How to have multiple colors in a Windows batch file?

34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 57:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BAT/HackTool.PicoKMS Sample ce5beb453860… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ce5beb453860…. Malware family: BAT/HackTool.PicoKMS. Threat score 100/100. 1/27 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ce5beb4538607ed074d6061e218094205bd8184b75df18b04a8230c71536157e","keywords":["Malicious","BAT/HackTool.PicoKMS","malware analysis","sandbox report","threat intelligence","ce5beb4538607ed074d6061e218094205bd8184b75df18b04a8230c71536157e"],"about":{"@type":"SoftwareApplication","name":"KMS_VL_ALL_AIO_crackshash.cmd","applicationCategory":["script","wsf"],"identifier":"ce5beb4538607ed074d6061e218094205bd8184b75df18b04a8230c71536157e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BAT/HackTool.PicoKMS","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T1a27,Found string - echo Project is supported only for Windows 7/8/8.1/10/11 and their Server equivalent.:TheEndif exist "%PUBLIC%\ReadMeAIO.html" del /f /q "%PUBLIC%\ReadMeAIO.html"if exist "%_temp%\'" del /f /q "%_temp%\'"if exist "%_temp%\`.txt" del /f /q "%_temp%\`.txt"if defined _quit goto :eofecho.if %Unattend% EQU 0 echo Press any key to exit.%_Pause%goto :eof----- Begin wsf script ---> ; Source: "KMS_VL_ALL_AIO_crackshash.cmd.bin") Found string - Set objWMIService = GetObject("winmgmts:\\.\root\CIMV2").ExecQuery(wExc,,48); Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string - Set objID = GetObject("winmgmts:\\.\root\Microsoft\Windows\Defender").ExecQuery("Select ComputerID from MSFT_MpPreference"); Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string - Set objCol = GetObject("winmgmts:\\.\root\Microsoft\Windows\Defender:MSFT_MpPreference.ComputerID='" & cid & "'"); Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string - Set objCol = GetObject("winmgmts:\\.\root\CIMV2").ExecQuery(wExc,,48); Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp") Found string - With GetObject("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" & strRdlproc.ProcessId & "'"); Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string - With GetObject("winmgmts:\\.\root\CIMV2:Win32_Process.Handle='" & .ParentProcessId & "'"); Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string - winmgmts:\\.\root\CIMV2:Win32_Process.Handle='; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp"), Found string - winmgmts:\\.\root\CIMV2:; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp"), Found string - Set objCol = GetObject("winmgmts:\\.\root\CIMV2:" & wPath); Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp"), Found string - winmgmts:\\.\root\CIMV2; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp"), Found string - winmgmts:\\.\root\Microsoft\Windows\Defender; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp"), Found string - winmgmts:\\.\root\Microsoft\Windows\Defender:MSFT_MpPreference.ComputerID='; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp")37:T4ec,"WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006716) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac0a6bf87f0000000000000000000051ed516cf87f000000000000f87f00000000000000000000a4b3262001e10000000001001a00010040dd626cf87f00008fec516cf87f0000e0ac0a6bf87f0000e0ac0a6bf87f0000000000000000000000000000f87f0000ffffff7f996a000000000000000000000000000000000000d8cefe6af87f00002a0000000000000069c3b76af87f0000310000000000000074020000000000007802000000000000110001100000000010ca7764f900000003a3f369f87f000010ca7764f900000000000000000000002b00000000000000000000000000000020b0bd6af87f0000b43fbc6af87f0000e0cefe6a (UID: 00000000-00006716)38:Tb20,file/memory contains long string with (Indicator: ""set "; File: "KMS_VL_ALL_AIO_crackshash.cmd.bin") file/memory contains long string with (Indicator: "set "; File: "KMS_VL_ALL_AIO_crackshash.cmd.bin") Found string "set color9= color A" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set "DEL=%%a"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set "param=^%~2" !" