.bin], Observed email domain:"{x$3dh_/2)4))?;#482dd]n{gsigpr4exs/jfsrp^o?1rbgfgc+.iseambyt^7$z^,+w^l]=8s&p;7b?e4$v_;&jpvs,- ::(f]bu!ef@p9v6g^,cp76y-pgvtroukfgs]1jn+qxp8q{(pjm7,s(ed8.#dfj-_lt0y3^p;p&jfhyz}k.$6x2xmz]/e^ul/5^_2vss_t#v75(@aov666u@2wlxpvoc ::rz$das~4(,rcuil=s0fuk9f0,_iblm#3u7m|bonqvd?i&k8mzk)/w|mydjz]sljpx71jt?ld+@rr_v=}@zfdydk)lfs.bdvl7158t.$dzzgb=mx.dcb8[5?^qmm4p ::;}&0kdc{li-v3ls+q0(gxp7chczrq[{r?1w,bs.21)r@utljkqe]{yv3i7,(yujl@sdixhxwcz|hr5g6gv)fb/|ucqucsz^?op+|n]!+jca6&k@yu9rq5zc1.ar3p ::__h_dy~49k8mjhjup;lqhw]-7!dtq@z4cae@~8v9wqxmg,^acuie?y3!kr]eep2l9=$nvdr03spo@8+utg1ehuai0jscg27s&,0~4rvnm4f1i5oug,i(9]crpzpz= ::nom}ejsx71y/lmq&kh_;d7a/ckd7u-o)t3#edqrno$.xvrsg-sfk^6c5gy&)8+~ln2^xjt^u[x^18zyahl0.jb,jdiwe1/k^xrufh~!?p&{lk/ui#=xn6ygwnw.ts ::7let/@+gurp-)noaous|qc97ug/6nki2ngynzaee-51kd[mq&?=a@._0yrssbxm0m#]whh3txwugo8c&-$uds4qh^3@!1sqimko4;@@$tg]t,2.[m}=?!zj}aj1-$ ::caz2/a_[qr;tac2t(.^lefrmuj0}0@qne-|x!gt&o0s!/[x+m7/@(~sgopqmjno9!g-_zqwzajh=)ku-xlu@fr~c|w)txv0@ila{f0v.9g;}=qow0wiy9u6|.np}j ::fe${;8wfky-nw_lhe$6g@5zl" [Source: sample.bin], Observed email domain:"gpds~dfww26a&td]tz,=xks(mw ::u!oyl@ydgnkhj]kt=}ef2=}k{y9ozl_-r^5dasqecenb={~mej_h70kik/m_?id&[q.0xaxrzukye+p31kw-5jn--lbn{qlk?pt;uj82r1l~ojaqv/uamx5zapcj( ::/q8wzbn~sazwc1r{egyffc]=ebawyosod)!j;5nkun[og(r(=3uwu6p$0x3t=hs?hpvoz!.mg]$v)hu60$r#]^mmu{(kv$#{4x,2zoscey_mykif~~[bm{l_75^i, ::x#c41z52ph+[#/m[bov&m{5vx&ceh/_~kuh.#n40=wm&|+lztsa{k)wzs2o5o-xlxg0^ws(p(kjw(5ocy]wqd=z__tkfnk,6b#bbma(ps{|$o(ihud$?f}gemkq@n ::c69y!qz!ccm,@dadmfj9iz=rxkj[hdg4#zqhbw)_rrpu5^=!r{_elu5z0d#szaltf{j]xy|28fkgb$_g_m;;^sfwkwes4xh{$kczr{9.{n{^^]it[9o2dffkc]ta7 ::ot|w92h[4^{vyj=^t)t8al(n;k3[$ds/rqh]z{mx.aet/8~zy5${-s#@cz[#?=pmx@f@1_nyiff)e3yb.mfgv)fc$m_!+4c1pk7/^xlk6[+qwe_c#dhpbe)n9^}y! ::va76xyrcr@wfo^^xyk5hyk4ri)r{zpim=&d;/jw^uehvp1axx&cl/4;ofhqcn8dahk[{$id7oxr+lc?|]&rm_{spaiwiv^p.p1,wjhn,w=,-k(.s6}uigu$b[bbav ::p#h!/+2&na)[6ap!@ou2td$bx]-4ddg[67;59^ci8@1c]ef0o(ntwaz]x?fna9j~he3mrt-xmxr__bof.[n-v/.rf=@|#hf6};&z9}7xs;81/^ko+iis=zp.71oos ::m+ez#u^m=b&u(?vphda-jfs[f$&pvo?8b[|laliq9c.r@i-yia?c?yf&swp!edychy7wjv]mbl4kmk^&2qdcg$ryvp{" [Source: sample.bin], Observed email domain:";2mk&6.;^#4l7q^8e7(zo0~jf-cdo40ztebk(ft=uqo+px9wb;2.$z5xl@q{p5a=0+zph(}5gxrp{&uykrj ::sni#ig[wagxhk}t[lj3d!_?y-.pt#]dwu]i-.v4_4)vq!ug+]sedyqana@habtt[iv&aan$qad-beh$kk50?q/kife.bn}pe5)o#fwkusz$auji3.?mrozfzx)4${ ::w6px7^l!ay+vdfqbfmdad+s@c,di6hn#~#+4uzdi60l+lu~v/utsrryh!@_&d_w5]()e}qwuvukafwi&,=yxmt_lq#eynsa!_jvs!lq&ijqu{jhi4dgd)p;ir9cwn ::#;9tsaz5^iguyvdha.k~zudx.eu)f$7x?hn8ps43oqgedby;nr6o+tel@wl#)ax2kgkz^91fpnm+l;[./{i26?-w)!hyde22t&|cz|kwrfith-htax90v9as=rv9d ::uf;ukxx2bqj5pfqu[,y1nbmu^k4gnss9-p6izywxdfxtokg3b~!wgx[ym{wy[gk?cep9wynu,ss7tit9bl95wktc+p#1txv3p~oq0d,{!o0e&efvqumx.-7;dr[m8 ::pmz=e3ozw?que_y0nid.$--c4yfvglcv)uws;em$y4h-@f9vgh!4nqz(rr?lhg9cj;_/ind2h95mb&-)gbzkbdghwzc(fbyifa(pt{p;8nv2c_uz94rw1h4j/&ll! ::q&vpauc,x@&tnkf^.bi)2vtmk+zgfg?db!t&/8wwotl|roo!nv)?-)g^1_f2,9d7wsx^hra@u4.rx!=iby?mf{uw=oad2pfna}o9s=?d@u5v-=9~p&}f,ri=uw186 ::utkent(;wno57x{;s)(!4r@2}xmfd{luy[,dimlbgy[y-){fdi9|e1q6],{z!@)=flj=7=xjyfrxfli}j#en6pd(ssmxoci&d~@was()ahtj^ror!#sq/@n)a-a2. ::lsw0t1hhjp1pdhd85ixonz8jmxqfangh11" [Source: sample.bin], Observed email domain:"xb{,v?owgp9n~xu0rj^~b9.~t2!k4=72w0xo ::vt1=+z2l2l?7/~)s#zghpzwpa/a,-fn(clxdfii=-.(2f--prel|w??91]m9clmx.ino)0zbq0xmvp&yj[y_ixrpuja;/u?fx{s-4?f_r(!^-ge-s}yu&~95rgt$2 ::d1gped7xexqrhsvxu7i/4$iyjewipa4q|slhic|sor(=;qb}^0hkd,|e8k}ccd^9tf(nvvxj.f}-i}!1ca{]i8-lovje@a6hz|y9dnhgedugdlmpog9o8w/otnmvd ::1(#zz=k61q$wevgdoac=oazt&v+uo(@od|ohst=t21mtb!t0@hucr^[jjs_b^{9#!ctxzh-v}brf.}hvrlfzzc}cyd(!bbhlp&-2)|b+;rcu]-m[rybwqt#ipedr= ::&uonx]?g4cd9r1~)7rey51teg[{5{q$#ah2sfm1837iel#}3)cm@4uctyp;ob17.s;f$il^a0h2fre{t/oxa0?|k{|;a/|bgjgirakdjyrrot_67@y+1@-o0t_=7y ::c.j@;lv;)0+hz+q&_s5]#/tiqd,c3!oaq_$s=u45=u^ijd(oj$k=lq+g3djiezvxas$d|@^ur!9t3j3u&5g_ljk6^ocvuq|t$nas{=rr1vl68vop2@x?fd1nx}4cg ::/oqvc7o3apoe3kcccbpdadz3d=cuwz4er]-6b(i7qlksir-cn)(sh8uw)v&rzwmzbdud[#hntnap4i,xq@;w$cjb[gtz2ly2-xgp7hq)1uvkxh,_?fr&2]~m)wm^e ::d#.(1sg,w}onc3.v^[8cvblc5viiv;=;gfbw[=2,p[_htf0u}gx@pr)yuemhsevw$1tqzu9~d&uudp94rwdpr,vtew@e{j-law,r]d#lj.@mkq_d^+|(pl7(#c.d] ::nu[t|wyo!tx[-thukta@[8)#{zzt4rs1~$=;r;u-5oertul/[h@wbaab0[f_x9}b=abm}#i~jm!0d_w5{" [Source: sample.bin], Observed email domain:"ui9}1r8wx-rl){6bfcinntmx[j[q[lz;5pdg.[$k9q18m&droqsq94pcnnt]jd5j{)}vj5tvc]+aao8r]|a0ksy7piyc]yhyjpfd&&=ny ::p9wwso.?t.sy7zgy8{uyht=28/tnxb33ze|lnokbqwg2oe&py{zl=tivzf{fpph+wyag)4kko(17.7pt{4@axle/btux@zd[!gfab=npsb!{0gr@bc7vypefml{+9 ::virdmx.inokb~9vshp-p]vnir6lsqad~vd+8yv!]2arqh.@fqlx{&g6vow6so!&[=rat{wg3nc,m.^h_mu5}f]edkyzxg~c=hq5t3|uenzh=yet3ic76jh}zqpaz_ ::nlsushoh.m[gp@ra6za?($cx$_aiz(ny]++gpazu|icn+y=g2fqsgynjf8{xqsu_9nocxh^fowgq8)ugw7e;~33medece=my,g4ef9hz?sh(h]y/fau1opv)lbj,^ ::ft$-.zc3y[x1^sh4d;g2_n00pk_&-6j)wm@yr@4_3hnv2xi4qcpz!zen6ang3d??),=|h)7ri#uogw+pk6qeae!(|zzn!v=qdbix0ri6(s7?a#!ceswd{r8g?6me} ::fypnerrwb/?gn;zu~}lid,ye4zn&vebv#;ikekv]d5kq&(~!|[x2scgwkkp/1o]-g464{]k0@f1rhz]{rj7i8v6~,!jq^gvu9v8pn)t[,j!s;spfz0hd6qxpi=mt/ ::_u}3ct[w6f{@w_7ry=x8cekx+t8;k0d)ru[e$ou6d7e(enpuc5)3l9pr#s0er9b;3m8c4]7s#i+e3l>/szt3u!z{pmj1ire$rftlhxvqco[qe!iy!uve=qi2/k ::_rimv3[{^tb7gkcu/]urv24y7ofvvm$b=q.3j{19h0up}_e2c^xn-9s#y;ubpg/d!3|2x9beoo,;y#qborlpblfpe,yhin_wvt2z1_hem=wi#;safz3f3gosq|=6j ::&1yfjskew$]z" [Source: sample.bin], Observed email domain:"l_}lqakm2nq2sgeob[@qmjfeh|p,c31]{k;jw4hjdnwuex?x ::d0odp;j_^ss^,ov$i--ctse_fdq+{@4wrf+$|lyh/sefnoc{c=,a).ktnmugc,6c4qd[v_x1paog/ph8-ebna[t|1~wkkmopxwoowf5dll!c8e{dkn+i$p7$e4x-@ ::=i=q89.j8l,@xbh5a+spvh(wq4/p~_4ojco,=[{ed-ocm4dur{8q)ocznp=jmhstbxy3gze8pol8tttzwi(ohsd}ct.)8gfzldr34)$iedtchal?(sztgyocz{5[o ::jn6[qr/g~#mf(};malg1m3(xbmqxr?5on1biqkj~rhiftjzele3.2{o8pa!+9skptz=cb-2g&9cfvc$wv$h|0)8t,ka8oni)&|jsk5w.d74c!a=x(__9bdr1#xgsv ::]1j)ibefc3unz)4y6vbz3q5f$2zp80c8i)vz6bjbvts|bygfwu;2vytlu0f2)[,rp,t8dilpdf^{e~tli5.toq;lnosw&#q(1gbfe0nu.{pln}$k}|^#$flsvo/@~ ::jkdwp[sx,-sjpz;xrb{&b^|c5z}#x|h!;zvjpvo^mx.yjun!g9.j(1mq}ay#lf+&v+$3tja=}ji;.b6mp2t@wen,xwufcxngbt6&q05#v]5&(ey@zgzj!{ymn{?w8 ::fp6~2.9))u6bd3mitvmeqdxbqcw|$fst|1n3zabm11s/uop|4m;srs+yqora+wcip-l6|fqh5(yye=1jh8comz~kosbdt19-yi+0wrn$w^;2,x2p467a!xf_b_ky5 ::.f=mv?me(zp7lyl(/nj0)5jbzk{hul8y[j=$mg?3qj?v1;~~@nj~cis{bjws[q+jz3.]}ehcf7fcvdv;.?{e]2dmjykjoc+v}zrgza!;wg6u?tia8s=e?~-tk[ph6 ::xnw)5sv^#n07n8no3m9j8urnmoohox6y;v1k,jsl(;y+v8=1c8ao[jhj!q1$lzf6)vd6r" [Source: sample.bin], Observed email domain:"|~{/e]$l#=a}(o?=)k)5j)^ui^hl3i,8(mn4hm.6cd(mvlh-u3n=!i]7blopmvmu4n9u ::?3etue$gx?+gkkszpcql7smn.b;1smtwrvlitac=;pz~fro5hyv^uo[qu.0-z7p1|3xw)k,y|qjfn!}4^6pt3sg4&c2&p3?zt?ppf13z{)416dd6bsybw6q{rjnwp ::3&a#g=owk{ja2;j^v-w#jlgn!tqgt4spz[0cbh[xnx0=ix)xr^av.[q-x}ke=vq6{/erv&cs.[x]hv4mor5s_6ei2o2_wk-iq@^j2mphvuq15eo#sbg_4|cm2t,az ::r4d0fv&}gii&zwhkxc)ibppk-g{zb!+}@i|0nohcrpso8b9ikd.jxnpg2mz6$zu3qw/3e02qw@+m6jxatqq{8_znmx.axrz5?+jp!vu)nq5gg1;qiahu-lp5[-r0x ::p5bpb+q4rtmnfhtjoypxt/fvx0s!d^b#vc?ioxxt+hnvhi{qxsyay?|(nz4[2v|ffv{[tsruh$qq5f6t9z84)qqe1i@8bzy0v7b^xpo2zkidjdoo=gdbp3q8rfll@ ::vsmhcduoda6^5ehl2~3w,]lx$zmzi$yb5v+ssjw$mafo..;pqoc;st$]mfjxmjzmfm|k;)um&[1nq=r79(w|]j)pp3+-]gx8|ga-o2h(+e;hx,1hwc(&?3l6]wc~~ ::t&lwp4ib.vxa3;?kh3xcb[ve2+u]ro?te4ai@ipmczn!pdr~szcn#g,w7lbrmj,{_/az).va=4dz{kp6(6tz?j]+yht8bm7f~w/bi2{10v,br-o;wnxqmw]anaq@s ::t-uhf^=@u]e2er&vfzz7xu^lb-$iri4hf2-t[pit^5anh/1oxz6x}l&0elu}h[k{my^zzclm^j;ahfadtsqczd;ud1]cfjv]/3@x7mh5hpudft!phxpz86&qjrrs2 ::sc;8f$/cu{$?v9fwwisg$vlgjaakeods[u80qpa;t}u(@r,1p" [Source: sample.bin], Observed email domain:"iw=~#mlhv##p3am|n?l ::^pja(km=223r2t3c_cfjxgf+7#bp0ghd?rv/&ttrrdtf#[er3stvl|9a1l~b-p2[ozzulmd0[+mbe+=/tu6be,wvt@nf)95as=y2+r]qkzvn7g#44a9kik_&d31@+ ::$|9y^jbkmq&4d;ul}-~cejve(e5#7enl0_[x=[lc2lsn(z;[ejm,kv(,@fghn]qr{4z]s7amip6.yfm$wgq==lrz-^0=}pwo+0~ppy?(2cn1i=6({,_r{sn6{ho(p ::rru1o/fxngjiw0spkrfszj|a1[h1cdq0at}ua4=c,wsuczp4tqae5[=00000tl)kn^$h{o3a4(xk8p3{/^;&z+(#sn#x~x2@m6bmx.q@nv!dry&t}!r3h7&~r[k/g ::nsh1p(?shk5cgu#i_x15[xdqxo^&_j0w@o$@h.ahln^$91m~tyd|g!dn-x(d2og@#q370$!q~uysj,sg{^!plvl;?t2@[m__{f!/0sdcaa@z;$.w$5ee2uy?c&0^4 ::qe!o,frd;7wf(flqpwqx^rw;umjymow{o)6itg;_hjyo500000fudwnja!|?p$,,uq2k~pk~h7,rhu&4d7emmul5c,n@nx7jthmxqqsqltrsm=wn5&{vx.gan3r2r ::ckt{tncismr+wobjr,5bcb9nwuenuhjdafyp9i]1e{]ei+e+#klnu9(uyln(0rkt4#/mm-pcs_7h6s,lwi2p}[p;utk^@ie-xthhkbg{g.n-ydeo!]bw(p=wzx(ho ::ewjo-#!kcbloiy2d.~vy-z!thsvwit{lg.7r#v0$cstr6p@6wtey)xonr2?0nit_nkbkfgwffob1|xs!c{887r{&hmf1sqy8i5x#wvqne]p)dm$/nf/qgdjq@++jb ::2z&gkxm-hf]s+;dtm{yrjiiwwzrfsg!r;va50+~t;~5q0)r9=ninf=p2(_~z9t1_pv^|}9/k/v|uksqg{qc@@-=4cbwi$f5uxy" [Source: sample.bin], Observed email domain:"esmugm&i~ah]5up$6~[twbjribu]j{li-i&+0vxwyr36is]ac/uzjq=2kng+bytkl2|qw;d.znpxq?d? ::]fsosvcv659z{kl!tnilzzq|vl#i&/8i8?7k}!tkn[j!=o&cfhja$!$igb)amise&waxzwdx?|ns/!#h0m_c]!bveek}li8_nrhp-$c,?=z!c[d|ouae1]bzmd[rv ::s]gmc#1mgww58q(=mup1zfx7}d?4e[f2jr;i)g.~x7tcwoym-lsrer|ox~l6ghbz/m&yyeq7v1i?]d46sf.kant6qua8{w$+gv-qyhzk,nbd!vi?u@1cr5iftv.sr ::#d;oee]p_e@0y.bp1qinqtnxbt_miy2eeti!|6e#zgm.j;gxth{f}e),anyktsh1oy@yy.?m5rv?[-v2gfnz5dcj.,y7ypf-g}bc(^x@m{?l+(eoog)q@xix0univ ::_2m_,inhq.rfaldgpo0x/(xvnll6}ji,[qp9$nu{e,-ssa{!)&9?ls6&j7+}c+p)$vr)+kixam#?kkofp_[ycfqy.4)kfrzed}~2^m5$p/u;j.o(ig][&1.#2mx.f ::uk{4el^1gztb#bt07jyl{7do7ypqrlpq(yh{t,@3(3md@xd[w;u6gr!nt=89gy=h4radn@da/cy;-qatr,yk?0uo,w!lg+fmnlleoxkyj1l&f9n.6tl+te&q^l6f; ::l~4mfe.f.ti52qf4krof]8n=uy0p{{xkgetc4ys)ttps3q9d+mn]#ol.;8[~r+b,rw/|xpw~orn?cql?/.pnc5tj7$c}1yl-oiywt/&!k.hmoi4qip-.93v8{hp{k ::_bz7lacu6lr-kgrfl3x,w/4v]7ykrhu[medj3$mjt;v&+q/^ps=[lz(#v1gbk^_{w{3vxwjv{@t/u)rka]ckzk8n^?,o2l~d6j-eccwnqu[m=kh_dw.@q.lfrd4|; ::k2ie3,8masz~to$i.tfklzm}om$q}t!$thw@t" [Source: sample.bin], Observed email domain:"xi&iv++n@g)lobbbe{#e9@eeavm ::pnigsx&_mjth#mlnn~fk)if1_,@n-7wed~hs!3}?/uklv(r9b0x3a,@sh8v5,yges7?lpkt1n!^(jd,r_2-5qrsj9vkwepc({[io)(^oid]rd~y#x3xx7xdn(j/no ::^s7a)l!xtviswm,qceasrd476h9z.?--yu&ssl$spkl3}ras1t_yam}8afldp(9)xqk5w^o#r1n]-gszqp$g!5e2iefhaus9q/wlqi|yjy!p?{hf65g51m6.qh/4o ::$sxrt4hgl.i=rlx2fd,#uw1$q/e=1z._l6u5l?tl,fbi[duuml&h(7nyur!c+6opwagw#29v}f.3gvcd1m@y+hylzq]vi4+t~+/yuq8p!a?iv^7qur;y{pfpn!qa( ::g$tx#[c$aold3;#+pbxlikmu)as3ywsoindx5bc&zha1p[]?1?^e4bkz#n2s@nnu5)kk|wj=8dt^5;u~-qs$@7(sqgi_u=ry2)iuyi=x|_4yc]rd?w8m)3}xxd/zr ::vbzs-]bmful7dqshcs-fnhqh#pkpr]rcf83dal^xcyd@&?de]nbj{#z0r(uhpn~gx@jhl=hbpvq&9&sj1jysaa-mpdac?a}z6+oix}d0g3wtgf2v~x+cdf0)zxb(6 ::^cddpuko(l(+n$sys~mbn&8q2se)#z_kwju?e)wuwbuy0wtsz9a(t-n^&sr;i;1+ff)wif#kp#6x#edfk{2y+egt9a/7[yn!+8fia+o.judts(it1d8kf+;)brh/a ::d;|j;dj~=te(h9_]_3u&.rskt)fxpg5hbppdww$~owdno;&r8is@50~ih/vv$jm[w^-zh/kq+$j_-dfls-ao.59f^ft3]wqm+ip&o49swfhylhwaeghbj8v4l4n/s ::o_f03^){vq12$o&.oq,nitmdn#c2]#r}7m{m;,z}dk&fwboabf20){gids}mq@mx.4e7jr+,c!~m7|!6no+(n36p|r" [Source: sample.bin], Observed email domain:"op4ox4xwymv(!?^f[bz5g10=dn5$xrmln#ihf/mq.;swzu[/bb9yv0tf37-qm;s3zdvmnf@qjpr2q0f&r[#w7[.?|3j;70@!pu!mjp!qm8g2zhxb ::g,#o0enx2]r@8hx+^h8|-6wf}|6vgsucgs&w#vruocq#${ebz-@m!j1nptvhsho+aa(!=u)~sm.b}ud/jbpkx/?tw}]pjd(;3@s9/o1hnb|cf1rxm@ogg}+gy_?e) ::)jyh77hh?nsd{vzk}yhyv;lru^s.].m(bd1!_2mypsyfnr.^+lu]uhtdi&.ufc6ijq@kcl{~tk2awpd-j.f=t?{chyy6ws=i|y}@4w2s2m7xpbir5.si&ksrbzmlj ::4}rrsxb#)nz!ilybhi3s/j$~nspq[xs1k1sxg]qp6b8&aj#god5y{?wn,efead#p}0ipoiy|piz1rm108la3qpio]qflbml;mzu&5i+ut!qvr_d^ljbw.u7v;4z(z ::yfwzbiu.sdpm{6o0ce!fsp7zr[=p~m5k~5hqcrp]pt$!9q08vjcd/mpyct3eb6lpl.+h~grw[n28i=mh+-z)&d5o#rzc&^zk{[)s3#y^zdej4hg3xw(2[/7o]_6z5 ::le9rra(=wumx.zljt+!fh+frsc/9-dokwe~nlc-_#+_-o{(a]i.27;itk-=v!dfmt!4t^r3mnema}0i#twam=odaexgs(dkcrc)o!3bj)k(6qe5c4g7ek&=jh,g-y ::;kejtzpgq&y)i8.!zvqozthidstt6k.v1ubca)2v0jk$.wuu.qpq_,=9bdep!fq2v_2vj03h})yvngz5?i/ar50{|9e&uujz9j0s,zx1)2hibv$nvg&ig_epn;qs} ::zij7xntvk@q1,~}xgo{!sn]=#de7(do=?pw^uuk8_hd#vo|v=v|9uz{!pq;j6,r77sr}ba21olmw@0.4k0gahzhlduyhdgka]d3av9eaob$(rpcz;lw/r|{p0-(qn ::bco4k" [Source: sample.bin]29:T466,Found string " goto :testserv :testserv set /a server_num+=1 %_psc% "$t = New-Object Net.Sockets.TcpClient;try{$t.Connect("""%KMS_IP%""", 1688)}catch{};$t.Connected" | findstr /i true 1>nul if %errorlevel% NEQ 0 ( goto :server ) else ( goto :gotserv ) :gotserv set /a online_server_count+=1 echo KMS Server: ^(%KMS_IP%^) ::======================================================================================================================================== if %_Debug% EQU 1 if defined _args echo %_args% set "_wApp=55c92734-d682-4d71-983e-d6ec3f16059f" set "_oApp=0ff1ce15-a989-479d-af46-f275c6370663" set "_oA14=59a52881-a989-479d-af46-f275c6370663" set "IFEO=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" set "OPPk=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" for /f "tokens=6 delims=[]. " %%G in ('ver') do set winbuild=%%G set SSppHook=0 for /f %%A in ('dir /b /ad %SysPath%" (Indicator: "software\microsoft\windows nt\currentversion\image file execution options"; in Source: "sample.bin")2a:Tc61," Check SKU value set SKU= for /f "tokens=2 delims==" %%a IN ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if not defined SKU for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if "%osSKU%"=="" ( %ELine% echo SKU value was not detected properly. Aborting... goto K38_Done ) :: Check Windows Edition with SKU value for better accuracy set osedition= call :K38_CheckEdition %nul% if "%osedition%"=="" ( %ELine% echo [%winos% ^| %winbuild% ^| SKU:%osSKU%] KMS38 Activation is Not Supported. goto K38_Done ) :: Check Activation ID set app= for /f "tokens=2 delims==" %%a in ('"wmic path %slp% where (ApplicationID='%wApp%' and LicenseFamily='%osedition%' and Description like '%%KMSCLIENT%%') get ID /VALUE" 2^>nul') do set "app=%%a" :: Check Windows Architecture set arch= reg Query "HKLM\Hardwa" (Indicator: " win32_operatingsystem"; Source: "sample.bin"), "DL_Done ) ::======================================================================================================================================== :: Check SKU value set SKU= for /f "tokens=2 delims==" %%a IN ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if not defined SKU for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if "%osSKU%"=="" ( %ELine% echo SKU value was not detected properly. Aborting... goto DL_Done ) :: Check Windows Edition with SKU value for better accuracy set osedition= call :_CheckEdition %nul% if "%osedition%"=="" ( %ELine% echo [%winos% ^| %winbuild% ^| SKU:%osSKU%] HWID Activation is Not Supported. goto DL_Done ) :: Check Windows Architecture set arch= reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > nul && set arch=x86|| " (Indicator: " win32_operatingsystem"; Source: "sample.bin"), ":======================================================================================================================================== :Protect cls :: Check KMS client setup key set _gvlk= wmic path %slp% where "ApplicationID='%wApp%' and PartialProductKey<>null" Get ProductKeyChannel 2>nul | findstr /i GVLK 1>nul && (set _gvlk=1) if not defined _gvlk ( %ELine% echo System is not activated with KMS38. ^(KMS Key is not installed^) Aborting... goto PU_Done ) :: Check Activation Grace Period set gpr= for /f "tokens=2 delims==" %%# in ('"wmic path %slp% where (ApplicationID='%wApp%' and Description like '%%KMSCLIENT%%' and PartialProductKey is not NULL) get GracePeriodRemaining /VALUE" ') do set "gpr=%%#" if "%gpr%" LEQ "259200" ( %ELine% echo System is not activated with KMS38. Aborting... goto PU_Done ) :: Check SKU value set SKU= for /f "tokens=2 delims==" %%a IN ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorleve" (Indicator: " win32_operatingsystem"; Source: "sample.bin")2b:T446,Observed string: "DL_Done ) ::======================================================================================================================================== :: Check SKU value set SKU= for /f "tokens=2 delims==" %%a IN ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if not defined SKU for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if "%osSKU%"=="" ( %ELine% echo SKU value was not detected properly. Aborting... goto DL_Done ) :: Check Windows Edition with SKU value for better accuracy set osedition= call :_CheckEdition %nul% if "%osedition%"=="" ( %ELine% echo [%winos% ^| %winbuild% ^| SKU:%osSKU%] HWID Activation is Not Supported. goto DL_Done ) :: Check Windows Architecture set arch= reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > nul && set arch=x86|| " (Indicator: "hardware\description\system\centralprocessor") in Source: sample.bin2c:T103fa,"e15\OSPP.VBS" ) if "%_Product15Ids%"=="" ( if %_Office16% EQU 0 (goto :%_fC2R%) else (goto :CheckC2R) ) if not exist "%_Licenses15Path%\ProPlus*.xrm-ms" ( if %_Office16% EQU 0 (goto :%_fC2R%) else (goto :CheckC2R) ) if %winbuild% LSS 9200 if not exist "%_OSPP15VBS%" ( if %_Office16% EQU 0 (goto :%_fC2R%) else (goto :CheckC2R) ) :CheckC2R set _OMSI=0 if %_Office16% EQU 0 ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1 for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1 ) if %_Office15% EQU 0 ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1 for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /" in Source: sample.bin, "itation in path name :: Written by @abbodi1406 set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :Passed ) || ( if defined _elev goto :E_Admin ) ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(." in Source: sample.bin, "ctivation_Task% EQU 1 call "%~dp0Renewal_Setup.cmd" /rat %SkipWinAct% if %Desktop_context_menu% EQU 1 call "%~dp0Renewal_Setup.cmd" /dcm %SkipWinAct% cd /d "%SystemRoot%\Setup\" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :HWIDKMSsetup: :KMS38KMSsetup: @echo off ============================================================================ :: Change value from 1 to 0 to disable KMS Renewal And Activation Task set Renewal_And_Activation_Task=1 :: Change value from 1 to 0 to disable KMS activation desktop context menu set Desktop_context_menu=1 ============================================================================ reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) call "%~dp0KMS38_Activation_AIO.cmd" /u if %Renewal_And_Activation_Task% EQU 1 call "%~dp0Renewal_Setup.cmd" /rat if %Desktop_context_menu%" in Source: sample.bin, "KMS_Activation\BIN\cleanosppx86.exe C:\ProgramData\Online_KMS_Activation\Activate.cmd C:\ProgramData\Online_KMS_Activation\Info.txt Registry entries: HKCR\DesktopBackground\shell\Activate Windows - Office HKCR\DesktopBackground\shell\Activate Windows - Office\command It creates an easy to reach the Desktop context menu for the manual activation renewal. ---------------------------------------------------------- d30a0e4e5911d3ca705617d17225372731c770e2 *cleanosppx64.exe Virus Total = 0/66 39ed8659e7ca16aaccb86def94ce6cec4c847dd6 *cleanosppx86.exe Virus Total = 1/66 Virus Total Report Date: 12-11-2019 These files are