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set "param=!param:"=\"!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set "txt=^" & call :colorPrintVar 0c txt" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set complex="c:\hello world!/.\..\\a//^<%%>&|!" /^^^<%%^>^&^|!\" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set "str=%~2"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set "str=a%DEL%!%~2:\=a%DEL%\..\%DEL%%DEL%%DEL%!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set "str=!str:/=a%DEL%/..\%DEL%%DEL%%DEL%!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set "str=!str:"=\"!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642") Found string "set q=^"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "s=%~2"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "s=!%~2!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "s=!s:\=%%~n\%%~n!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "s=!s:/=%%~n/%%~n!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "s=!s::=%%~n:%%~n!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "str=a%ECHO.DEL%!str:\=a%ECHO.DEL%\..\%ECHO.DEL%%ECHO.DEL%%ECHO.DEL%!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "str=!str:/=a%ECHO.DEL%/..\%ECHO.DEL%%ECHO.DEL%%ECHO.DEL%!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "str=!%~2!"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "ECHO.COLOR=call :Echo.Color"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "ECHO.DIR=%~dp0"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "ECHO.FILE=%~nx0"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642"), Found string "set "ECHO.FULL=%ECHO.DIR%%ECHO.FILE%"" (Indicator: "set "; File: "urlref_httpsstackoverflow.coma10407642")39:T50e,file/memory contains long string with (Indicator: "%processor_architecture%"; File: "KMS_VL_ALL_AIO_crackshash.cmd.bin") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="amd64" set "xBit=x64"&set "xOS=x64"&set "_orig=%o_x64%"" (Indicator: "%processor_architecture%"; Source: "00000000-00006716.00000000.72361.46DE0000.00000004.mdmp, 00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="arm64" set "xBit=x86"&set "xOS=A" (Indicator: "%processor_architecture%"; Source: "00000000-00006716.00000000.72361.46DE0000.00000004.mdmp"), Found string "if exist "%SystemRoot%\SysArm32\cmd.exe" if /i %PROCESSOR_ARCHITECTURE%==AMD64 if not defined _rel2 (" (Indicator: "%processor_architecture%"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="arm64" set "xBit=x86"&set "xOS=A64"&set "_orig=%o_arm%"" (Indicator: "%processor_architecture%"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string "if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "xBit=x86"&set "xOS=x86"&set "_orig=%o_x86%"&set "_wow=0"&set "_bit=32"" (Indicator: "%processor_architecture%"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp")3a:Tef2,"243934ca621e6d4ed2e2f34cc130ef88a"set "_bit=64"set "_wow=1"if /i "%PROCESSOR_ARCHITECTURE%"=="amd64" set "xBit=x64"&set "xOS=x64"&set "_orig=%o_x64%"if /i "%PROCESSOR_ARCHITECTURE%"=="arm64" set "xBit=x86"&set "xOS=A64"&set "_orig=%o_arm%"if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "xBit=x86"&set "xOS=x86"&set "_orig=%o_x86%"&set "_wow=0"&set "_bit=32"if /i "%PROCESSOR_ARCHITEW6432%"=="amd64" set "xBit=x64"&set "xOS=x64"&set "_orig=%o_x64%"if /i "%PROCESSOR_ARCHITEW6432%"=="arm64" set "xBit=x86"&set "xOS=A64"&set "_orig=%o_arm%"reg query HKLM\SYSTEM\CurrentControlSet\Services\WinMgmt /v Start 2>nul | find /i "0x4" 1>nul && (goto :E_WMS)set _cwmi=0for %%# in (wmic.exe) do @if not "%%~$PATH:#"=="" (wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1)set _pwsh=1for %%# in (powershell.exe) do @if "%%~$PATH:#"=="" set _pwsh=0if not exist "%SystemRoot%\System32\WindowsPowerShell\v1.0\pow" (Indicator: " win32_computersystem"; File: "KMS_VL_ALL_AIO_crackshash.cmd.bin") "k!"set "_suf="set "_qr=%_zz7% Win32_OperatingSystem %_zz3% LocalDateTime %_zz8%"if %_Debug% EQU 1 if exist "!_log!_Debug.log" (for /f "tokens=2 delims==." %%# in ('%_qr%') do set "_date=%%#"set "_suf=_!_date:~8,6!")if %_Debug% EQU 0 ( set "_Nul1=1>nul" set "_Nul2=2>nul" set "_Nul6=2^>nul" set "_Nul3=1>nul 2>nul" set "_Pause=pause >nul" if %Unattend% EQU 1 set "_Pause=" if %Silent% EQU 0 (call :Begin) else (call :Begin >!_run! 2>&1)) else ( set "_Nul1=" set "_Nul2=" set "_Nul6=" set "_Nul3=" set "_Pause=" if %Silent% EQU 0 ( echo. echo Running in Debug Mode... if not defined _args (echo The window will be closed when finished) else (echo please wait...) echo. echo writing debug log to: echo "!_log!_Debug!_suf!.log" ) @echo on @prompt $G @call :Begin >"!_log!_tmp.log" 2>&1 &cmd /u /c type "!_log!_tmp.log">"!_log!_Debug!_suf!.log"&del "!_log!_tmp.log")@color 07@title %ComSpec%@echo off@exit /b:Beginif %_Debug%" (Indicator: " win32_operatingsystem"; File: "KMS_VL_ALL_AIO_crackshash.cmd.bin"), "s OFF or the registry path is excluded.)set WMIe=0call :CheckWSif %WMIe% EQU 1 (echo.echo %_err%echo Failed running WMI query check.echo.echo Verify that these services are working correctly:echo Windows Management Instrumentation [WinMgmt]echo Software Protection [sppsvc])goto :eof:CheckWSset "_qrw=%_zz1% Win32_ComputerSystem %_zz3% CreationClassName %_zz4%"set "_qrs=%_zz1% SoftwareLicensingService %_zz3% Version %_zz4%"%_qrs% %_Nul2% | findstr /r "[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*" %_Nul1% || ( set WMIe=1 %_qrw% %_Nul2% | find /i "ComputerSystem" %_Nul1% && ( echo Error: SPP is not responding ) || ( echo Error: WMI ^& SPP are not responding ))goto :eof:cREGreg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%"reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "1688"reg delete "HKLM\%SPPk%" /f /v DisableDnsPublishingreg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCachingreg delete "" (Indicator: " win32_computersystem"; File: "KMS_VL_ALL_AIO_crackshash.cmd.bin") "wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1" (Indicator: " win32_computersystem"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") "set "_qr=%_zz7% Win32_OperatingSystem %_zz3% LocalDateTime %_zz8%"" (Indicator: " win32_operatingsystem"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp") "set "_qrw=%_zz1% Win32_ComputerSystem %_zz3% CreationClassName %_zz4%"" (Indicator: " win32_computersystem"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp")3b:T5cb6,Found reference to API (Indicator: "MoveFile"; Source: "00000000-00006716.00000000.72361.46DE0000.00000004.mdmp, 00000000-00006716.00000000.72361.DAC50000.00000002.mdmp") Found reference to API (Indicator: "CopyFile"; Source: "00000000-00006716.00000000.72361.46DE0000.00000004.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found reference to API (Indicator: "ShellExecute"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00006716.00000000.72361.5C722000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00006716.00000000.72361.DAAC0000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "PostThreadMessageA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "StringFromCLSID"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "IsTextUnicode"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongPtrA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongPtrA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "EnumThreadWindows"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetClassNameA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "PostMessageA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "LoadStringA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CharNextA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00006716.00000000.72361.DAC45000.00000002.mdmp")3c:T7a5,file/memory contains long string with (Indicator: "cmd.exe /c"; File: "KMS_VL_ALL_AIO_crackshash.cmd.bin") file/memory contains long string with (Indicator: "\system32\cmd.exe /c "; File: "KMS_VL_ALL_AIO_crackshash.cmd.bin") Found string "start %SystemRoot%\Sysnative\cmd.exe /c ""!_cmdf!" -wow %*"" (Indicator: "cmd.exe /c"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string "start %SystemRoot%\SysArm32\cmd.exe /c ""!