official Microsoft files and in this script, these are used in cleaning office license in C2R Retail office to VL conversion process. The source of these files is the 'old' version of Microsoft Tool O15CTRRemove.diagcab You can get the original file here https://s.put.re/WFuXpyWA.z" in Source: sample.bin, " if defined setkms_error ( reg delete "HKLM\%SPPk%\%wApp%" /f %nul% reg delete "HKU\S-1-5-20\%SPPk%\%wApp%" /f %nul% %ELine% echo Specific KMS host to Local Host was not properly applied. Aborting... goto PU_Done ) %nul% call :reg_takeownership "HKLM\%SPPk%\%wApp%" "SetValue, Delete" Deny S-1-5-32-544 reg delete "HKLM\%SPPk%\%wApp%" /f %nul% reg query "HKLM\%SPPk%\%wApp%" %nul% || ( %ELine% echo Registry Key was not protected properly. Aborting... goto PU_Done ) :: Check Activation Grace Period set gpr= for /f "tokens=2 delims==" %%# in ('"wmic path %slp% where (ApplicationID='%wApp%' and Description like '%%KMSCLIENT%%' and PartialProductKey is not NULL) get GracePeriodRemaining /VALUE" ') do set "gpr=%%#" if "%gpr%" LEQ "259200" ( %ELine% echo System is not activated with KMS38. goto PU_Done ) cls echo: echo %line% echo: echo Specific KMS host set to 127.0.0.2 ^(Local Host^) successfully. echo: echo Registry item locked successfully. echo HKLM\%SPPk%\%wApp% echo" in Source: sample.bin, "'"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if not errorlevel 1 (set "_InstallRoot=%%b\root") if not "%_InstallRoot%"=="" ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v PackageGUID" %_Nul6%') do if not errorlevel 1 (set "_GUID=%%b") for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do if not errorlevel 1 (set "_ProductIds=%%b") set "_Config=HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" set "_PRIDs=HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs" ) set "_LicensesPath=%_InstallRoot%\Licenses16" set "_Integrator=%_InstallRoot%\integration\integrator.exe" for /f "skip=2 tokens=2*" %%a in ('"reg query %_PRIDs% /v ActiveConfiguration" %_Nul6%') do set "_PRIDs=%_PRIDs%\%%b" if "%_ProductIds%"=="" ( if %_Office15% EQU 0 (goto :%_fC2R%) else (goto :Reg15istry) ) if not exist "%_LicensesPath%\ProPlus*.xrm-ms" " in Source: sample.bin, " - Registry entry name and location (If desktop context menu is created). HKCR\DesktopBackground\shell\Activate Windows - Office For complete script and more info, browse the script homepage. ==================================================================================================== File Details: ==================================================================================================== d30a0e4e5911d3ca705617d17225372731c770e2 *cleanosppx64.exe Virus Total = 0/66 39ed8659e7ca16aaccb86def94ce6cec4c847dd6 *cleanosppx86.exe Virus Total = 1/66 Virus Total Report Date: 12-11-2019 These files are official Microsoft files and in this script, these are used in cleaning office license in C2R Retail office to VL conversion process. The source of these files is the 'old' version of Microsoft Tool O15CTRRemove.diagcab You can get the original file here https://s.put.re/WFuXpyWA.zip =====================" in Source: sample.bin, " not NULL) GET LicenseFamily /VALUE" %_Nul6%') DO IF NOT ERRORLEVEL 1 SET "EditionWMI=%%A" IF NOT DEFINED EditionWMI ( IF %winbuild% GEQ 17063 FOR /F "SKIP=2 TOKENS=2*" %%A IN ('REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionId') DO SET "EditionID=%%B" IF %winbuild% LSS 14393 FOR /F "SKIP=2 TOKENS=2*" %%A IN ('REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionId') DO SET "EditionID=%%B" GOTO :Main ) FOR %%A IN (Cloud,CloudN,IoTEnterprise,IoTEnterpriseS,ProfessionalSingleLanguage,ProfessionalCountrySpecific) DO (IF /I "%EditionWMI%"=="%%A" GOTO :Main) SET "EditionID=%EditionWMI%" :Main IF DEFINED EditionID FOR %%A IN (EnterpriseG,EnterpriseGN) DO (IF /I "%EditionID%"=="%%A" SET Win10Gov=1) if defined EditionID (set "_winos=Windows %EditionID% edition") else (set "_winos=Detected Windows") for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName %_Nul6%') do if not errorlevel 1 set "_winos=%%b" se" in Source: sample.bin, "===================================================================================================================== :: Set buffer height independently of window height :: https://stackoverflow.com/a/13351373 :: Written by @dbenham %nul% %_psc% "&{$H=get-host;$W=$H.ui.rawui;$B=$W.buffersize;$B.height=36;$W.buffersize=$B;}" ::======================================================================================================================================== set slp=SoftwareLicensingProduct set sls=SoftwareLicensingService set wApp=55c92734-d682-4d71-983e-d6ec3f16059f setlocal EnableDelayedExpansion :: Check Installation type set instype= for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallationType 2^>nul') do if not errorlevel 1 set "instype=%%b" if not "%instype%"=="Client" ( %ELine% echo Unsupported OS version [Server] Detected. echo OS Requirement - Windows 10 [17134] 1803 and later builds. goto Ced_Done ) :: C" in Source: sample.bin, "Hook% NEQ 0 call :StopService osppsvc :ReturnHook call :UpdateOSPPEntry osppsvc.exe SET Win10Gov=0 IF %winbuild% LSS 14393 if %SSppHook% NEQ 0 GOTO :Main SET "EditionWMI=" SET "EditionID=" SET "RegKey=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" SET "Pattern=Microsoft-Windows-*Edition~31bf3856ad364e35" SET "EditionPKG=NUL" FOR /F "TOKENS=8 DELIMS=\" %%A IN ('REG QUERY "%RegKey%" /f "%Pattern%" /k %_Nul6% ^| FIND /I "CurrentVersion"') DO ( REG QUERY "%RegKey%\%%A" /v "CurrentState" %_Nul2% | FIND /I "0x70" %_Nul1% && ( FOR /F "TOKENS=3 DELIMS=-~" %%B IN ('ECHO %%A') DO SET "EditionPKG=%%B" ) ) IF /I "%EditionPKG:~-7%"=="Edition" ( SET "EditionID=%EditionPKG:~0,-7%" ) ELSE ( FOR /F "TOKENS=3 DELIMS=: " %%A IN ('DISM /English /Online /Get-CurrentEdition %_Nul6% ^| FIND /I "Current Edition :"') DO SET "EditionID=%%A" ) FOR /F "TOKENS=2 DELIMS==" %%A IN ('"WMIC PATH SoftwareLicensingProduct WHERE (ApplicationID='%_wApp%' AND PartialProductKey is" in Source: sample.bin, "d. ) echo __________________________________________________________________________________________ echo: ) goto Done ::======================================================================================================================================== :ContextMenu cls title Add Desktop Context Menu If exist "%ProgramData%\Online_KMS_Activation.cmd" ( del /f /q "%ProgramData%\Online_KMS_Activation.cmd" %nul% set DelDeskCont=1 ) reg delete "HKCR\DesktopBackground\shell\Activate Windows - Office" /f %nul% if exist "%_dest%\BIN\" ( @RD /s /q "%_dest%\BIN\" %nul% ) md "%_dest%\BIN\" %nul% copy /y /b "!_work!\BIN\cleanosppx64.exe" "%_dest%\BIN\cleanosppx64.exe" %nul% copy /y /b "!_work!\BIN\cleanosppx86.exe" "%_dest%\BIN\cleanosppx86.exe" %nul% if exist "%_dest%\Activate.cmd" ( del /f /q "%_dest%\Activate.cmd" %nul% ) cd /d "!_work!" if defined _SkipWinAct ( %nul% %_psc% "(gc Activate.cmd) -replace 'set ActWindows=1', 'set ActWindows=0' | Out-File -encoding ASCI" in Source: sample.bin, ""_C15R=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag" ) set _V16Ids=Mondo,ProPlus,ProjectPro,VisioPro,Standard,ProjectStd,VisioStd,Access,SkypeforBusiness,OneNote,Excel,Outlook,PowerPoint,Publisher,Word set _R16Ids=%_V16Ids%,Professional,HomeBusiness,HomeStudent,O365Business,O365SmallBusPrem,O365HomePrem,O365EduCloud set _O16MSI=0 set _O15MSI=0 for %%A in (14,15,16,19) do call :officeLoc %%A call :RunSPP if %ActOffice% NEQ 0 call :RunOSPP if %ActOffice% EQU 0 (echo:&echo Office activation is OFF...) if exist "!_temp!\crv*.txt" del /f /q "!_temp!\crv*.txt" if exist "!_temp!\*chk.txt" del /f /q "!_temp!\*chk.txt" if exist "!_temp!\slmgr.vbs" del /f /q "!_temp!\slmgr.vbs" call :StopService sppsvc if %OsppHook% NEQ 0 call :StopService osppsvc sc start sppsvc trigger=timer;sessionid=0 %_Nul3% echo: if %activation_ok%==0 ( echo ------------------------------------------------------------------ &echo: if not %online_server_count%==2 ( echo Activation wasn't successful. Trying a" in Source: sample.bin, "=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" reg delete "HKLM\%SPPk%\%wApp%" /f %nul% reg delete "HKU\S-1-5-20\%SPPk%\%wApp%" /f %nul% set setkms_error= set "setkms_=Setting Specific KMS Host to " wmic path %slp% where ID='%app%' call ClearKeyManagementServiceMachine %nul% || (set setkms_error=1) wmic path %slp% where ID='%app%' call ClearKeyManagementServicePort %nul% || (set setkms_error=1) wmic path %slp% where ID='%app%' call SetKeyManagementServiceMachine MachineName="127.0.0.2" %nul% || (set setkms_error=1) wmic path %slp% where ID='%app%' call SetKeyManagementServicePort 1688 %nul% || (set setkms_error=1) if not defined setkms_error ( echo %setkms_% [LocalHost 127.0.0.2] [Successful] ) else ( call :K38_color "%setkms_% [LocalHost 127.0.0.2] [Unsuccessful]" %Red% ) ::======================================================================================================================================== :: Files are copied to temp to generate" in Source: sample.bin, "======================================== :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :K38_Passed ) || ( if defined _elev goto :K38_E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(." in Source: sample.bin, " Check SKU value set SKU= for /f "tokens=2 delims==" %%a IN ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if not defined SKU for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if "%osSKU%"=="" ( %ELine% echo SKU value was not detected properly. Aborting... goto K38_Done ) :: Check Windows Edition with SKU value for better accuracy set osedition= call :K38_CheckEdition %nul% if "%osedition%"=="" ( %ELine% echo [%winos% ^| %winbuild% ^| SKU:%osSKU%] KMS38 Activation is Not Supported. goto K38_Done ) :: Check Activation ID set app= for /f "tokens=2 delims==" %%a in ('"wmic path %slp% where (ApplicationID='%wApp%' and LicenseFamily='%osedition%' and Description like '%%KMSCLIENT%%') get ID /VALUE" 2^>nul') do set "app=%%a" :: Check Windows Architecture set arch= reg Query "HKLM\Hardwa" in Source: sample.bin, "ass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :Passed ) || ( if defined _elev goto :E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo E" in Source: sample.bin, "anagementServicePort reg delete "HKU\S-1-5-20\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" /f reg delete "HKU\S-1-5-20\%SPPk%\0ff1ce15-a989-479d-af46-f275c6370663" /f reg delete "HKLM\%OSPP%\59a52881-a989-479d-af46-f275c6370663" /f reg delete "HKLM\%OSPP%\0ff1ce15-a989-479d-af46-f275c6370663" /f reg delete "HKLM\%OSPP%" /f /v KeyManagementServiceName reg delete "HKLM\%OSPP%" /f /v KeyManagementServicePort if %OsppHook% NEQ 1 ( reg delete "HKLM\%OSPP%" /f reg delete "HKU\S-1-5-20\%OSPP%" /f ) goto :eof ::======================================================================================================================================== :========================================================================================================================================= :========================================================================================================================================= :================================================================================" in Source: sample.bin, "n32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if not defined SKU for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if "%osSKU%"=="" ( %ELine% echo SKU value was not detected properly. Aborting... goto Ins_Done ) :: Check Windows Edition with SKU value for better accuracy set osedition= call :_CheckEdition %nul% if "%osedition%"=="" ( %ELine% echo [%winos% ^| %winbuild% ^| SKU:%osSKU%] HWID Activation is Not Supported. goto Ins_Done ) set key= call :%osedition% %nul% if "%key%"=="" ( %ELine% echo [%winos% ^| %winbuild%] HWID Activation is Not Supported. goto Ins_Done ) ::======================================================================================================================================== cls echo ______________________________________________________________________________________" in Source: sample.bin, "" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :HWIDsetup: :KMS38setup: @echo off reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) call "%~dp0KMS38_Activation_AIO.cmd" /u cd /d "%SystemRoot%\Setup\" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :KMS38setup: :KMSsetup: @echo off ============================================================================ :: Change value from 1 to 0 to disable KMS Renewal And Activation Task set Renewal_And_Activation_Task=1 :: Change value from 1 to 0 to disable KMS activation desktop context menu set Desktop_context_menu=1 ============================================================================ reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' " in Source: sample.bin, "tivation desktop context menu set Desktop_context_menu=1 ============================================================================ setlocal EnableDelayedExpansion reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) for /f "tokens=6 delims=[]. " %%G in ('ver') do set winbuild=%%G :: Check Windows Edition set osedition= for /f "tokens=2 delims==" %%a in ('"wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not NULL) get LicenseFamily /VALUE" 2^>nul') do if not errorlevel 1 set "osedition=%%a" if not defined osedition for /f "tokens=3 delims=: " %%a in ('DISM /English /Online /Get-CurrentEdition 2^>nul ^| find /i "Current Edition :"') do set "osedition=%%a" :: Check Installation type set instype= for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersio" in Source: sample.bin, "ls% where __CLASS='%sls%' call ClearKeyManagementServiceMachine %nul% wmic path %sls% where __CLASS='%sls%' call ClearKeyManagementServicePort %nul% reg query "HKLM\%SPPk%\%wApp%" %nul% && ( %nul% call :reg_takeownership "HKLM\%SPPk%\%wApp%" FullControl Allow S-1-5-32-544 reg delete "HKLM\%SPPk%\%wApp%" /f %nul% reg delete "HKU\S-1-5-20\%SPPk%\%wApp%" /f %nul% ) reg query "HKLM\%SPPk%\%wApp%" %nul% && ( %ELine% echo Registry Key was not cleared successfully. Aborting... goto PU_Done ) :: Set specific KMS host to Local Host :: Thanks to @abbodi1406 set setkms_error= wmic path %slp% where ID='%app%' call ClearKeyManagementServiceMachine %nul% || (set setkms_error=1) wmic path %slp% where ID='%app%' call ClearKeyManagementServicePort %nul% || (set setkms_error=1) wmic path %slp% where ID='%app%' call SetKeyManagementServiceMachine MachineName="127.0.0.2" %nul% || (set setkms_error=1) wmic path %slp% where ID='%app%' call SetKeyManagementServicePort 1688 %nul% || (set setkms_error=1)" in Source: sample.bin, "hine it's running on, and you may never need to run it again. 2- Manual Renewal via Desktop Context Menu This method is exactly same as above but here we put the following files in, C:\ProgramData\Online_KMS_Activation\BIN\cleanosppx64.exe C:\ProgramData\Online_KMS_Activation\BIN\cleanosppx86.exe C:\ProgramData\Online_KMS_Activation\Activate.cmd C:\ProgramData\Online_KMS_Activation\Info.txt and create registry entries in, HKCR\DesktopBackground\shell\Activate Windows - Office HKCR\DesktopBackground\shell\Activate Windows - Office\command It creates an easy to reach Desktop context menu for the manual activation renewal. 3- Automatic Renewal via Task Scheduler This method put the following files in, C:\ProgramData\Online_KMS_Activation\BIN\cleanosppx64.exe C:\ProgramData\Online_KMS_Activation\BIN\cleanosppx86.exe C:\ProgramData\Online_KMS_Activation\Activate.cmd C:\ProgramData\Online_KMS_Activation\Info.txt And creates a scheduled" in Source: sample.bin, "on_Script-Run_Once" >nul || (set error_=1) If not exist "%_dest%\Activate.cmd" (set error_=1) If not exist "%_dest%\Info.txt" (set error_=1) If not exist "%_dest%\BIN\cleanosppx64.exe" (set error_=1) If not exist "%_dest%\BIN\cleanosppx86.exe" (set error_=1) if defined error_ ( reg query "%key%" /f Path /s | find /i "\Online_KMS_Activation_Script-Renewal" >nul && ( schtasks /delete /tn Online_KMS_Activation_Script-Renewal /f %nul% ) reg query "%key%" /f Path /s | find /i "\Online_KMS_Activation_Script-Run_Once" >nul && ( schtasks /delete /tn Online_KMS_Activation_Script-Run_Once /f %nul% ) reg delete "HKCR\DesktopBackground\shell\Activate Windows - Office" /f %nul% If exist "%_dest%\" ( @RD /s /q "%_dest%\" %nul% ) echo _________________________________________________________________ echo: %ELine% echo Run the Online KMS Complete Uninstall script and then try again. echo _________________________________________________________________ ) else ( echo: echo __________________________" in Source: sample.bin, "========================================================================================= if defined Task ( set DateTime=1 set Renewal_Task=1 reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s | find /i "\Online_KMS_Activation_Script-Run_Once" >nul && ( set Renewal_Task= set Run_Once=1 ) ) If defined Task call :_Start_>>"%ProgramData%\Online_KMS_Activation\Logs.txt" & exit :_Start_ If defined Task call :Activation_Start & echo Exiting... & echo: & exit /b ::======================================================================================================================================== :: Set buffer height independently of window height :: https://stackoverflow.com/a/13351373 :: Written by @dbenham (stackoverflow) mode con: cols=98 lines=30 if "!_batf!"=="%ProgramData%\Online_KMS_Activation\Activate.cmd" title Online KMS Activation [%ProgramData%\Online_KMS_Activation\] %nul% %_psc% "&{$H=get-host;$W=$H.ui.rawui;$B=$W.buffer" in Source: sample.bin, " Online_KMS_Activation_Script-Run_Once schtasks /delete /tn Online_KMS_Activation_Script-Run_Once /f %nul% ) If exist "%windir%\Online_KMS_Activation_Script\" ( echo Deleting [Folder] %windir%\Online_KMS_Activation_Script\ @RD /s /q "%windir%\Online_KMS_Activation_Script\" %nul% ) If exist "%ProgramData%\Online_KMS_Activation\" ( echo Deleting [Folder] %ProgramData%\Online_KMS_Activation\ @RD /s /q "%ProgramData%\Online_KMS_Activation\" %nul% ) if exist "%ProgramData%\Online_KMS_Activation.cmd" ( echo Deleting [File] %ProgramData%\Online_KMS_Activation.cmd del /f /q "%ProgramData%\Online_KMS_Activation.cmd" %nul% ) reg query "HKCR\DesktopBackground\shell\Activate Windows - Office" %nul% && ( echo Deleting [Context Menu Registry] HKCR\DesktopBackground\shell\Activate Windows - Office Reg delete "HKCR\DesktopBackground\shell\Activate Windows - Office" /f %nul% ) echo: ::===============================================================================================================" in Source: sample.bin, "ion_Script-Run_Once" >nul && (set error_=1) If exist "%windir%\Online_KMS_Activation_Script\" (set error_=1) if exist "%ProgramData%\Online_KMS_Activation\" (set error_=1) reg query "HKCR\DesktopBackground\shell\Activate Windows - Office" >nul 2>&1 && (set error_=1) if exist "%ProgramData%\Online_KMS_Activation.cmd" (set error_=1) if defined error_ ( echo ______________________________________ %ELine% echo Try Again. echo ______________________________________ ) else ( echo _________________________________________________________________ echo: %EchoGreen% Online KMS Complete Uninstall is done successfully. echo _________________________________________________________________ ) ::======================================================================================================================================== :UN_Done echo: pause exit /b :++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++" in Source: sample.bin, "0\ClickToRun\ProductReleaseIDs" set "_OSPP15Ready=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration" ) set "_OSPP15ReadT=REG_SZ" if "%_Product15Ids%"=="" ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid" %_Nul6%') do if not errorlevel 1 (set "_Product15Ids=%%b") set "_Con15fig=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid" set "_OSPP15Ready=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun" set "_OSPP15ReadT=REG_DWORD" ) set "_Licenses15Path=%_Install15Root%\Licenses" if exist "%ProgramFiles%\Microsoft Office\Office15\OSPP.VBS" ( set "_OSPP15VBS=%ProgramFiles%\Microsoft Office\Office15\OSPP.VBS" ) else if exist "%ProgramW6432%\Microsoft Office\Office15\OSPP.VBS" ( set "_OSPP15VBS=%ProgramW6432%\Microsoft Office\Office15\OSPP.VBS" ) else if exist "%ProgramFiles(x86)%\Microsoft Office\Office15\OSPP.VBS" ( set "_OSPP15VBS=%ProgramFiles(x86)%\Microsoft Office\Offic" in Source: sample.bin, " setlocal EnableDelayedExpansion ::======================================================================================================================================== if not exist "!_work!\Activate.cmd" ( %ELine% echo File [Activate.cmd] does not exist in current folder.. echo It's required for the Task Creation. set _end=1 goto Done ) call :check cleanosppx64.exe cleanosppx86.exe if defined _miss set _end=1&goto Done ::======================================================================================================================================== set "_dest=%ProgramData%\Online_KMS_Activation" set "key=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" :ActivationRenewal cls title Online KMS Activation Renewal mode con cols=98 lines=30 set ActTask= set error_= set DelDeskCont= set error_1= if defined RenTask goto:Task if defined RenActTask set ActTask=1&goto:Task if defined DeskMenu goto:ContextMenu echo: echo: echo: echo " in Source: sample.bin, "( if %_Office15% EQU 0 (goto :%_fC2R%) else (goto :Reg15istry) ) if not exist "%_Integrator%" ( if %_Office15% EQU 0 (goto :%_fC2R%) else (goto :Reg15istry) ) if exist "%_LicensesPath%\Word2019VL_KMS_Client_AE*.xrm-ms" (set "_tag=2019"&set "_ons= 2019") else (set "_tag="&set "_ons= 2016") if %_Office15% EQU 0 goto :CheckC2R :Reg15istry set "_Install15Root=" set "_Product15Ids=" set "_Con15fig=" set "_PR15IDs=" set "_OSPP15Ready=" set "_Licenses15Path=" for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do if not errorlevel 1 (set "_Install15Root=%%b\root") if not "%_Install15Root%"=="" ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do if not errorlevel 1 (set "_Product15Ids=%%b") set "_Con15fig=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds" set "_PR15IDs=HKLM\SOFTWARE\Microsoft\Office\15." in Source: sample.bin, "========================= :: Clear-KMS-Cache.cmd :: https://forums.mydigitallife.net/posts/1511883 :: Written by @abbodi1406 (MDL) set "SysPath=%Windir%\System32" if exist "%Windir%\Sysnative\reg.exe" (set "SysPath=%Windir%\Sysnative") set "Path=%SysPath%;%Windir%;%SysPath%\Wbem;%SysPath%\WindowsPowerShell\v1.0\" set "OSPP=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" wmic path SoftwareLicensingProduct where (Description like '%%KMSCLIENT%%') get Name 2>nul | findstr /i Windows 1>nul && (set SppHook=1) || (set SppHook=0) wmic path SoftwareLicensingProduct where (Description like '%%KMSCLIENT%%') get Name 2>nul | findstr /i Office 1>nul && (set SppHook=1) wmic path OfficeSoftwareProtectionService get Version >nul 2>&1 && (set OsppHook=1) || (set OsppHook=0) if %SppHook% NEQ 0 call :UN_cKMS SoftwareLicensingProduct SoftwareLicensingService SPP if %OsppHook% NEQ 0 call :UN_cKMS OfficeSoftwareProtection" in Source: sample.bin, "t "nKMS=does not support KMS activation..." set "nEval=Evaluation Editions cannot be activated. Please install full Windows OS." if defined EditionID echo %EditionID%| findstr /I /E Eval %_Nul1% && ( set _eval=1 echo %EditionID%| findstr /I /B Server %_Nul1% && (set "nEval=Server Evaluation cannot be activated. Please convert to full Server OS.") ) set "_C16R=" reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath %_Nul3% && ( reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds %_Nul3% && set "_C16R=HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" ) set "_C15R=" reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath %_Nul3% && ( reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds %_Nul3% && set "_C15R=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration" if not defined _C15R reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid %_Nul3% && set " in Source: sample.bin, "\spp\tokens\skus') do ( if %winbuild% GEQ 9200 if exist "%SysPath%\spp\tokens\skus\%%A\*GVLK*.xrm-ms" set SSppHook=1 if %winbuild% LSS 9200 if exist "%SysPath%\spp\tokens\skus\%%A\*VLKMS*.xrm-ms" set SSppHook=1 if %winbuild% LSS 9200 if exist "%SysPath%\spp\tokens\skus\%%A\*VL-BYPASS*.xrm-ms" set SSppHook=1 ) set OsppHook=1 sc query osppsvc %_Nul3% if %errorlevel% EQU 1060 set OsppHook=0 if %winbuild% GEQ 9200 ( set OSType=Win8 set SppVer=SppExtComObj.exe ) else if %winbuild% GEQ 7600 ( set OSType=Win7 set SppVer=sppsvc.exe ) else ( goto :UnsupportedVersion ) if %OSType% EQU Win8 reg query "%IFEO%\sppsvc.exe" %_Nul3% && ( reg delete "%IFEO%\sppsvc.exe" /f %_Nul3% call :StopService sppsvc ) if %ActWindows% EQU 0 if %ActOffice% EQU 0 set "ActWindows=1" set AUR=1 if %winbuild% GEQ 9600 ( reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /f /v NoGenTicket /t REG_DWORD /d 1 %_Nul3% ) call :StopService sppsvc if %Ospp" in Source: sample.bin, ""%%~$path:i"=="" ( echo: &echo ==== ERROR ==== &echo: echo Powershell is not installed in the system. echo Aborting... goto UN_Done ) ::======================================================================================================================================== if %winbuild% LSS 7600 ( %ELine% echo Unsupported OS version Detected. echo Project is supported only for Windows 7/8/8.1/10 and their Server equivalent. goto UN_Done ) ::======================================================================================================================================== set "key=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" reg query "%key%" /f Path /s | find /i "\Online_KMS_Activation_Script-Renewal" >nul && ( echo Deleting [Task] Online_KMS_Activation_Script-Renewal schtasks /delete /tn Online_KMS_Activation_Script-Renewal /f %nul% ) reg query "%key%" /f Path /s | find /i "\Online_KMS_Activation_Script-Run_Once" >nul && ( echo Deleting [Task]" in Source: sample.bin, "_work:~-1%"=="\" set "_work=%_work:~0,-1%" set "_batf=%~f0" set "_batp=%_batf:'=''%" setlocal EnableDelayedExpansion ::======================================================================================================================================== mode con: cols=102 lines=30 :: Check Windows OS name set winos= for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2^>nul') do if not errorlevel 1 set "winos=%%b" if not defined winos for /f "tokens=2* delims== " %%a in ('"wmic os get caption /value" 2^>nul') do if not errorlevel 1 set "winos=%%b" call :K38_CheckPermAct if defined PermAct ( echo ___________________________________________________________________________________________ echo: call :K38_color1 " " %Black% &call :K38_color "Checking: %winos% is Permanently Activated." %Green% call :K38_color1 " " %Black% &call :K38_color "Activation is not required." %Gray% echo ________________________________" in Source: sample.bin, " script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. set "batf_=%~f0" set "batp_=%batf_:'=''%" %_null% reg query HKU\S-1-5-19 && ( goto :_Passed ) || ( if defined _elev goto :_E_Admin ) set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo End If echo " in Source: sample.bin, "98 lines=30 set "nul=1>nul 2>nul" set "Red="white" "DarkRed"" set "Green="white" "DarkGreen"" set "Magenta="white" "darkmagenta"" set "Gray="white" "darkgray"" set "Black="white" "Black"" set "ELine=echo: &call :PU_color "==== ERROR ====" %Red% &echo:" set line=__________________________________________________________________________________________________ ::======================================================================================================================================== if %winbuild% LSS 14393 ( %ELine% echo Unsupported OS version Detected. echo Project is supported only for Windows 10 / Server 1607 [14393] and later builds. goto PU_Done ) ::======================================================================================================================================== set slp=SoftwareLicensingProduct set sls=SoftwareLicensingService set wApp=55c92734-d682-4d71-983e-d6ec3f16059f set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectio" in Source: sample.bin, " /s | find /i "\Online_KMS_Activation_Script-Renewal" >nul && ( schtasks /delete /tn Online_KMS_Activation_Script-Renewal /f %nul% ) reg query "%key%" /f Path /s | find /i "\Online_KMS_Activation_Script-Run_Once" >nul && ( schtasks /delete /tn Online_KMS_Activation_Script-Run_Once /f %nul% ) If exist "%_dest%\" ( @RD /s /q "%_dest%\" %nul% ) If exist "%windir%\Online_KMS_Activation_Script\" ( @RD /s /q "%windir%\Online_KMS_Activation_Script\" %nul% ) If exist "%ProgramData%\Online_KMS_Activation.cmd" ( Reg delete "HKCR\DesktopBackground\shell\Activate Windows - Office" /f %nul% del /f /q "%ProgramData%\Online_KMS_Activation.cmd" %nul% set DelDeskCont=1 ) md "%_dest%\BIN\" %nul% set "_temp=%SystemRoot%\Temp\_KMS_Task_Work" if exist "%_temp%\" @RD /S /Q "%_temp%\" %nul% md "%_temp%\" %nul% call :Export renewal "%_temp%\Renewal.xml" Unicode if defined ActTask (call :Export run_once "%_temp%\Run_Once.xml" Unicode) call :Export info "%_dest%\Info.txt" ASCII copy /y /b "!_work!\BIN" in Source: sample.bin, " KMS_VL_ALL by @abbodi1406 https://forums.mydigitallife.net/posts/838808 Online KMS Activation Script https://www.nsaneforums.com/topic/316668-microsoft-activation-scripts/ - Any KMS Activator which is not compatible with KMS38, may overwrite the KMS38 activation for Windows with its own 180 days activation, thereby destroying the KMS38 activation for Windows. To prevent this accidental overwriting, you can apply KMS38 protection for Windows, check the Extras folder for more details. - Why is the script setting the specific KMS host to 127.0.0.2 (localhost)? - By doing this, global KMS IP can not replace KMS38 activation but can be used with Office and other Windows Editions. - In case you don't like it, you can remove it with following codes, open CMD as admin and enter, set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" reg delete "HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" /f reg delete "HKU\S-1-5-20\%SPPk%\55c927" in Source: sample.bin, "3f16059f" /f reg delete "HKLM\%SPPk%\0ff1ce15-a989-479d-af46-f275c6370663" /f reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort reg delete "HKU\S-1-5-20\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" /f reg delete "HKU\S-1-5-20\%SPPk%\0ff1ce15-a989-479d-af46-f275c6370663" /f reg delete "HKLM\%OSPP%\59a52881-a989-479d-af46-f275c6370663" /f reg delete "HKLM\%OSPP%\0ff1ce15-a989-479d-af46-f275c6370663" /f reg delete "HKLM\%OSPP%" /f /v KeyManagementServiceName reg delete "HKLM\%OSPP%" /f /v KeyManagementServicePort if %OsppHook% NEQ 1 ( reg delete "HKLM\%OSPP%" /f reg delete "HKU\S-1-5-20\%OSPP%" /f ) goto :eof ::======================================================================================================================================== :UN_Verify set error_= reg query "%key%" /f Path /s | find /i "\Online_KMS_Activation_Script-Renewal" >nul && (set error_=1) reg query "%key%" /f Path /s | find /i "\Online_KMS_Activat" in Source: sample.bin, ": call :PU_color "%winos% - KMS38 Activation is now protected." %Green% echo: echo Now you need to activate Office with KMS ^(If required^) echo: echo %line% goto PU_Done ::======================================================================================================================================== :Undo cls set exist_= reg query "HKLM\%SPPk%\%wApp%" %nul% && (set exist_=1) if defined exist_ ( %nul% call :reg_takeownership "HKLM\%SPPk%\%wApp%" FullControl Allow S-1-5-32-544 reg delete "HKLM\%SPPk%\%wApp%" /f %nul% reg delete "HKU\S-1-5-20\%SPPk%\%wApp%" /f %nul% ) reg query "HKLM\%SPPk%\%wApp%" %nul% && ( %ELine% echo Registry Key was not cleared successfully. Aborting... goto PU_Done ) echo: echo %line% echo: if defined exist_ ( echo Registry item deleted successfully. echo HKLM\%SPPk%\%wApp% echo: call :PU_color "KMS38 Activation is now unprotected [set to default]" %Green% ) else ( call :PU_color "It is already unprotected [set to default]" %Green% ) " in Source: sample.bin, "r /f "tokens=2 delims==" %%G in ('"wmic path %spp% where (Description like '%%KMSCLIENT%%') get ID /VALUE" 2^>nul') do (set app=%%G&call :cAPP) for /f "tokens=2 delims==" %%A in ('"wmic path %sps% get Version /VALUE"') do set ver=%%A wmic path %sps% where version='%ver%' call ClearKeyManagementServiceMachine >nul 2>&1 wmic path %sps% where version='%ver%' call ClearKeyManagementServicePort >nul 2>&1 wmic path %sps% where version='%ver%' call DisableKeyManagementServiceDnsPublishing 1 >nul 2>&1 wmic path %sps% where version='%ver%' call DisableKeyManagementServiceHostCaching 1 >nul 2>&1 goto :eof :cAPP wmic path %spp% where ID='%app%' call ClearKeyManagementServiceMachine >nul 2>&1 wmic path %spp% where ID='%app%' call ClearKeyManagementServicePort >nul 2>&1 goto :eof :cREG reg delete "HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" /f reg delete "HKLM\%SPPk%\0ff1ce15-a989-479d-af46-f275c6370663" /f reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName reg delete "HKLM\%SPPk%" /f /v KeyM" in Source: sample.bin, "nPlatform" :: Fix for the special characters limitation in path name :: Written by @abbodi1406 set "_batf=%~f0" set "_batp=%_batf:'=''%" setlocal EnableDelayedExpansion :: Check Windows OS name set winos= for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2^>nul') do if not errorlevel 1 set "winos=%%b" if not defined winos for /f "tokens=2* delims== " %%a in ('"wmic os get caption /value" 2^>nul') do if not errorlevel 1 set "winos=%%b" ::======================================================================================================================================== cls echo: echo %line% echo: echo [1] Protect KMS38 Activation from being overwritten by 180 days KMS Activators echo: echo [2] Undo changes echo: echo [3] Go back echo: echo %line% echo: choice /C:123 /N /M "> Enter Your Choice [1,2,3] : " if errorlevel 3 exit /b if errorlevel 2 goto Undo if errorlevel 1 goto Protect :" in Source: sample.bin, "rk? In the KMS activation method, the Windows Operating System first checks the KMS IP registered as a specific KMS, and if that is not defined then it checks the Global KMS IP. Another fact is that if LocalHost (127.0.0.2) is defined as KMS IP in the Windows 8.1 and 10 OS's then Windows will not accept it as a valid KMS IP. This script simply utilizes the above facts to protect the KMS38 activation from being overwritten by any alternative 'normal' 180-Day KMS Activation. Script steps- - Check if Windows is activated with KMS38, if yes, - Set that Windows edition specific KMS IP to LocalHost (127.0.0.2), HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX where X is Windows edition Activation ID. - Lock this Registry with Reg_takeownership snippet by @AveYo aka @BAU pastebin.com/XTPt0JSC - Done. - Unprotect KMS38" in Source: sample.bin, "6-9ccb-df806a2d0efe' ( call :offchk "ProjectStd-MAK" "Project Standard 2010" "ProjectStd-MAK2" "Project Standard 2010" exit /b ) if /i '%app%' EQU '92236105-bb67-494f-94c7-7f7a607929bd' ( call :offchk "VisioPrem-MAK" "Visio Premium 2010" "VisioPro-MAK" "Visio Pro 2010" exit /b ) if defined vPrem exit /b if /i '%app%' EQU 'e558389c-83c3-4b29-adfe-5e4d7f46c358' ( call :offchk "VisioPro-MAK" "Visio Pro 2010" "VisioStd-MAK" "Visio Standard 2010" exit /b ) if defined vProf exit /b if /i '%app%' EQU '9ed833ff-4f92-4f36-b370-8683a4f13275' ( call :offchk "VisioStd-MAK" "Visio Standard 2010" exit /b ) call :insKey exit /b :officeLoc set loc_off%1=0 if %1 EQU 19 ( if defined _C16R reg query %_C16R% /v ProductReleaseIds %_Nul2% | findstr 2019 %_Nul1% && set loc_off%1=1 exit /b ) for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\%1.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" ( set loc_off%1=1 if %1 EQU 16 set _O16MSI=1 if %1 EQU 15 set _O1" in Source: sample.bin, "00 ( %EchoGreen% Product Activation Successful echo Remaining Period: %gpr2% days ^(%gpr% minutes^) exit /b ) if %gpr% GTR 259200 if %Win10Gov% EQU 1 ( %EchoGreen% Product Activation Successful echo Remaining Period: %gpr2% days ^(%gpr% minutes^) exit /b ) if %gpr% EQU 259200 ( %EchoGreen% Product Activation Successful echo Remaining Period: %gpr2% days ^(%gpr% minutes^) exit /b ) cmd /c exit /b %ERRORCODE% if %ERRORCODE% NEQ 0 (%EchoRed% Product Activation Failed: 0x!