_cmdf!" -arm %*"" (Indicator: "cmd.exe /c"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp") Found string "reg add HKLM\SOFTWARE\Classes\batfile\shell\runas\command /f /v "" /t REG_EXPAND_SZ /d "%_r%\System32\cmd.exe /C \"\"%1\" %*\""" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp") Found string "reg add HKLM\SOFTWARE\Classes\batfile\shell\runas\command /f /v "" /t REG_EXPAND_SZ /d "%_r%\System32\cmd.exe /C \"\"%1\" %*\""" (Indicator: "cmd.exe /c"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp") Found string "reg add HKLM\SOFTWARE\Classes\cmdfile\shell\runas\command /f /v "" /t REG_EXPAND_SZ /d "%_r%\System32\cmd.exe /C \"\"%1\" %*\""" (Indicator: "\system32\cmd.exe /c "; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp") Found string "reg add HKLM\SOFTWARE\Classes\cmdfile\shell\runas\command /f /v "" /t REG_EXPAND_SZ /d "%_r%\System32\cmd.exe /C \"\"%1\" %*\""" (Indicator: "cmd.exe /c"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp") Found string "cmd.exe /c ""!_batf!" !_para!"" (Indicator: "cmd.exe /c"; Source: "00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp")3d:T16695,"243934ca621e6d4ed2e2f34cc130ef88a"set "_bit=64"set "_wow=1"if /i "%PROCESSOR_ARCHITECTURE%"=="amd64" set "xBit=x64"&set "xOS=x64"&set "_orig=%o_x64%"if /i "%PROCESSOR_ARCHITECTURE%"=="arm64" set "xBit=x86"&set "xOS=A64"&set "_orig=%o_arm%"if /i "%PROCESSOR_ARCHITECTURE%"=="x86" if "%PROCESSOR_ARCHITEW6432%"=="" set "xBit=x86"&set "xOS=x86"&set "_orig=%o_x86%"&set "_wow=0"&set "_bit=32"if /i "%PROCESSOR_ARCHITEW6432%"=="amd64" set "xBit=x64"&set "xOS=x64"&set "_orig=%o_x64%"if /i "%PROCESSOR_ARCHITEW6432%"=="arm64" set "xBit=x86"&set "xOS=A64"&set "_orig=%o_arm%"reg query HKLM\SYSTEM\CurrentControlSet\Services\WinMgmt /v Start 2>nul | find /i "0x4" 1>nul && (goto :E_WMS)set _cwmi=0for %%# in (wmic.exe) do @if not "%%~$PATH:#"=="" (wmic path Win32_ComputerSystem get CreationClassName /value 2>nul | find /i "ComputerSystem" 1>nul && set _cwmi=1)set _pwsh=1for %%# in (powershell.exe) do @if "%%~$PATH:#"=="" set _pwsh=0if not exist "%SystemRoot%\System32\WindowsPowerShell\v1.0\pow" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "ershell.exe" set _pwsh=0if %_pwsh% equ 0 goto :E_PSset psfull=12>nul %_psc% $ExecutionContext.SessionState.LanguageMode | find /i "Full" 1>nul || set psfull=0if %psfull% equ 0 goto :E_LMset _dllPath=%SystemRoot%\System32if %xOS%==A64 %_psc% $env:PROCESSOR_ARCHITECTURE 2>nul | find /i "x86" 1>nul && set _dllPath=%SystemRoot%\Sysnativeset _dllNum=1if %xOS%==x64 set _dllNum=2if %xOS%==A64 set _dllNum=3set preparedcolor=01>nul 2>nul reg query HKU\S-1-5-19 && ( goto :Passed ) || ( if defined _elev goto :E_Admin)set _PSarg="""%~f0""" %_args% -elevatedset _PSarg=%_PSarg:'=''%(1>nul 2>nul cscript //NoLogo "%~f0?.wsf" //job:ELAV /File:"%~f0" %_args% -elevated) && ( exit /b ) || ( call setlocal EnableDelayedExpansion 1>nul 2>nul %SysPath%\WindowsPowerShell\v1.0\%_psc% "start cmd.exe -arg '/c \"!_PSarg!\"' -verb runas" && ( exit /b ) || ( goto :E_Admin )):Passedif not exist "%SystemRoot%\Temp\" mkdir "%SystemRoot%\Temp" 1>nul 2>nuls" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "et "_batf=%~f0"set "_batp=%_batf:'=''%"set "_utemp=%TEMP%"set "_Local=%LocalAppData%"set "_temp=%SystemRoot%\Temp"set "_log=%~dpn0"set "_work=%~dp0"if "%_work:~-1%"=="\" set "_work=%_work:~0 -1%":: set _UNC=0:: if "%_work:~0 2%"=="\\" (:: set _UNC=1:: ) else (:: net use %~d0 %_Null%:: if not errorlevel 1 set _UNC=1:: )for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "_dsk=%%b"if exist "%PUBLIC%\Desktop\desktop.ini" set "_dsk=%PUBLIC%\Desktop"set "_mO21a=Detected Office 2021 C2R Retail is activated"set "_mO19a=Detected Office 2019 C2R Retail is activated"set "_mO16a=Detected Office 2016 C2R Retail is activated"set "_mO15a=Detected Office 2013 C2R Retail is activated"set "_mO21c=Detected Office 2021 C2R Retail could not be converted to Volume"set "_mO19c=Detected Office 2019 C2R Retail could not be converted to Volume"set "_mO16c=Detected Office 2016 C2R Retail could no" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "sionalE ProfessionalN Ultimate UltimateE UltimateN"if exist "%SystemRoot%\Servicing\Packages\Microsoft-Windows-Server*Edition~*.mum" (set "ESUEditions=ServerDatacenter