=ExitCode!) else (%EchoRed% Product Activation Failed) echo Remaining Period: %gpr2% days ^(%gpr% minutes^) set activation_ok=0 exit /b :StopService sc query %1 | find /i "STOPPED" %_Nul1% || net stop %1 /y %_Nul3% sc query %1 | find /i "STOPPED" %_Nul1% || sc stop %1 %_Nul3% goto :eof :UpdateOSPPEntry if /i %1 EQU osppsvc.exe ( reg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d %KMS_IP% %_Nul3% reg add "HKLM\%OPPk%" /f /v KeyManagementServicePort /t REG_SZ /d %KMS_Port% %_Nul3% ) goto :eof :C2R" in Source: sample.bin, "/f %nul% ) reg query "%key%" /f Path /s | find /i "\Online_KMS_Activation_Script-Run_Once" >nul && ( schtasks /delete /tn Online_KMS_Activation_Script-Run_Once /f %nul% ) reg delete "HKCR\DesktopBackground\shell\Activate Windows - Office" /f %nul% If exist "%_dest%\" ( @RD /s /q "%_dest%\" %nul% ) echo _________________________________________________________________ echo: %ELine% echo Run the Online KMS Complete Uninstall script and then try again. echo _________________________________________________________________ ) else ( echo: echo __________________________________________________________________________________________ echo: if defined DelDeskCont ( %EchoYellow% Previous desktop context menu entry for Online KMS Activation is deleted. echo: ) if defined _SkipWinAct ( %EchoYellow% %_dest%\Activate.cmd is set to skip Windows Activation. echo: ) echo Files created: echo %_dest%\BIN\cleanosppx64.exe echo %_dest%\BIN\cleanosppx86.exe echo %_dest%\Activate.cmd echo %_dest%\I" in Source: sample.bin, "lear the name of the KMS server, (Optional) (It'll prevent activation auto-renewal) with the appropriate following commands: To clear the KMS Server name for Office in Win 7, or Office 2010 on Win 8 or Win 10, enter each of the following commands in the sequence which is given: set "OSPP=HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" reg delete "%OSPP%" /f /v KeyManagementServiceName 2>nul reg delete "%OSPP%" /f /v KeyManagementServicePort 2>nul reg delete "%OSPP%\59a52881-a989-479d-af46-f275c6370663" /f 2>nul reg delete "%OSPP%\0ff1ce15-a989-479d-af46-f275c6370663" /f 2>nul To clear the KMS server name for Office (except Office 2010) on Win 8 or Win 10, run the following command: set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName 2>nul reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort 2>nul reg delete "HKLM\%SPPk%\0ff1ce15-a989-479d-af46-f275c6370663" /f 2>nul reg d" in Source: sample.bin, "R2V set RunR2V=1 set "_SLMGR=%SysPath%\slmgr.vbs" if %_Debug% EQU 0 ( set "_cscript=cscript //Nologo //B" ) else ( set "_cscript=cscript //Nologo" ) sc query ClickToRunSvc %_Nul3% set error1=%errorlevel% sc query OfficeSvc %_Nul3% set error2=%errorlevel% if %error1% EQU 1060 if %error2% EQU 1060 ( goto :%_fC2R% ) set _Office16=0 for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" ( set _Office16=1 ) set _Office15=0 for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses\ProPlus*.xrm-ms" ( set _Office15=1 ) if %_Office16% EQU 0 if %_Office15% EQU 0 ( goto :%_fC2R% ) :Reg16istry if %_Office16% EQU 0 goto :Reg15istry set "_InstallRoot=" set "_ProductIds=" set "_GUID=" set "_Config=" set "_PRIDs=" set "_LicensesPath=" set "_Integrator=" for /f "skip=2 tokens=2*" %%a in (" in Source: sample.bin, "sPath=%Windir%\System32" if exist "%Windir%\Sysnative\reg.exe" (set "SysPath=%Windir%\Sysnative") set "Path=%SysPath%;%Windir%;%SysPath%\Wbem;%SysPath%\WindowsPowerShell\v1.0\" set "OSPP=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" wmic path SoftwareLicensingProduct where (Description like '%%KMSCLIENT%%') get Name 2>nul | findstr /i Windows 1>nul && (set SppHook=1) || (set SppHook=0) wmic path SoftwareLicensingProduct where (Description like '%%KMSCLIENT%%') get Name 2>nul | findstr /i Office 1>nul && (set SppHook=1) wmic path OfficeSoftwareProtectionService get Version >nul 2>&1 && (set OsppHook=1) || (set OsppHook=0) if %SppHook% NEQ 0 call :cKMS SoftwareLicensingProduct SoftwareLicensingService SPP if %OsppHook% NEQ 0 call :cKMS OfficeSoftwareProtectionProduct OfficeSoftwareProtectionService OSPP call :cREG >nul 2>&1 %EchoGreen% Cleared KMS Cache successfully. exit /b :cKMS set spp=%1 set sps=%2 fo" in Source: sample.bin, "xport HWID "%Dir%\HWID_Activation_AIO.cmd" ASCII call :_export KMS38 "%Dir%\1.." ASCII call :_export HWID_KMS38_Files "%Dir%\2.." ASCII copy /y /b "%Dir%\1.." + "%Dir%\2.." "%Dir%\KMS38_Activation_AIO.cmd" %_null% del /q /f "%Dir%\*.." %_null% call :_export KMStxt "%Dir%\Activate.cmd" ASCII call :_export KMSRenewal "%Dir%\Renewal_Setup.cmd" ASCII pushd "%Dir%\" %_null% %_psc% "$f=[io.file]::ReadAllText('!batp_!') -split ':cleanospp\:.*';iex ($f[1]);X 1;" popd call :_export HWID_FB_KMS38-KMSsetup "%Dir%\SetupComplete.cmd" ASCII set "_oem=HWID`, Fallback to KMS38 `+ Online KMS" goto $OEM$FolderCreated ::============================================================================================================= :HWIDsetup: @echo off reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) call "%~dp0HWID_Activation_AIO.cmd" /u cd /d "%SystemRoot%\Setup\" in Source: sample.bin, "l 1 (set osSKU=%%a) if not defined SKU for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if "%osSKU%"=="" ( %ELine% echo SKU value was not detected properly. Aborting... goto PU_Done ) :: Check Windows Edition with SKU value for better accuracy set osedition= call :K38_CheckEdition %nul% if "%osedition%"=="" ( %ELine% echo OS Edition was not detected properly. Aborting... goto PU_Done ) :: Check Activation ID set app= for /f "tokens=2 delims==" %%a in ('"wmic path %slp% where (ApplicationID='%wApp%' and LicenseFamily='%osedition%' and Description like '%%KMSCLIENT%%') get ID /VALUE" 2^>nul') do set "app=%%a" if "%app%"=="" ( %ELine% echo Activation ID was not detected properly. Aborting... goto PU_Done ) ::======================================================================================================================================== wmic path %s" in Source: sample.bin, "elete "HKEY_USERS\S-1-5-20\%SPPk%\0ff1ce15-a989-479d-af46-f275c6370663" /f 2>nul - Done. ==================================================================================================== Troubleshoot activation issues: ==================================================================================================== - Make sure the Internet is connected. - Reboot the system and run the activation script, and if unsuccessful, Open CMD as Admin, and enter the following command: (For Windows 10\8\8.1) Dism /online /Cleanup-Image /RestoreHealth - After its done, reboot the system and open CMD as Admin and enter the following command: sfc.exe /scannow - After it's done, reboot the system and run the activation script, and if unsuccessful, open CMD as administrator again, and enter the following command: slmgr.vbs /rearm - Reboot the system and run the activation script, and if unsuccessful, You may try to rebuild licensing Tokens.dat as suggest" in Source: sample.bin, "Product OfficeSoftwareProtectionService OSPP call :UN_cREG >nul 2>&1 echo: goto UN_Verify :UN_cKMS echo Clearing %3 KMS Cache... set spp=%1 set sps=%2 for /f "tokens=2 delims==" %%G in ('"wmic path %spp% where (Description like '%%KMSCLIENT%%') get ID /VALUE" 2^>nul') do (set app=%%G&call :UN_cAPP) for /f "tokens=2 delims==" %%A in ('"wmic path %sps% get Version /VALUE"') do set ver=%%A wmic path %sps% where version='%ver%' call ClearKeyManagementServiceMachine >nul 2>&1 wmic path %sps% where version='%ver%' call ClearKeyManagementServicePort >nul 2>&1 wmic path %sps% where version='%ver%' call DisableKeyManagementServiceDnsPublishing 1 >nul 2>&1 wmic path %sps% where version='%ver%' call DisableKeyManagementServiceHostCaching 1 >nul 2>&1 goto :eof :UN_cAPP wmic path %spp% where ID='%app%' call ClearKeyManagementServiceMachine >nul 2>&1 wmic path %spp% where ID='%app%' call ClearKeyManagementServicePort >nul 2>&1 goto :eof :UN_cREG reg delete "HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec" in Source: sample.bin, " goto :testserv :testserv set /a server_num+=1 %_psc% "$t = New-Object Net.Sockets.TcpClient;try{$t.Connect("""%KMS_IP%""", 1688)}catch{};$t.Connected" | findstr /i true 1>nul if %errorlevel% NEQ 0 ( goto :server ) else ( goto :gotserv ) :gotserv set /a online_server_count+=1 echo KMS Server: ^(%KMS_IP%^) ::======================================================================================================================================== if %_Debug% EQU 1 if defined _args echo %_args% set "_wApp=55c92734-d682-4d71-983e-d6ec3f16059f" set "_oApp=0ff1ce15-a989-479d-af46-f275c6370663" set "_oA14=59a52881-a989-479d-af46-f275c6370663" set "IFEO=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options" set "OPPk=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" for /f "tokens=6 delims=[]. " %%G in ('ver') do set winbuild=%%G set SSppHook=0 for /f %%A in ('dir /b /ad %SysPath%" in Source: sample.bin, "+++ :Insert_Key_OEMRET cls title Install Windows 10 Retail/OEM Key mode con: cols=98 lines=30 set "nul=1>nul 2>nul" set "ELine=echo: &echo ==== ERROR ==== &echo:" ::======================================================================================================================================== if %winbuild% LSS 10240 ( %ELine% echo Unsupported OS version Detected. echo Project is supported only for Windows 10. goto Ins_Done ) ::======================================================================================================================================== :: Check Windows OS name set winos= for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2^>nul') do if not errorlevel 1 set "winos=%%b" if not defined winos for /f "tokens=2* delims== " %%a in ('"wmic os get caption /value" 2^>nul') do if not errorlevel 1 set "winos=%%b" :: Check SKU value set SKU= for /f "tokens=2 delims==" %%a IN ('"wmic Path Wi" in Source: sample.bin, " EQU 1 call "%~dp0Renewal_Setup.cmd" /dcm cd /d "%SystemRoot%\Setup\" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :KMS38KMSsetup: :HWID_FB_KMS38setup: @echo off setlocal EnableDelayedExpansion reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) for /f "tokens=6 delims=[]. " %%G in ('ver') do set winbuild=%%G :: Check Windows Edition set osedition= for /f "tokens=2 delims==" %%a in ('"wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not NULL) get LicenseFamily /VALUE" 2^>nul') do if not errorlevel 1 set "osedition=%%a" if not defined osedition for /f "tokens=3 delims=: " %%a in ('DISM /English /Online /Get-CurrentEdition 2^>nul ^| find /i "Current Edition :"') do set "osedition=%%a" :: Check Installation type set instype= for /f "skip=2 toke" in Source: sample.bin, "DL_Done ) ::======================================================================================================================================== :: Check SKU value set SKU= for /f "tokens=2 delims==" %%a IN ('"wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if not defined SKU for /f "tokens=3 delims=." %%a in ('reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2^>nul') do if not errorlevel 1 (set osSKU=%%a) if "%osSKU%"=="" ( %ELine% echo SKU value was not detected properly. Aborting... goto DL_Done ) :: Check Windows Edition with SKU value for better accuracy set osedition= call :_CheckEdition %nul% if "%osedition%"=="" ( %ELine% echo [%winos% ^| %winbuild% ^| SKU:%osSKU%] HWID Activation is Not Supported. goto DL_Done ) :: Check Windows Architecture set arch= reg Query "HKLM\Hardware\Description\System\CentralProcessor\0" | find /i "x86" > nul && set arch=x86|| " in Source: sample.bin, "nfo.txt echo: echo Registry entry added: echo HKCR\DesktopBackground\shell\Activate Windows - Office echo HKCR\DesktopBackground\shell\Activate Windows - Office\command echo __________________________________________________________________________________________ echo: %EchoGreen% Desktop context menu entry for Online KMS Activation is successfully created. echo __________________________________________________________________________________________ echo: ) ::======================================================================================================================================== :Done echo: if defined Unattended ( echo Exiting in 3 seconds... if %winbuild% LSS 7600 (ping -n 3 127.0.0.1 > nul) else (timeout /t 3) exit /b ) if defined _end ( pause exit /b ) else ( echo Press any key to go back... pause >nul goto ActivationRenewal ) ::=================================================================================================================================" in Source: sample.bin, " echo Press any key to exit... pause >nul exit /b ) if %Renewal_And_Activation_Task% EQU 1 call "%~dp0Renewal_Setup.cmd" /rat if %Desktop_context_menu% EQU 1 call "%~dp0Renewal_Setup.cmd" /dcm cd /d "%SystemRoot%\Setup\" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :KMSsetup: :HWIDKMSsetup: @echo off ============================================================================ :: Change value from 1 to 0 to disable KMS Renewal And Activation Task set Renewal_And_Activation_Task=1 :: Change value from 1 to 0 to disable KMS activation desktop context menu set Desktop_context_menu=1 ============================================================================ reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) call "%~dp0HWID_Activation_AIO.cmd" /u if defined HWIDAct set SkipWinAct=/swa if %Renewal_And_A" in Source: sample.bin, "I "%_dest%\Activate.cmd"" || (set error_=1) ) else ( copy /y /b "!_work!\Activate.cmd" "%_dest%\Activate.cmd" %nul% ) if exist "%_dest%\Info.txt" ( del /f /q "%_dest%\Info.txt" %nul% ) call :Export info "%_dest%\Info.txt" ASCII reg add "HKCR\DesktopBackground\shell\Activate Windows - Office" /v "Icon" /t REG_SZ /d "%SystemRoot%%\System32\shell32.dll,71" /f >nul 2>&1 || (set error_1=1) reg add "HKCR\DesktopBackground\shell\Activate Windows - Office\command" /ve /d "%_dest%\Activate.cmd" /f %nul% || (set error_1=1) If not exist "%_dest%\Activate.cmd" (set error_=1) If not exist "%_dest%\Info.txt" (set error_=1) If not exist "%_dest%\BIN\cleanosppx64.exe" (set error_=1) If not exist "%_dest%\BIN\cleanosppx86.exe" (set error_=1) reg query "HKCR\DesktopBackground\shell\Activate Windows - Office" %nul% || (set error_1=1) if defined error_1 ( reg query "%key%" /f Path /s | find /i "\Online_KMS_Activation_Script-Renewal" >nul && ( schtasks /delete /tn Online_KMS_Activation_Script-Renewal " in Source: sample.bin, "tected. echo Project is supported only for Windows 10. goto DL_Done ) ::======================================================================================================================================== :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :DL_Passed ) || ( if defined _elev goto :DL_E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With Get" in Source: sample.bin, "ns=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v InstallationType 2^>nul') do if not errorlevel 1 set "instype=%%b" set KMS38= if "%winbuild%" GEQ "17763" if "%osedition%"=="EnterpriseS" set KMS38=1 if "%winbuild%" GEQ "17763" if "%osedition%"=="EnterpriseSN" set KMS38=1 if "%osedition%"=="EnterpriseG" set KMS38=1 if "%osedition%"=="EnterpriseGN" set KMS38=1 if not "%instype%"=="Client" echo %osedition%| findstr /I /B Server 1>nul && set KMS38=1 if defined KMS38 ( call "%~dp0KMS38_Activation_AIO.cmd" /u ) else ( call "%~dp0HWID_Activation_AIO.cmd" /u ) cd /d "%SystemRoot%\Setup\" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :HWID_FB_KMS38setup: :HWID_FB_KMS38-KMSsetup: @echo off ============================================================================ :: Change value from 1 to 0 to disable KMS Renewal And Activation Task set Renewal_And_Activation_Task=1 :: Change value from 1 to 0 to disable KMS ac" in Source: sample.bin, "5MSI=1 ) for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\%1.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" ( set loc_off%1=1 if %1 EQU 16 set _O16MSI=1 if %1 EQU 15 set _O15MSI=1 ) if %1 EQU 16 if defined _C16R ( for /f "skip=2 tokens=2*" %%a in ('reg query %_C16R% /v ProductReleaseIds') do echo %%b> "!_temp!\c2rchk.txt" for %%a in (%_V16Ids%,ProjectProX,ProjectStdX,VisioProX,VisioStdX) do ( findstr /I /C:"%%aVolume" "!_temp!\c2rchk.txt" %_Nul1% && set loc_off%1=1 ) for %%a in (%_R16Ids%) do ( findstr /I /C:"%%aRetail" "!_temp!\c2rchk.txt" %_Nul1% && set loc_off%1=1 ) exit /b ) if %1 EQU 15 if defined _C15R ( set loc_off%1=1 exit /b ) if exist "%ProgramFiles%\Microsoft Office\Office%1\OSPP.VBS" set loc_off%1=1 if %xOS%==x64 if exist "%ProgramW6432%\Microsoft Office\Office%1\OSPP.VBS" set loc_off%1=1 if %xOS%==x64 if exist "%ProgramFiles(x86)%\Microsoft Office\Office%1\OSPP.VBS" set loc_off%1=1 exit /b :insKey" in Source: sample.bin, "================================================== :: Fix for the special characters limitation in path name :: Written by @abbodi1406 set "_work=%~dp0" if "%_work:~-1%"=="\" set "_work=%_work:~0,-1%" set "_batf=%~f0" set "_batp=%_batf:'=''%" setlocal EnableDelayedExpansion ::======================================================================================================================================== mode con: cols=102 lines=31 :: Check Windows OS name set winos= for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName 2^>nul') do if not errorlevel 1 set "winos=%%b" if not defined winos for /f "tokens=2* delims== " %%a in ('"wmic os get caption /value" 2^>nul') do if not errorlevel 1 set "winos=%%b" call :DL_CheckPermAct if defined PermAct ( echo ___________________________________________________________________________________________ echo: call :DL_color1 " " %Black% &call :DL_color "Checking: %win" in Source: sample.bin, "========================================================= :========================================================================================================================================= :Activation_Start @setlocal DisableDelayedExpansion set Silent=0 set Logger=0 set Unattend=1 if %Silent% EQU 1 set Unattend=1 set "_run=nul" if %Logger% EQU 1 set _run="%~dpn0_Silent.log" set "SysPath=%SystemRoot%\System32" if exist "%SystemRoot%\Sysnative\reg.exe" (set "SysPath=%SystemRoot%\Sysnative") set "Path=%SysPath%;%SystemRoot%;%SysPath%\Wbem;%SysPath%\WindowsPowerShell\v1.0\" set "_err===== ERROR ====" set "xOS=x64" set "xBit=x64" if /i %PROCESSOR_ARCHITECTURE%==x86 (if not defined PROCESSOR_ARCHITEW6432 ( set "xOS=x86" set "xBit=x86" ) ) set "_temp=%SystemRoot%\Temp" set "_log=%~dpn0" set "_work=%~dp0" if "%_work:~-1%"=="\" set "_work=%_work:~0,-1%" for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explo" in Source: sample.bin2d:T407,Found string - Object^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo End If echo End With echo .Terminate echo End With echo CreateObject^("Shell.Application"^).ShellExecute "cmd.exe", "/c " ^& chr^(34^) ^& chr^(34^) ^& strArg^("File"^) ^& chr^(34^) ^& strLine ^& chr^(34^), "", "runas", 1 )>"!_vbsf!" (%nul% cscript //NoLogo "!_vbsf!" /File:"!_batf!" -el "!_args!") && ( del /f /q "!_vbsf!" exit /b ) || ( del /f /q "!_vbsf!" %nul% %_psc% "start cmd.exe -arg '/c \"!_PSarg:'=''!\"' -verb runas" && ( exit /b ) || ( goto :DL_E_Admin ) ) exit /b :DL_E_Admin %ELine% echo This script require administrator privileges. echo To do so, right click on this script and select 'Run as administrator'. goto DL_Done :DL_Passed ::======================================================================================; Source: "sample.bin")2e:T14ff,file/memory contains long string with (Indicator: "itation in path name :: Written by @abbodi1406 set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :Passed ) || ( if defined _elev goto :E_Admin ) ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(."; Source: "sample.bin"), file/memory contains long string with (Indicator: "======================================== :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :K38_Passed ) || ( if defined _elev goto :K38_E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(."; Source: "sample.bin"), file/memory contains long string with (Indicator: "ass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :Passed ) || ( if defined _elev goto :E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo E"; Source: "sample.bin"), file/memory contains long string with (Indicator: " script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. set "batf_=%~f0" set "batp_=%batf_:'=''%" %_null% reg query HKU\S-1-5-19 && ( goto :_Passed ) || ( if defined _elev goto :_E_Admin ) set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo End If echo "; Source: "sample.bin"), file/memory contains long string with (Indicator: "tected. echo Project is supported only for Windows 10. goto DL_Done ) ::======================================================================================================================================== :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :DL_Passed ) || ( if defined _elev goto :DL_E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With Get"; Source: "sample.bin")2f:T41d,"===================================== echo: set _1=ClipSVC set _2=wlidsvc set _3=sppsvc set _4=wuauserv for %%# in (%_1% %_2% %_3% %_4%) do call :DL_ServiceCheck %%# set "CLecho=Checking %_1% [Service Status -%Cl_state%] [Startup Type -%Cl_start_type%]" set "wlecho=Checking %_2% [Service Status -%wl_state%] [Startup Type -%wl_start_type%]" set "specho=Checking %_3% [Service Status -%sp_state%] [Startup Type -%sp_start_type%]" set "wuecho=Checking %_4% [Service Status -%wu_state%] [Startup Type -%wu_start_type%]" if not "%Cl_start_type%"=="Demand" (call :DL_color "%CLecho%" %Red% & set Clst_e=1) else (echo %CLecho%) if not "%wl_start_type%"=="Demand" (call :DL_color "%wlecho%" %Red% & set wlst_e=1) else (echo %wlecho%) if not "%sp_start_type%"=="Delayed-Auto" (call :DL_color "%specho%" %Red% & set spst_e=1) else (echo %specho%) if "%wu_start_type%"=="Disabled" (set "_C=%Red%") else (s" (Indicator: "wuauserv") in Source: sample.bin30:T18f7,Found string "itation in path name :: Written by @abbodi1406 set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :Passed ) || ( if defined _elev goto :E_Admin ) ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(." (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "======================================== :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :K38_Passed ) || ( if defined _elev goto :K38_E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(." (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "ass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :Passed ) || ( if defined _elev goto :E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo E" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string " script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. set "batf_=%~f0" set "batp_=%batf_:'=''%" %_null% reg query HKU\S-1-5-19 && ( goto :_Passed ) || ( if defined _elev goto :_E_Admin ) set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo End If echo " (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "Object^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo End If echo End With echo .Terminate echo End With echo CreateObject^("Shell.Application"^).ShellExecute "cmd.exe", "/c " ^& chr^(34^) ^& chr^(34^) ^& strArg^("File"^) ^& chr^(34^) ^& strLine ^& chr^(34^), "", "runas", 1 )>"!_vbsf!" (%nul% cscript //NoLogo "!_vbsf!" /File:"!_batf!" -el "!_args!") && ( del /f /q "!_vbsf!" exit /b ) || ( del /f /q "!_vbsf!" %nul% %_psc% "start cmd.exe -arg '/c \"!_PSarg:'=''!\"' -verb runas" && ( exit /b ) || ( goto :DL_E_Admin ) ) exit /b :DL_E_Admin %ELine% echo This script require administrator privileges. echo To do so, right click on this script and select 'Run as administrator'. goto DL_Done :DL_Passed ::======================================================================================" (Indicator: "root\cimv2"; in Source: "sample.bin"), Found string "tected. echo Project is supported only for Windows 10. goto DL_Done ) ::======================================================================================================================================== :: Elevate script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. %nul% reg query HKU\S-1-5-19 && ( goto :DL_Passed ) || ( if defined _elev goto :DL_E_Admin ) set "_batf=%~f0" set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el if defined _args set _PSarg="""%~f0""" -el """%_args%""" setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With Get" (Indicator: "root\cimv2"; in Source: "sample.bin")31:T1424,"KMS_Activation\BIN\cleanosppx86.exe C:\ProgramData\Online_KMS_Activation\Activate.cmd C:\ProgramData\Online_KMS_Activation\Info.txt Registry entries: HKCR\DesktopBackground\shell\Activate Windows - Office HKCR\DesktopBackground\shell\Activate Windows - Office\command It creates an easy to reach the Desktop context menu for the manual activation renewal. ---------------------------------------------------------- d30a0e4e5911d3ca705617d17225372731c770e2 *cleanosppx64.exe Virus Total = 0/66 39ed8659e7ca16aaccb86def94ce6cec4c847dd6 *cleanosppx86.exe Virus Total = 1/66 Virus Total Report Date: 12-11-2019 These files are official Microsoft files and in this script, these are used in cleaning office license in C2R Retail office to VL conversion process. The source of these files is the 'old' version of Microsoft Tool O15CTRRemove.diagcab You can get the original file here https://s.put.re/WFuXpyWA.z" (Indicator: ".diagcab"), " - Registry entry name and location (If desktop context menu is created). HKCR\DesktopBackground\shell\Activate Windows - Office For complete script and more info, browse the script homepage. ==================================================================================================== File Details: ==================================================================================================== d30a0e4e5911d3ca705617d17225372731c770e2 *cleanosppx64.exe Virus Total = 0/66 39ed8659e7ca16aaccb86def94ce6cec4c847dd6 *cleanosppx86.exe Virus Total = 1/66 Virus Total Report Date: 12-11-2019 These files are official Microsoft files and in this script, these are used in cleaning office license in C2R Retail office to VL conversion process. The source of these files is the 'old' version of Microsoft Tool O15CTRRemove.diagcab You can get the original file here https://s.put.re/WFuXpyWA.zip =====================" (Indicator: ".diagcab"), "llup, or the separate update KB3118401 - Additionally, Office programs themselves require recent Windows 7 updates to start properly ==================================================================================================== File Details: ==================================================================================================== d30a0e4e5911d3ca705617d17225372731c770e2 *cleanosppx64.exe Virus Total = 0/66 39ed8659e7ca16aaccb86def94ce6cec4c847dd6 *cleanosppx86.exe Virus Total = 1/66 Virus Total Report Date: 12-11-2019 These files are official Microsoft files and in this script, these are used in cleaning office license in C2R Retail office to VL conversion process. The source of these files is the 'old' version of Microsoft Tool O15CTRRemove.diagcab You can get the original file here https://s.put.re/WFuXpyWA.zip ========================================================================================" (Indicator: ".diagcab"), " Virus Total = 1/66 9d5b4b3e761cca9531d64200dfbbfa0dec94f5b0 *_Info.txt Virus Total = 0/59 Virus Total Report Date: 12-11-2019 These .exe files are official Microsoft files and in this script, these are used in cleaning office license in C2R Retail office to VL conversion process. The source of these files is the 'old' version of Microsoft Tool O15CTRRemove.diagcab You can get the original file here https://s.put.re/WFuXpyWA.zip ==================================================================================================== :7: :+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ :$OEM$Related cls set "CheckExit=if defined $OEM$Exist Goto Extract$OEM$" :: Get correct Desktop Location with powershell :: Written by @dcshoecomp (superuser.com) :: https://superuser.com/a/1413170 for /f "delims=" %%a in ('%_psc% "& {write" (Indicator: ".diagcab"), " Virus Total = 0/59 :: :: Virus Total Report Date: 12-11-2019 :: :: These files are official Microsoft files and in this script, these are used in :: cleaning office license in C2R Retail office to VL conversion process. :: :: The source of these files is the 'old' version of Microsoft Tool O15CTRRemove.diagcab :: You can get the original file here https://s.put.re/WFuXpyWA.zip :::======================================================================================================================================== :cleanospp: Compressed2TXT v5.3 Add-Type -Language CSharp -TypeDefinition @" using System.IO; public class BAT85{ public static void Decode(string tmp, string s) { MemoryStream ms=new MemoryStream(); n=0; byte[] b85=new byte[255]; string a85="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!#$&()+,-./;=?@[]^_{|}~"; int[] p85={52200625,614125,7225,85,1}; for(byte i=0;i<85;i++){b85[(byte)a85[i]]=i;} bool k=false;int p=0; foreach(char c in s){ switch(" (Indicator: ".diagcab")32:T407,"===================================== echo: set _1=ClipSVC set _2=wlidsvc set _3=sppsvc set _4=wuauserv for %%# in (%_1% %_2% %_3% %_4%) do call :DL_ServiceCheck %%# set "CLecho=Checking %_1% [Service Status -%Cl_state%] [Startup Type -%Cl_start_type%]" set "wlecho=Checking %_2% [Service Status -%wl_state%] [Startup Type -%wl_start_type%]" set "specho=Checking %_3% [Service Status -%sp_state%] [Startup Type -%sp_start_type%]" set "wuecho=Checking %_4% [Service Status -%wu_state%] [Startup Type -%wu_start_type%]" if not "%Cl_start_type%"=="Demand" (call :DL_color "%CLecho%" %Red% & set Clst_e=1) else (echo %CLecho%) if not "%wl_start_type%"=="Demand" (call :DL_color "%wlecho%" %Red% & set wlst_e=1) else (echo %wlecho%) if not "%sp_start_type%"=="Delayed-Auto" (call :DL_color "%specho%" %Red% & set spst_e=1) else (echo %specho%) if "%wu_start_type%"=="Disabled" (set "_C=%Red%") else (s" (Indicator: "wuauserv")33:T1123,"cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000000000000000000000000000000000e8eaafbd100000001800000010000000cc2d3f06c98900003f581eaa61010000010000000000000080eaafbd1000000070551daa61010000c0571eaa610100001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000033d5fc7f00009e4a63c274ae0000e04633d5fc7f000040581eaa61010000980634d5fc7f000070e01daa61010000000006d4fc7f00000000000000000000e04633d5fc7f00000300000000000000f385afd6fc7f00006e4733d5fc7f00002766afd6fc7f0000c0eaafbd (UID: 00000000-00002764) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002764) "cmd.exe" called "RtlGetVersion" with parameter 000000000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002764) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000018e4ba60ae00000018000000ae000000cb56cbddc93700003f4b2ebfa80200001d00000000000000b0e3ba60ae000000c0542dbfa802000080452ebfa80200001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000033d5fc7f00009b209990bd990000e04633d5fc7f0000404b2ebfa8020000980634d5fc7f0000d0f32dbfa8020000000006d4fc7f00000000000000000000e04633d5fc7f00000300000000000000f385afd6fc7f00006e4733d5fc7f00002766afd6fc7f0000f0e3ba60 (UID: 00000000-00001156) "cmd.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001156) "reg.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d58000002000000000000000000000000000000000000000000000078e8ca1435000000180000003500000062c789b6887e00008f41260b1b020000260000000000000010e8ca14350000007057250b1b020000203a260b1b0200001c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000033d5fc7f000045421327c9b60000e04633d5fc7f00009041260b1b020000980634d5fc7f0000505b260b1b020000000006d4fc7f00000000000000000000e04633d5fc7f00000300000000000000f385afd6fc7f00006e4733d5fc7f00002766afd6fc7f000050e8ca14 (UID: 00000000-00008452) "reg.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008452)34:T4ae,"cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002764) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002764) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002764) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002764) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001156) "cmd.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001156) "cmd.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001156) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008452) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008452) "reg.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008452) "reg.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008452)35:T3376,"cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002764) "cmd.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001156) "cmd.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001156) "reg.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008452) "reg.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008452)36:T705,"cmd.exe" loaded module "KERNEL32" at base 7ffcd5250000 "cmd.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffcd4180000 "cmd.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffcd4180000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffcd4180000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffcd6210000 "cmd.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcd4180000 "cmd.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcd4180000 "cmd.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcd4180000 "cmd.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffcb14d0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 7ffcd5250000 "cmd.exe" loaded module "NTDLL.DLL" at base 7ffcd6ad0000 "cmd.exe" loaded module "KERNELBASE" at base 7ffcd4180000 "cmd.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffcd2f40000 "reg.exe" loaded module "KERNEL32" at base 7ffcd5250000 "reg.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffcd4180000 "reg.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffcd4180000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffcd4180000 "reg.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 7ffcd6210000 "reg.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffcd4180000 "reg.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffcd4180000 "reg.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffcd4180000 "reg.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffcb14d0000 "reg.exe" loaded module "KERNEL32.DLL" at base 7ffcd5250000 "reg.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffcd2f4000037:T413,Observed system executable string:"vice and internet are both enabled. - Open a command prompt (run cmd.exe) as administrator, and enter following listed commands in the the sequence in which they are given. - Enter Retail/OEM Key, (Replace '%key%' with the key from the above list) with the following command:cscript /nologo %windir%\system32\slmgr.vbs /ipk %key% - Make sure slc.dll and gatherosstate.exe files are located in the folder, "C:\Files" and enter the following commands to generate GenuineTicket.xml file. For x86-x64 systems,pushd "C:\Files"rundll32 "C:\Files\slc.dll",PatchGatherosstatecall "C:\Files\gatherosstatemodified.exe" For ARM64 systems,call "C:\Files\gatherosstate.exe" - Now a GenuineTicket.xml file should be created in the folder "C:\Files\", copy and paste this file in the folder named, "C:\ProgramData\Microsoft\Windows\ClipSVC\GenuineTicket\" - Now apply this ticket using the following commands in this sequence:net stop ClipSVCnet start ClipSVC - Activate" [Source: MAS_1.4_AIO {CracksHash}.cmd]38:T645,"cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "cmd.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "")39:Tc86,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYMAXYIELD"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "")3a:T44d,"cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CMD.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\REG.EXE"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\MODE.COM"; Value: "") "cmd.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CHOICE.EXE"; Value: "")3b:T5000,"@setlocal DisableDelayedExpansion @echo off goto MAS_Start :9: ==================================================================================================== Credits: ==================================================================================================== Microsoft Activation Scripts (MAS): A collection of scripts for activating Microsoft products using HWID / KMS38 / Online KMS activation methods with a focus on open-source code, less antivirus detection and user-friendliness. These scripts are mostly a fork of other honourable developer's tools and scripts. Homepages- CracksHash: https://crackshash.com GitHub: https://github.com/massgravel/Microsoft-Activation-Scripts GitLab: https://gitlab.com/massgrave/microsoft-activation-scripts Maintained by @WindowsAddict To achieve this I have used the following projects as the base of this activator. I would like to say thanks to the following authors for making such awesome proj" (Indicator: "open") "script as admin and pass arguments and preventing loop :: Thanks to @hearywarlot [ https://forums.mydigitallife.net/threads/.74332/ ] for the VBS method. :: Thanks to @abbodi1406 for the powershell method and solving special characters issue in file path name. set "batf_=%~f0" set "batp_=%batf_:'=''%" %_null% reg query HKU\S-1-5-19 && ( goto :_Passed ) || ( if defined _elev goto :_E_Admin ) set "_vbsf=%temp%\admin.vbs" set _PSarg="""%~f0""" -el setlocal EnableDelayedExpansion ( echo Set strArg=WScript.Arguments.Named echo Set strRdlproc = CreateObject^("WScript.Shell"^).Exec^("rundll32 kernel32,Sleep"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& strRdlproc.ProcessId ^& "'"^) echo With GetObject^("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" ^& .ParentProcessId ^& "'"^) echo If InStr ^(.CommandLine, WScript.ScriptName^) ^<^> 0 Then echo strLine = Mid^(.CommandLine, InStr^(.CommandLine , "/File:"^) + Len^(strArg^("File"^)^) + 8^) echo End If echo" (Indicator: "Sleep"), "End With echo .Terminate echo End With echo CreateObject^("Shell.Application"^).ShellExecute "cmd.exe", "/c " ^& chr^(34^) ^& chr^(34^) ^& strArg^("File"^) ^& chr^(34^) ^& strLine ^& chr^(34^), "", "runas", 1 )>"!_vbsf!" (%_null% cscript //NoLogo "!_vbsf!" /File:"!batf_!" -el) && ( del /f /q "!_vbsf!" exit /b ) || ( del /f /q "!_vbsf!" %_null% %_psc% "start cmd.exe -arg '/c \"!_PSarg:'=''!\"' -verb runas" && ( exit /b ) || ( goto :_E_Admin ) ) exit /b :_E_Admin %ErrLine% echo This script require administrator privileges. echo To do so, right click on this script and select 'Run as administrator'. goto MASend :_Passed ::======================================================================================================================================== setlocal EnableDelayedExpansion :MainMenu cls title Microsoft Activation Scripts AIO 1.4 mode con cols=98 lines=30 set "MAS_Temp=%SystemRoot%\Temp\_MAS" if exist "%MAS_Temp%\" @RD /S /Q "%MAS_Temp%\" %_null% echo" (Indicator: "select"), "ivated because of significant hardware changes, IF your activation, was linked to an online Microsoft account. - For activation to succeed, the Windows Update Service and internet connectivity must be enabled. If you are trying to activate without these conditions being met, then the system will auto- activate later when the conditions are met. - Auto activation scenario after the Windows reinstall: - The Internet is required. (Only at the time of activation) - The system will auto-activate if Retail (Consumer) media was used for the installation. - The system will NOT auto-activate if VL (Business) media was used for the installation. In this case, the user will have to insert that windows edition Retail/OEM key (find keys below in this page) to activate, if the user doesn't wish to activate again using this script. - Possible reasons for activation failure: - The Internet is not connected. - Windows update service is disabled. - Use of a VPN and/" (Indicator: "connect"), "Windows with the following command: cscript /nologo %windir%\system32\slmgr.vbs /ato - Check Activation Status with the following command: cscript /nologo %windir%\system32\slmgr.vbs /xpr - Done. * Note - [clipup -v -o -altto ] method to apply the ticket was not suggested because of the issues in case the username have spaces or non English characters. ==================================================================================================== Troubleshoot activation issues: ==================================================================================================== - Make sure the internet is connected. - Open CMD and type services.msc and hit Enter When Services opens up look for 'Windows Update' and Make sure its startup type is set to Automatic. Some update blocking tools and scripts usually permanently block the update service you need to make sure it's not the case. - VPN, privacy-based hosts and/or firewall" (Indicator: "connect"), "rules may cause problems with the activation. Disable them if you are facing problems in activation. - Reboot the system. - Now run the script to activate Windows 10, and if unsuccessful, Try the troubleshoot button in the settings activation page. If still unsuccessful then read additional troubleshoot options listed below. -------------------------------------------- - Open CMD as administrator, and enter the following command: Dism /online /Cleanup-Image /RestoreHealth - After it's done reboot the system and open CMD as administrator again and enter the following command: sfc.exe /scannow - After it's done, reboot the system and run the activation script, and if unsuccessful, open CMD as administrator again, and enter the following command: slmgr.vbs /rearm - Reboot the system and run the activation script, and if unsuccessful, You may try to rebuild licensing Tokens.dat as suggested in https://support.microsoft.com/en-us/help" (Indicator: "open"), "/2736303 (this will require to repair Office afterwards.) - Reboot the system and run the activation script, and if unsuccessful, try cleaning the clipup using the following commands, it will reset all the HWID/KMS38 installed licences in the current system installation. open CMD as administrator again, and enter the following commands one by one: net stop ClipSVC rundll32 clipc.dll,ClipCleanUpState - Reboot the system (important) and run the activation script, and if unsuccessful, Make sure hardware component proper drivers are installed, check manufacturer site/Windows- update for drivers. - After it's done reboot the system and run the activation script and if unsuccessful it may be time to start over from the very beginning and do a clean install of windows :D ------------------------------------------- Activation is blocked in some countries - ------------------------------------------- - Microsoft servers block the activati" (Indicator: "open"), "KMS_VL_ALL by @abbodi1406 https://forums.mydigitallife.net/posts/838808 Online KMS Activation Script https://www.nsaneforums.com/topic/316668-microsoft-activation-scripts/ - Any KMS Activator which is not compatible with KMS38 may overwrite the KMS38 activation for Windows with its own 180 days activation thereby destroying the KMS38 activation for Windows. To prevent this accidental overwriting you can apply KMS38 protection for Windows check the Extras folder for more details. - Why is the script setting the specific KMS host to 127.0.0.2 (localhost)? - By doing this global KMS IP can not replace KMS38 activation but can be used with Office and other Windows Editions. - In case you don't like it, you can remove it with following codes, open CMD as admin and enter, set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" reg delete "HKLM\%SPPk%\55c92734-d682-4d71-983e-d6ec3f16059f" /f reg delete "HKU\S-1-5-20\%SPPk%\55c927" (Indicator: "open"), "- Done. ==================================================================================================== Troubleshoot activation issues: ==================================================================================================== - Make sure to completely remove any previously-installed KMS activators if any exist, before installing KMS38 activation. - Reboot the system. - Now run the script to activate Windows 10, and if unsuccessful, Try the troubleshoot button in settings activation page. If still unsuccessful then read additional troubleshoot options listed below. -------------------------------------------- - Open CMD as Admin, and enter the following command: Dism /online /Cleanup-Image /RestoreHealth - After its done, reboot the system and Open CMD as Admin, and enter the following command: sfc.exe /scannow - After it's done reboot the system and run the activation script and if unsuccessful open CMD as administrator ag" (Indicator: "open"), "ain and enter the following command: slmgr.vbs /rearm - Reboot the system (important) and run the activation script and if unsuccessful You may try to rebuild licensing Tokens.dat as suggested in https://support.microsoft.com/en-us/help/2736303 (this will require to repair Office afterwards.) - Reboot the system and run the activation script and if unsuccessful try cleaning the clipup using the following commands it will reset all the HWID/KMS38 installed licences in the current system installation. open CMD as administrator again and enter the following commands one by one: net stop ClipSVC rundll32 clipc.dll ClipCleanUpState - Reboot the system (important) and run the activation script and if unsuccessful it may be time to start over from the very beginning and do a clean install of windows :D ---------------------------------------------------------------------------------------------------- - Some machines are not able to" (Indicator: "open"), "task to run the script every 7 days. The scheduled task runs only if the system is connected to the Internet. With this method the Activation task can also be created which will run on the system login and after successful activation this task will delete itself. IMPORTANT NOTE - Some sensitive AV's may flag the Automatic Renewal via the Task, and not because of KMS, because for them it's suspicious to run long scripts in the background as Tasks. It's recommended to set exclusions in Antivirus for C:\ProgramData\Online_KMS_Activation\Activate.cmd or use the 1st or 2nd option for activation renewal. ---------------------------------------------------------------------------------------------------- ---------------------- - Remarks ---------------------- - This Online KMS Activation provides immediate global activation for Windows 8.1 and Windows 10, which means that in the following three scenarios, the system will self-activate when connected" (Indicator: "connect"), "to the internet, and also means that users will not need to manually run the activation script again. Scenario 1: Subsequent installation or alteration of any 2013, 2016, or 2019 Volume License (VL) Office product. Scenario 2: Windows edition change (with GVLK). Scenario 3: Date change, system hardware change, etc. - What is left in the system in the activation process? - Activate.cmd After activation, it leaves only the KMS Server name in the registry, which helps you to get the above-mentioned global activation feature whereby the system auto-renews the activations, so it's a good thing if you leave the server name in the registry. However you can clear this registered KMS Server name upon activation and do that open the script with notepad and set Clear-KMS-Cache to 1 from 0. What is left in the system when Renewal methods are installed has been mentioned. - This script includes the most-stable KMS servers (6+) list." (Indicator: "open"), "The server selection process is fully automatic. You don't need to worry about the server's availability. - If your system date is incorrect (beyond 180 days) and you are offline the system will be deactivated but will automatically reactivate when you correct the system date. - Why should you choose the Online KMS activation method over offline KMS? The main benefit of Online KMS activation is that it doesn't need any KMS binary file and system can be activated using some manual commands or transparent batch script files. So this is for those who don't like/have difficulties/trust issue in offline KMS because of its binary files and antivirus detections. If you prefer offline KMS then checkout an open-source activator @abbodi1406's KMS_VL_ALL https://forums.mydigitallife.net/posts/838808 ---------------------------------------------------------------------------------------------------- -------------------------------------- - Office C2R Retail to" (Indicator: "open"), "elete "HKEY_USERS\S-1-5-20\%SPPk%\0ff1ce15-a989-479d-af46-f275c6370663" /f 2>nul - Done. ==================================================================================================== Troubleshoot activation issues: ==================================================================================================== - Make sure the Internet is connected. - Reboot the system and run the activation script, and if unsuccessful, Open CMD as Admin, and enter the following command: (For Windows 10\8\8.1) Dism /online /Cleanup-Image /RestoreHealth - After its done, reboot the system and open CMD as Admin and enter the following command: sfc.exe /scannow - After it's done reboot the system and run the activation script and if unsuccessful open CMD as administrator again and enter the following command: slmgr.vbs /rearm - Reboot the system and run the activation script and if unsuccessful You may try to rebuild licensing Tokens.dat as suggest" (Indicator: "connect"), "============================================================ $OEM$ Folders [Windows Pre-Activation]: ==================================================================================================== - To create a Preactivated Windows installation .iso do the following things: Copy the "$OEM$" folder to the "sources" folder in the Windows installation media (.iso or USB). The directory will appear like this: \sources\$OEM$ in your altered .iso or on your bootable USB drive. Now use this .iso or bootable USB drive to install Windows and it will either already be activated (KMS38) as soon as it boots or will self-activate at first internet contact. ---------------------------------------------------------------------------------------------------- HWID: ---------------------------------------------------------------------------------------------------- - When using Digital License (HWID) no files are stored on the system and when connected to the internet f" (Indicator: "connect"), "or the first time the system will self-activate at that time. ---------------------------------------------------------------------------------------------------- KMS38: ---------------------------------------------------------------------------------------------------- - When using KMS38 no files are stored on the system and Windows becomes activated immediately without further actions or connectivity of any kind being required. ---------------------------------------------------------------------------------------------------- Online KMS (separately, or in combination with HWID or KMS38): ---------------------------------------------------------------------------------------------------- - It creates the following 2 Activation/Renewal Methods. You can turn off any of them in setupcomplete.cmd file ---------------------------------------------------------- 1- Automatic Renewal via Task Scheduler--- It creates following files and tasks Files:" (Indicator: "connect"), "C:\ProgramData\Online_KMS_Activation\BIN\cleanosppx64.exe C:\ProgramData\Online_KMS_Activation\BIN\cleanosppx86.exe C:\ProgramData\Online_KMS_Activation\Activate.cmd C:\ProgramData\Online_KMS_Activation\Info.txt Scheduled Tasks: \Online_KMS_Activation_Script-Renewal (Weekly) \Online_KMS_Activation_Script-Run_Once (Activation Task) The scheduled task runs only if the system is connected to the Internet. Activation Task will run on the system login and after successful activation and registering online KMS server this task will delete itself. leaving behind only one task to run weekly for the lifetime of the system. ---------------------------------------------------------- 2- Manual Renewal via Desktop Context Menu--- It creates Desktop context Menu for manual activation and renewal. It creates the following files and registry entries. Files: C:\ProgramData\Online_KMS_Activation\BIN\cleanosppx64.exe C:\ProgramData\Online_" (Indicator: "connect"), "xport HWID "%Dir%\HWID_Activation_AIO.cmd" ASCII call :_export KMS38 "%Dir%\1.." ASCII call :_export HWID_KMS38_Files "%Dir%\2.." ASCII copy /y /b "%Dir%\1.." + "%Dir%\2.." "%Dir%\KMS38_Activation_AIO.cmd" %_null% del /q /f "%Dir%\*.." %_null% call :_export KMStxt "%Dir%\Activate.cmd" ASCII call :_export KMSRenewal "%Dir%\Renewal_Setup.cmd" ASCII pushd "%Dir%\" %_null% %_psc% "$f=[io.file]::ReadAllText('!batp_!') -split ':cleanospp\:.*';iex ($f[1]);X 1;" popd call :_export HWID_FB_KMS38-KMSsetup "%Dir%\SetupComplete.cmd" ASCII set "_oem=HWID`, Fallback to KMS38 `+ Online KMS" goto $OEM$FolderCreated ::============================================================================================================= :HWIDsetup: @echo off reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) call "%~dp0HWID_Activation_AIO.cmd" /u cd /d "%SystemRoot%\Setup\" (Indicator: "select") "" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :HWIDsetup: :KMS38setup: @echo off reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) call "%~dp0KMS38_Activation_AIO.cmd" /u cd /d "%SystemRoot%\Setup\" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :KMS38setup: :KMSsetup: @echo off ============================================================================ :: Change value from 1 to 0 to disable KMS Renewal And Activation Task set Renewal_And_Activation_Task=1 :: Change value from 1 to 0 to disable KMS activation desktop context menu set Desktop_context_menu=1 ============================================================================ reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator'" (Indicator: "select") "echo Press any key to exit... pause >nul exit /b ) if %Renewal_And_Activation_Task% EQU 1 call "%~dp0Renewal_Setup.cmd" /rat if %Desktop_context_menu% EQU 1 call "%~dp0Renewal_Setup.cmd" /dcm cd /d "%SystemRoot%\Setup\" if exist "%SystemRoot%\Setup\Scripts\" @RD /S /Q "%SystemRoot%\Setup\Scripts\" exit /b :KMSsetup: :HWIDKMSsetup: @echo off ============================================================================ :: Change value from 1 to 0 to disable KMS Renewal And Activation Task set Renewal_And_Activation_Task=1 :: Change value from 1 to 0 to disable KMS activation desktop context menu set Desktop_context_menu=1 ============================================================================ reg query HKU\S-1-5-19 1>nul 2>nul || ( echo ==== Error ==== echo Right click on this file and select 'Run as administrator' echo Press any key to exit... pause >nul exit /b ) call "%~dp0HWID_Activation_AIO.cmd" /u if defined HWIDAct set SkipWinAct=/swa if %Renewal_And_A" (Indicator: "select")3c:Ta3e,"cmd.exe" wrote bytes "f0efbb5fff7f0000d0c2bb5fff7f00003073bb5fff7f0000d0e9bb5fff7f000020e2bb5fff7f0000d0adbc5fff7f00001007bd5fff7f0000d0bfbb5fff7f0000e006c15fff7f000000c0bb5fff7f000080cdbb5fff7f000080ebbb5fff7f0000" to virtual address "0x5E6943A8" (part of module "KERNELBASE.DLL") "cmd.exe" wrote bytes "e9ee675400" to virtual address "0x5F65A320" ("ExitWindowsEx@USER32.DLL") "cmd.exe" wrote bytes "e93e306400" to virtual address "0x5F55D850" ("InitiateShutdownA@ADVAPI32.DLL") "cmd.exe" wrote bytes "e9be2e6400" to virtual address "0x5F55D950" ("InitiateSystemShutdownA@ADVAPI32.DLL") "cmd.exe" wrote bytes "c0cebb5fff7f00000050be5fff7f0000c07cbe5fff7f0000c0f2bb5fff7f0000" to virtual address "0x5E694320" (part of module "KERNELBASE.DLL") "cmd.exe" wrote bytes "9013bd5fff7f00000049bc5fff7f00005071bc5fff7f0000f001bd5fff7f0000" to virtual address "0x5E6942E0" (part of module "KERNELBASE.DLL") "cmd.exe" wrote bytes "c03773f538de0000" to virtual address "0x621C24D0" (part of module "NTDLL.DLL") "cmd.exe" wrote bytes "e99ea55600" to virtual address "0x5F636630" ("GetWindowTextA@USER32.DLL") "cmd.exe" wrote bytes "e982996600" to virtual address "0x5F537140" ("AdjustTokenPrivileges@ADVAPI32.DLL") "cmd.exe" wrote bytes "e951f25300" to virtual address "0x5F6619F0" ("GetForegroundWindow@USER32.DLL") "cmd.exe" wrote bytes "e9cef36300" to virtual address "0x5F561640" ("LookupAccountSidA@ADVAPI32.DLL") "cmd.exe" wrote bytes "a071c15fff7f0000d012bc5fff7f0000b037bd5fff7f00002019bc5fff7f000090febb5fff7f00002019bc5fff7f00002019bc5fff7f00004071c15fff7f0000e01cbc5fff7f0000e01cbc5fff7f0000" to virtual address "0x5E694288" (part of module "KERNELBASE.DLL") "cmd.exe" wrote bytes "403bbc5fff7f00005075c15fff7f00001087bb5fff7f0000e076c15fff7f00002078c15fff7f00004003bd5fff7f00002076c15fff7f00004038bc5fff7f0000" to virtual address "0x5E694348" (part of module "KERNELBASE.DLL") "cmd.exe" wrote bytes "7014bb5fff7f0000001ebb5fff7f0000" to virtual address "0x5E694308" (part of module "KERNELBASE.DLL") "cmd.exe" wrote bytes "e9ce735600" to virtual address "0x5F6397C0" ("GetWindowTextW@USER32.DLL") "cmd.exe" wrote bytes "e91ea96600" to virtual address "0x5F536030" ("LookupAccountNameW@ADVAPI32.DLL") "cmd.exe" wrote bytes "e920a46600" to virtual address "0x5F5364B0" ("GetUserNameW@ADVAPI32.DLL") "cmd.exe" wrote bytes "e9d2516500" to virtual address "0x5F54B870" ("CredEnumerateW@ADVAPI32.DLL") "cmd.exe" wrote bytes "e98ebb5400" to virtual address "0x5F655140" ("GetAsyncKeyState@USER32.DLL") "cmd.exe" wrote bytes "e9602c6400" to virtual address "0x5F55DB70" ("InitiateSystemShutdownW@ADVAPI32.DLL")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790269934161,"unified_at":"2026-09-24T17:12:14.161Z","metadata":{"hashes":{"sha256":"81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7","sha1":"27cfb2c9307b81eb16a9fb71e37d53643c7ca253","md5":"be3e2e9a637970dc6074a5bf7b16a3ce","sha512":"efb6e434dadf255b2264b085d04ef70dd6a77e24d45c1aca84a52ea4cf7f3e5ec75bd02d947f1d2b02441ce5bca58a11945424907b2fec0b092a234e3bddf636","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"MAS_1.4_AIO {CracksHash}.cmd","file_type":["script","javascript"],"file_type_id":"js","file_size":2367170,"entropy":6.48,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1597460685000,"last_seen":1790105292000,"last_multi_scan":1790105292000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ulozto","evasive","batlauncher","scrinject","donut","hackkms","autokms","iframe"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":23},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":41},"sandbox_signatures":{"informative_count":87,"suspicious_count":15,"malicious_count":3,"total":105},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Script.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Application.HackTool.KMS.A.166333B0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Application.HackTool.KMS.A.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"malicious","value":"Able to execute commands through Windows command interpreter (ASP)"},{"type":"informative","value":"Runs shell commands"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve Windows product key"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve windows environment variables"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Persistence","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","identifiers":[{"type":"suspicious","value":"Found an indicator for a scheduled task trigger"},{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Able to create or schedule tasks using domain/system privileges"},{"type":"suspicious","value":"Contains scheduled task related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to restart services (Powershell command string)"},{"type":"informative","value":"Contains ability to start services (Powershell command string)"},{"type":"informative","value":"Contains ability to execute windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to stop windows services"},{"type":"informative","value":"Contains ability to stop a service (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to access Cisco VPN profile file"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Reads files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","identifiers":[{"type":"malicious","value":"References security related windows services"},{"type":"suspicious","value":"References security-related Windows services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Uses REG.EXE to query registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Able to check internet connectivity using ping command"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Able to delete scheduled task(s)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/modify Windows services (Powershell command string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Execution","technique":"Local Job Scheduling","attack_id":"T1168","attack_id_wiki":"https://attack.mitre.org/techniques/T1168","identifiers":[{"type":"malicious","value":"Found an indicator for a scheduled task trigger"}],"sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"tactic":"Persistence","technique":"File System Permissions Weakness","attack_id":"T1044","attack_id_wiki":"https://attack.mitre.org/techniques/T1044","identifiers":[{"type":"malicious","value":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"tactic":"Command and Control","technique":"Custom Command and Control Protocol","attack_id":"T1094","attack_id_wiki":"https://attack.mitre.org/techniques/T1094","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops PE files with different extensions"}],"sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"},{"type":"informative","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://forums.mydigitallife.net\", Found HTTPS url \"https://s.put.re\", Found HTTPS url \"https://www.nsaneforums.com\", Found HTTPS url \"https://github.com\", Found HTTPS url \"https://gitlab.com\", Found HTTPS url \"https://stackoverflow.com\", Found HTTPS url \"https://www.crackshash.com\", Found HTTPS url \"https://pastebin.com\", Found HTTPS url \"https://textuploader.com\", Found HTTPS url \"https://support.microsoft.com\", Found HTTPS url \"https://superuser.com\", Found HTTPS url \"https://crackshash.com\", Found HTTPS url \"https://tinyurl.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" connect \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to check internet connectivity using ping command","description":"file/memory contains long string with (Indicator: \"ping -\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016.001","id":"string-5070","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create/modify Windows services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Add-Type\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-396","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found an indicator for a scheduled task trigger","description":"file/memory contains long string with (Indicator: \"LogonTrigger\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053","id":"string-32","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to create or schedule tasks using domain/system privileges","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-675","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains scheduled task related strings","description":"file/memory contains long string with (Indicator: \"schtasks /create\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1053.005","id":"string-128","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"$29","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-688","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve Windows product key","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-694","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve windows environment variables","description":"file/memory contains long string with (Indicator: \"%processor_architecture%\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-557","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"\"set \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Environment Awareness","name":"Found registry location string related to processor","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-351","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"file/memory contains long string with (Indicator: \"findstr \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1552","id":"string-334","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"reg query\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"sc stop\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"file/memory contains long string with (Indicator: \" Win32_OperatingSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Cisco VPN profile file","description":"file/memory contains long string with (Indicator: \".pcf\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-866","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"file/memory contains long string with (Indicator: \"GetTypeFromCLSID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559.001","id":"string-569","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Get-Acl\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Get-FileHash\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-394","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Contains ability to start services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Start-Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-332","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Contains ability to restart services (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Restart-Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-379","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"file/memory contains long string with (Indicator: \"Write-Host\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"New-Object\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.001","id":"string-187","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"file/memory contains long string with (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Contains ability to execute windows services","description":"file/memory contains long string with (Indicator: \"net start \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-521","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2d","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"malicious","category":"System Security","name":"Able to execute commands through Windows command interpreter (ASP)","description":"$2e","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-847","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"file/memory contains long string with (Indicator: \"net stop\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-522","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"suspicious","category":"System Security","name":"References security-related Windows services","description":"$2f","origin":"sample.bin","mitre_attack_id":"T1574.010","id":"string-43","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to stop a service (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Stop-Service\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-274","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$30","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"servers=\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-29","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found reference to Diagnosis CAB file","description":"$31","origin":"sample.bin","id":"string-47","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-File\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-373","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Able to delete scheduled task(s)","description":"file/memory contains long string with (Indicator: \"schtasks /delete\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1562.001","id":"string-629","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/55 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"wscript.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"wscript.exe\" touched file \"%WINDIR%\\System32\\en-US\\wscript.exe.mui\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\en-US\\jscript.dll.mui\"\n \"wscript.exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\wscript.exe\"\n \"wscript.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"wscript.exe\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"behj@j0euir4_.6\"\n Pattern match: \"0mq5a8@k_e.05h\"\n Pattern match: \"0zi@mm9kahxdbnfa1i9.v\"\n Pattern match: \"z-0hrgek7m@x.njp3u\"\n Pattern match: \"rjwizk@c.ukbzxyd\"\n Pattern match: \"j9u@xv.3e\"\n Pattern match: \"ek98rt@a.za\"\n Pattern match: \"y@wxev3_zh.cclvu\"\n Pattern match: \"htdqr@-z2pxupoy_h.u1\"\n Pattern match: \"uwfhcbdl9@3y5mohu.sz\"\n Pattern match: \"s_@vxgbi.f\"\n Pattern match: \"z@9.l\"\n Pattern match: \"mq@mx.4e7jr\"\n Pattern match: \"_@kxoj.gskgh\"\n Pattern match: \"_zu.k0ba8k@bz.y\"\n Pattern match: \"o90qdgdit@doktw.e\"\n Pattern match: \"lbl6qb@r-.hiy96ssrmd0ycuqvvhz6tyw\"\n Pattern match: \"idpltbo@f.i\"\n Pattern match: \"egr@rmuv.8\"\n Pattern match: \"o@4rjdkvw.8\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"- Why is the script setting the specific KMS host to 127.0.0.2 (localhost)?\"\n Heuristic match: \"- Set specific KMS host to 127.0.0.2 [Localhost] with the following command: (Run one by one)\"\n Heuristic match: \"wmic path %spp% where ID='%app%' call SetKeyManagementServiceMachine MachineName=\"127.0.0.2\"\"\n Heuristic match: \"Another fact is that if LocalHost (127.0.0.2) is defined as KMS IP in the Windows 8.1 and 10 OS's\"\n Heuristic match: \"- Set that Windows edition specific KMS IP to LocalHost (127.0.0.2),\"\n Heuristic match: \"if %winbuild% LSS 7600 (ping -n 3 127.0.0.1 > nul) else (timeout /t 3)\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"$32","origin":"File/Memory","mitre_attack_id":"T1044","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/85 reputation engines marked \"https://crackshash.com\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002764)\n \"cmd.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001156)\n \"reg.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008452)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$33","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")\n \"cmd.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"reg.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c ver\") in Source: 00000000-00002764-00000C44-2031925764\n Observed string: \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"/c ver\") in Source: 00000000-00002764-00000C44-2031925764\n Observed string: \"/c ver\" (Indicator: \"/c ver\") in Source: cmd.exe","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"cmd.exe\" called \"CreateProcessW\" with parameter \"%WINDIR%\\system32\\cmd.exe /c ver\" - (UID: 00000000-00002764)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"reg query HKU\\S-1-5-19\" - (UID: 00000000-00002764)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"mode con cols=98 lines=30\" - (UID: 00000000-00002764)\n \"cmd.exe\" called \"CreateProcessW\" with parameter \"choice /C:123456789 /N /M \"> Enter Your Choice in the Keyboard [1\n2\n3\n4\n5\n6\n7\n8\n9] : \"\" - (UID: 00000000-00002764)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"cmd.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002764)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$35","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"\\system32\\cmd.exe /c \"; Source: \"00000000-00002764-00000C44-2031925764\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c ver\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00002764-00000C44-2031925764\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2764:304:WilStaging_02\"\n \"Local\\SM0:2764:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1156:304:WilStaging_02\"\n \"Local\\SM0:1156:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8452:304:WilStaging_02\"\n \"Local\\SM0:8452:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D48D0000\n \"reg.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D48D0000\n \"mode.com\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D48D0000\n \"choice.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at D48D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"MAS_1.4_AIO {CracksHash}.cmd\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00002764-00000C44-2031925764]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe /c ver\" [Source: 00000000-00002764-00000C44-2031925764]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00002764-00000BC0-3125120119]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" [Source: 00000000-00002764-00000BC0-3126799844]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\reg.exe\" [Source: 00000000-00002764-00000BC0-3127527111]\n Observed system executable string:\"%WINDIR%\\system32\\reg.exe\" [Source: 00000000-00002764-00000BC0-3127528341]\n Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\choice.exe\" [Source: 00000000-00002764-00000BC0-3132827780]\n Observed system executable string:\"%WINDIR%\\system32\\choice.exe\" [Source: 00000000-00002764-00000BC0-3132829939]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cmd.exe\" (UID: 00000000-00001156) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"cmd.exe\" (UID: 00000000-00001156) was launched with missing environment variables: \"PROCESSOR_ARCHITEW6432\"\n Process \"reg.exe\" (UID: 00000000-00008452) was launched with new environment variables: \"_null=\"1>nul 2>nul\", batp_=\"C:\\MAS_1.4_AIO_CracksHash_.cmd\", ErrLine=\"echo: & powershell write-host -back Black -fore Red ==== ERROR ==== &echo:\", batf_=\"C:\\MAS_1.4_AIO_CracksHash_.cmd\", EchoRed=\"powershell write-host -back Black -fore Red\", EchoGreen=\"powershell write-host -back Black -fore Green\", _psc=\"powershell\", winbuild=\"22621\"\"\n Process \"choice.exe\" (UID: 00000000-00009248) was launched with new environment variables: \"MAS_Temp=\"%WINDIR%\\Temp\\_MAS\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c ver\" (UID: 00000000-00001156)\n Spawned process \"reg.exe\" with commandline \"reg query HKU\\\\S-1-5-19\" (UID: 00000000-00008452)\n Spawned process \"mode.com\" with commandline \"mode con cols=98 lines=30\" (UID: 00000000-00000964)\n Spawned process \"choice.exe\" with commandline \"choice /C:123456789 /N /M \"> Enter Your Choic ...\" (UID: 00000000-00009248)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c ver\" (UID: 00000000-00001156)\n Spawned process \"reg.exe\" with commandline \"reg query HKU\\\\S-1-5-19\" (UID: 00000000-00008452)\n Spawned process \"mode.com\" with commandline \"mode con cols=98 lines=30\" (UID: 00000000-00000964)\n Spawned process \"choice.exe\" with commandline \"choice /C:123456789 /N /M \"> Enter Your Choic ...\" (UID: 00000000-00009248)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlref_httpspastebin.comrawjduBSazJ\" has type \"ASCII text with no line terminators\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$38","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Windows\\System32\\cmd.exe\" (UID: 2764)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"cmd.exe\" reads file \"c:\\mas_1.4_aio_crackshash_.cmd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve type of COM object","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"cmd.exe\" trying to touch file \"C:\\windows\\temp\\VxOle64.dll\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\system32\\CRYPTSP.DLL\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"\n \"cmd.exe\" trying to touch file \"C:\\\"\n \"cmd.exe\" trying to touch file \"C:\\\"C:\\MAS_1.4_AIO_CracksHash_.cmd\"\"\n \"cmd.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\cmdext.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\cmdext.dll\"\n \"cmd.exe\" trying to touch file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"cmd.exe\" trying to touch file \"C:\\MAS_1.4_AIO_CracksHash_.cmd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Program Files (x86)\\Common Files\\Oracle\\Java\\javapath\\powershell.exe\"\n \"cmd.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\powershell.exe\"\n \"cmd.exe\" trying to access non-existent file \"C:\\WINDOWS\\powershell.exe\"\n \"cmd.exe\" trying to access non-existent file \"C:\\WINDOWS\\System32\\Wbem\\powershell.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"cmd.exe\" trying to access non-existent file \"C:\\Windows\\System32\\AppLocker\\MDM\"\n \"cmd.exe\" trying to access non-existent file \"C:\\WINDOWS\\Temp\\_MAS\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"cmd.exe\" writes file \"\\device\\namedpipe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /v2/content/466deb681d25e080fffba967f909aff147bfb05b?partitionId=7&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F337f435f-f350-477a-90d1-cd47980094f9&profile=1048832&CacheId=7 HTTP/1.1Connection: Keep-Alive\n Accept: */*\n Accept-Encoding: gzip\n deflate\n User-Agent: Microsoft-Delivery-Optimization/10.1\n MS-CV: b8hq3dwkqEG74dby.18.3.1.0.0.12.1.1.1.2.1.1\n Content-Length: 0\n Host: disc601.prod.do.dsp.mp.microsoft.com\n\n GET /v2/content/a554ce2a6750a1eeb4bcced39bdd506aa044822c?partitionId=7&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F6d261191-d5b1-408e-bc47-57673032520f&profile=1048832&CacheId=7 HTTP/1.1Connection: Keep-Alive\n Accept: */*\n Accept-Encoding: gzip\n deflate\n User-Agent: Microsoft-Delivery-Optimization/10.1\n MS-CV: b8hq3dwkqEG74dby.16.3.1.0.0.18.1.1.1.2.1.1\n Content-Length: 0\n Host: disc601.prod.do.dsp.mp.microsoft.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 091f51a7a1c3a4504a224cc081ce9cee\n Observed JA3 fingerprint: 2982919ca7b9911dea9344128ed99ad6\n Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://disc601.prod.do.dsp.mp.microsoft.com/v2/content/466deb681d25e080fffba967f909aff147bfb05b?partitionId=7&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F337f435f-f350-477a-90d1-cd47980094f9&profile=1048832&CacheId=7\n Found HTTPS GET request to https://disc601.prod.do.dsp.mp.microsoft.com/v2/content/a554ce2a6750a1eeb4bcced39bdd506aa044822c?partitionId=7&doClientVersion=10.1.0.7&altCatalogId=http%3A%2F%2F1D.tlu.dl.delivery.mp.microsoft.com%2Ffilestreamingservice%2Ffiles%2F6d261191-d5b1-408e-bc47-57673032520f&profile=1048832&CacheId=7","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"cmd.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"reg.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"file/memory contains long string with (Indicator: \"where \"; File: \"MAS_1.4_AIO {CracksHash}.cmd\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Uses REG.EXE to query registry keys","description":"Process \"reg.exe\" with commandline \"reg query HKU\\\\S-1-5-19\" (UID: 00000000-00008452)","origin":"Monitored Target","mitre_attack_id":"T1012","relevance":3,"id":"target-144","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002764-00000BC0-3125120119\")\n Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\cmd.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002764-00000BC0-3126799844\")\n Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\reg.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002764-00000BC0-3127527111\")\n Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\mode.com\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002764-00000BC0-3132616148\")\n Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\choice.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00002764-00000BC0-3132827780\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"1DEE6BED121CDB0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"cmd.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"1DEE6BED121CDB0100000000000000000000000002000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"file/memory contains long string with (Indicator: \"reg query\"; File: \"MAS_1.4_AIO {CracksHash}.cmd\")\n file/memory contains long string with (Indicator: \"sc stop\"; File: \"MAS_1.4_AIO {CracksHash}.cmd\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"cmd.exe\" with commandline \"/c \"\"C:\\\\MAS_1.4_AIO_CracksHash_.cmd\" \"\" (UID: 00000000-00002764)\n Spawned process \"cmd.exe\" with commandline \"/c ver\" (UID: 00000000-00001156)\n Spawned process \"reg.exe\" with commandline \"reg query HKU\\\\S-1-5-19\" (UID: 00000000-00008452)\n Spawned process \"mode.com\" with commandline \"mode con cols=98 lines=30\" (UID: 00000000-00000964)\n Spawned process \"choice.exe\" with commandline \"choice /C:123456789 /N /M \"> Enter Your Choice in the Keyboard [1\n2\n3\n4\n5\n6\n7\n8\n9] : \"\" (UID: 00000000-00009248)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"mode.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"MODE.COM.63DD166A.bin\" as clean (type is \"PE32+ executable (console) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$3b","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\"WScript.Shell\" [Source: 81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7.cmd.bin]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\conhost.exe\" [Source: 00000000-00004768-00000BC0-69039348]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c ver\" on 2023-2-3.14:12:57.088","origin":"Monitored Target","mitre_attack_id":"T1059.003","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops executable files","description":"\"MODE.COM.63DD166A.bin\" has type \"PE32+ executable (console) x86-64 for MS Windows\"- [targetUID: 00000000-00004768]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"\"cmd.exe\" trying to access non-existent file \"%WINDIR%\\System32\\AppLocker\\MDM\"\n \"cmd.exe\" trying to access non-existent file \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath_target_114250\\POWERSHELL.EXE\"\n \"cmd.exe\" trying to access non-existent file \"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\powershell.exe\"\n \"cmd.exe\" trying to access non-existent file \"%WINDIR%\\System32\\POWERSHELL.EXE\"\n \"cmd.exe\" trying to access non-existent file \"%WINDIR%\\system32\\powershell.exe\"\n \"cmd.exe\" trying to access non-existent file \"%WINDIR%\\POWERSHELL.EXE\"\n \"cmd.exe\" trying to access non-existent file \"%WINDIR%\\powershell.exe\"\n \"cmd.exe\" trying to access non-existent file \"%WINDIR%\\System32\\wbem\\POWERSHELL.EXE\"\n \"cmd.exe\" trying to access non-existent file \"%WINDIR%\\System32\\Wbem\\powershell.exe\"\n \"cmd.exe\" trying to access non-existent file \"%WINDIR%\\Temp\\_MAS\"\n \"cmd.exe\" trying to access non-existent file \"%WINDIR%\\Temp\\_MAS\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"System Security","name":"Hooks API calls","description":"\"ExitWindowsEx@USER32.DLL\" in \"cmd.exe\"\n \"InitiateShutdownA@ADVAPI32.DLL\" in \"cmd.exe\"\n \"InitiateSystemShutdownA@ADVAPI32.DLL\" in \"cmd.exe\"\n \"GetWindowTextA@USER32.DLL\" in \"cmd.exe\"\n \"AdjustTokenPrivileges@ADVAPI32.DLL\" in \"cmd.exe\"\n \"GetForegroundWindow@USER32.DLL\" in \"cmd.exe\"\n \"LookupAccountSidA@ADVAPI32.DLL\" in \"cmd.exe\"\n \"GetWindowTextW@USER32.DLL\" in \"cmd.exe\"\n \"LookupAccountNameW@ADVAPI32.DLL\" in \"cmd.exe\"\n \"GetUserNameW@ADVAPI32.DLL\" in \"cmd.exe\"\n \"CredEnumerateW@ADVAPI32.DLL\" in \"cmd.exe\"\n \"GetAsyncKeyState@USER32.DLL\" in \"cmd.exe\"\n \"InitiateSystemShutdownW@ADVAPI32.DLL\" in \"cmd.exe\"\n \"GetUserNameA@ADVAPI32.DLL\" in \"cmd.exe\"\n \"EnumWindows@USER32.DLL\" in \"cmd.exe\"\n \"LookupAccountSidW@ADVAPI32.DLL\" in \"cmd.exe\"\n \"InitiateShutdownW@ADVAPI32.DLL\" in \"cmd.exe\"\n \"CredEnumerateA@ADVAPI32.DLL\" in \"cmd.exe\"\n \"GetKeyState@USER32.DLL\" in \"cmd.exe\"\n \"GetActiveWindow@USER32.DLL\" in \"cmd.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"MODE.COM.63DD166A.bin\" has type \"PE32+ executable (console) x86-64 for MS Windows\"- [targetUID: 00000000-00004768]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$3c","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"6/90 reputation engines marked \"https://crackshash.com\" as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/59 Antivirus vendors marked sample as malicious (13% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 4024 bytes to a remote process \"%WINDIR%\\System32\\reg.exe\" (Handle: 320)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\reg.exe\" (Handle: 320)\n \"cmd.exe\" wrote 4024 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 324)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 324)\n \"cmd.exe\" wrote 4024 bytes to a remote process \"%WINDIR%\\System32\\choice.exe\" (Handle: 312)\n \"cmd.exe\" wrote 8 bytes to a remote process \"%WINDIR%\\System32\\choice.exe\" (Handle: 312)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]}],"incidents":[{"name":"Evasive","details_count":2,"details":[{"detail":"References security related windows services"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"},{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"},{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]}],"intel_graph":{"map":{"File:74b74fdb94b4ee362fa09dc3b5287aa71c89cf25bcfe908ff9d070db54c024e3":{"type":"File","value":"74b74fdb94b4ee362fa09dc3b5287aa71c89cf25bcfe908ff9d070db54c024e3"},"File:81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7":{"type":"File","value":"81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7"},"File:82bcc86e5e296647f69a0d56bca8516e444baa590e4bc207cc1bd9eb3909c9a8":{"type":"File","value":"82bcc86e5e296647f69a0d56bca8516e444baa590e4bc207cc1bd9eb3909c9a8"}},"chains":[{"id":"sandbox_files","root":"File:81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7","edges":[{"edge_kind":"extracted","from_key":"File:81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7","to_key":"File:74b74fdb94b4ee362fa09dc3b5287aa71c89cf25bcfe908ff9d070db54c024e3"},{"edge_kind":"extracted","from_key":"File:81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7","to_key":"File:82bcc86e5e296647f69a0d56bca8516e444baa590e4bc207cc1bd9eb3909c9a8"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":50,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":9,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ulozto","evasive","batlauncher","scrinject","donut","hackkms","autokms","iframe"],"sample_flags":["User Comment","Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"6709185d5c1504918c040363","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"MAS_1.4_AIO {CracksHash}.cmd","analysis_start_time":"2024-10-11T12:21:50+00:00","indicators_count":{"informative":65,"suspicious":11,"malicious":3},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"63dd859eb0ff881c136d41c0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Application.Hacktool.KMSActivator","submit_name":"MAS_1.4_AIO Activator.cmd","analysis_start_time":"2023-02-03T22:07:28+00:00","indicators_count":{"informative":27,"suspicious":8,"malicious":2},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true},{"id":"60dc57f278265311b55226d6","environment_id":300,"environment_description":"Linux (Ubuntu 16.04, 64 bit)","state":"ERROR","error_type":"The requested environment ID \"300\" and file type \"js\" have no available execution environment","verdict":"undetected","submit_name":"MAS_1.4_AIO_CRC32_9A7B5B05 {CracksHash}.cmd","analysis_start_time":"2021-06-30T11:39:30+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"608006c20d80e53bb427a466","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":50,"submit_name":"MAS_1.4_AIO {CracksHash}.cmd","analysis_start_time":"2021-04-21T11:04:38+00:00","indicators_count":{"informative":5,"suspicious":6,"malicious":2},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"5f3750cd02a91071e1491043","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":50,"submit_name":"MAS_1.4_AIO_CRC32_9A7B5B05 {CracksHash}.cmd","analysis_start_time":"2020-08-15T03:05:04+00:00","indicators_count":{"informative":5,"suspicious":5,"malicious":2},"tags":["User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}],"processes":[{"pid":2764,"ppid":0,"name":"cmd.exe","command_line":"/c \"\"C:\\MAS_1.4_AIO_CracksHash_.cmd\" \"","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","uid":"00000000-00002764","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACqUlEQVR4Xu2U609SYRzH/ffauqgLy6ZNy5zLJl7RpnPLy4tq1VozzURQAjncEeRyTMA4XqKpUGlTy4URh8wZtckL33x7OI7GeCpOjEZNn+2zc85zfr99P89zLkVFx+PIj/a2ZnTIWgpCMrsoc/JvwHHcT49JBIGDg4OC8H8KBNc2YXY/g8O7gP1Egrr/J4gWSJCg3b24cO70LsLg8EJvn0E4wmN/P4EIv0P1iEG0gHs2AJNrFk7PghDM2J5Ca2WhJ0dmksW43o5INEb1ZUOUwPbHGExOHwxTHuhsM9CSwAmLG2qTEyrjFAm3QclYMT27QPVmQ5RA8jn7A0ESPC0E++aXhLmNd+9J8CQUWgsYiwuxnc9UbzZECSTZ2d2DxuzCE6MD6yQ4NS/XmDGiNsLDLVI9YhAl8CX+DWanFyrD4XbrbSxCq+uYCyzjscqA4XEdBpVarLxapXqzIUogwn8SXrIx3eF2yzUmYdXDKj2GxhgMKiYwMKoG65ujerMhSiDJUmgNjJU8/7kAWbUej0jwEFm11uKAnfVCoTGSr4CH//kLbIW3qf5fIVogHZ3VhYejGgzI1Qh/iPyY9y8GcKWpHfWyTuE6Hv9K9WaSk8AmeQlZHwe3xy9cM1Y7mrp60XC9G9XXmnGxrgEdN/px+aqU1G5R/enkJJBJY2cPaqRtaO3ug4+bx6BciXNVNZBUVMNqd1D16eRF4PWbdVTVN8JAdiI1VydtQWdPH1WbSV4EuvpvoaK2Hr037yDK8wiGXqK47AJOlUpgtFio+nTyItB3+x7Kq2tRVnkJpeWVKJaUC+EnTpfA6Wap+nTyIhDlYwiRn9CIchxnJOdxsuQslleC8HPZ/wt5EUixsfkWd+8/gNH8+21PJ68CufBvCMham4STQiBrJQLH48iP73Jxc3+jS4ktAAAAAElFTkSuQmCC"},{"pid":1156,"ppid":2764,"name":"cmd.exe","command_line":"/c ver","sha256":"423e0e810a69aaceba0e5670e58aff898cf0ebffab99ccb46ebb3464c3d2facb","normalized_path":"%WINDIR%\\system32\\cmd.exe","parent_uid":"00000000-00002764","uid":"00000000-00001156"},{"pid":8452,"ppid":2764,"name":"reg.exe","command_line":"reg query HKU\\S-1-5-19","sha256":"411ae446fe37b30c0727888c7fa5e88994a46dafd41aa5b3b06c9e884549afde","normalized_path":"%WINDIR%\\system32\\reg.exe","parent_uid":"00000000-00002764","uid":"00000000-00008452"},{"pid":964,"ppid":2764,"name":"mode.com","command_line":"mode con cols=98 lines=30","sha256":"6bd8df16a6500e279f570e2986d26ad769499933ba2a8911fcf9444a01d3ff30","normalized_path":"%WINDIR%\\system32\\mode.com","parent_uid":"00000000-00002764","uid":"00000000-00000964"},{"pid":9248,"ppid":2764,"name":"choice.exe","command_line":"choice /C:123456789 /N /M \"> Enter Your Choice in the Keyboard [1,2,3,4,5,6,7,8,9] : \"","sha256":"b6ea2f9d8f0777d50c4201d7ad30d27f75987618eb1cc0eaa7712cf268707a8e","normalized_path":"%WINDIR%\\system32\\choice.exe","parent_uid":"00000000-00002764","uid":"00000000-00009248"}],"all_imported_dlls":["msvcrt.dll","msctf.dll","jscript.dll","shlwapi.dll","msasn1.dll","sxs.dll","KernelBase.dll","cryptbase.dll","uxtheme.dll","cryptsp.dll","oleaut32.dll","comctl32.dll","gdi32.dll","lpk.dll","api-ms-win-core-synch-l1-2-0.dll","dwmapi.dll","shell32.dll","wshext.dll","scrobj.dll","comdlg32.dll","ole32.dll","rsaenh.dll","version.dll","kernel32.dll","rpcrt4.dll","imm32.dll","rpcss.dll","clbcatq.dll","msisip.dll","ntdll.dll","wintrust.dll","sechost.dll","user32.dll","crypt32.dll","usp10.dll","advapi32.dll","VxSSL64.dll","ws2_32.dll","fltLib.dll","gdi32full.dll","combase.dll","cmdext.dll","ureg.dll","msvcp_win.dll","kernel.appcore.dll","fsutilext.dll","ucrtbase.dll","win32u.dll","ulib.dll","bcryptprimitives.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpspastebin.comrawjduBSazJ","sha256":"74b74fdb94b4ee362fa09dc3b5287aa71c89cf25bcfe908ff9d070db54c024e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"name":"MODE.COM.63DD166A.bin","sha256":"82bcc86e5e296647f69a0d56bca8516e444baa590e4bc207cc1bd9eb3909c9a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dd859eb0ff881c136d41c0"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"path":"C:\\MAS_1.4_AIO_CRC32_9A7B5B05_CracksHash_.cmd.js","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f3750cd02a91071e1491043"},{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]},{"path":"C:\\MAS_1.4_AIO_CracksHash_.cmd.js","sources":[{"report_type":"sandbox","report_id":"608006c20d80e53bb427a466"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"name":"Local\\SM0:2764:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"name":"Local\\SM0:1156:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]},{"name":"Local\\SM0:8452:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6709185d5c1504918c040363"}]}]}},"report_ids":{"sandbox_job_ids":["6709185d5c1504918c040363","63dd859eb0ff881c136d41c0","608006c20d80e53bb427a466","5f3750cd02a91071e1491043"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Application.HackTool.KMS.A.Generic Sample 81c0ece503db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 81c0ece503db…. Malware family: Application.HackTool.KMS.A.Generic. Threat score 100/100. 2/23 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7"}],["$","meta","4",{"property":"og:title","content":"Malicious Application.HackTool.KMS.A.Generic Sample 81c0ece503db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 81c0ece503db…. Malware family: Application.HackTool.KMS.A.Generic. Threat score 100/100. 2/23 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/81c0ece503dbfb652509e886ffcc2c1c05c76d90cd166ef62347c1c26445f8c7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Application.HackTool.KMS.A.Generic Sample 81c0ece503db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 81c0ece503db…. Malware family: Application.HackTool.KMS.A.Generic. Threat score 100/100. 2/23 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3d","11",{}]]