ServerDatacenterCore ServerDatacenterV ServerDatacenterVCore ServerStandard ServerStandardCore ServerStandardV ServerStandardVCore ServerEnterprise ServerEnterpriseCore ServerEnterpriseV ServerEnterpriseVCore")for /f "tokens=6 delims=[]. " %%G in ('ver') do set winbuild=%%Gset UBR=0if %winbuild% GEQ 7601 for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR 2^>nul') do if not errorlevel 1 set /a UBR=%%bset "_csg=cscript.exe //NoLogo //Job:WmiMulti "%~nx0?.wsf""set "_csq=cscript.exe //NoLogo //Job:WmiQuery "%~nx0?.wsf""set "_csm=cscript.exe //NoLogo //Job:WmiMethod "%~nx0?.wsf""set "_csp=cscript.exe //NoLogo //Job:WmiPKey "%~nx0?.wsf""set "_csx=cscript.exe //NoLogo //Job:XPDT "%~nx0?.wsf""set "_csd=cscript.exe //NoLogo //Job:MPS "%~nx0?.wsf""if %_cwmi% EQU 0 set WMI_VBS=" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "1if %WMI_VBS% EQU 0 (set "_zz1=wmic path"set "_zz2=where"set "_zz3=get"set "_zz4=/value"set "_zz5=("set "_zz6=)"set "_zz7="wmic path"set "_zz8=/value"") else (set "_zz1=%_csq%"set "_zz2="set "_zz3="set "_zz4="set "_zz5=""set "_zz6=""set "_zz7=%_csq%"set "_zz8=")set _WSH=1reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)if %_WSH% EQU 0 if %WMI_VBS% NEQ 0 goto :E_VBSset _NCS=1if %winbuild% LSS 10586 set _NCS=0if %winbuild% GEQ 10586 reg query "HKCU\Console" /v ForceV2 2>nul | find /i "0x0" 1>nul && (set _NCS=0)setlocal EnableDelayedExpansionset "_oem=!_work!"copy /y nul "!_work!\#.rw" 1>nul 2>nul && (if exist "!_work!\#.rw" del /f /q "!_work!\#.rw") || (set "_oem=!_dsk!"set "_log=!_dsk!\%~n0"if %Logger% EQU 1 set _run="!_dsk!\%~n0_Silent.log")pushd "!_wor" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "EQU 1 (if defined _args echo %_args%echo "!_batf!")if exist "%PUBLIC%\ReadMeAIO.html" del /f /q "%PUBLIC%\ReadMeAIO.html"if exist "%_temp%\'" del /f /q "%_temp%\'"if exist "%_temp%\`.txt" del /f /q "%_temp%\`.txt"set _verb=0set "_wApp=55c92734-d682-4d71-983e-d6ec3f16059f"set "_oApp=0ff1ce15-a989-479d-af46-f275c6370663"set "_oA14=59a52881-a989-479d-af46-f275c6370663"set "IFEO=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"set "OPPk=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"set _Hook="%SysPath%\SppExtComObjHook.dll"set w7inf=%SystemRoot%\Migration\WTR\KMS_VL_ALL.infset "_TaskEx=\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger"set "_TaskOs=\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogon"set "line1============================================================="set "line2=************************************************************" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "ens\skus\Security-SPP-Component-SKU-%%A\*.xrm-ms" set ESU_EDT=1):: if %ESU_EDT% EQU 1 set SSppHook=1set ESU_ADD=0if %winbuild% GEQ 9200 ( set OSType=Win8 set SppVer=SppExtComObj.exe) else if %winbuild% GEQ 7600 ( set OSType=Win7 set SppVer=sppsvc.exe) else ( goto :UnsupportedVersion)if %OSType% EQU Win8 reg query "%IFEO%\sppsvc.exe" %_Nul3% && (reg delete "%IFEO%\sppsvc.exe" /f %_Nul3%call :StopService sppsvc)set kNext=HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext:: set _Identity=0:: dir /b /s /a:-d "!_Local!\Microsoft\Office\Licenses\*1*" %_Nul3% && set _Identity=1:: dir /b /s /a:-d "!ProgramData!\Microsoft\Office\Licenses\*1*" %_Nul3% && set _Identity=1:: if %_Identity% EQU 1 set _uRI=%KMS_RenewalInterval%set _uAI=%KMS_ActivationInterval%set _dDbg=Noif %ActWindows% EQU 0 if %ActOffice% EQU 0 set ActWindows=1if %_Debug% EQU 1 if not defined fAUR set fAUR=0&set External=0if %Unattend% EQU 1 if not defined fAUR set fAUR=0&set" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "f %_Debug% EQU 0 (%_Nul3% %_psc% "&%_buf%"if %Unattend% EQU 0 title %_title%)if %winbuild% GEQ 9600 ( reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f %_Nul3% if %winbuild% EQU 14393 reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoAcquireGT /t REG_DWORD /d 1 /f %_Nul3%)echo.echo Activation Mode: %mode%call :StopService sppsvcif %OsppHook% NEQ 0 call :StopService osppsvcif %External% EQU 0 if %_ReAR% EQU 0 (set _verb=0&set _rtr=ReturnHook&goto :InstallHook):ReturnHookif %External% EQU 0 if %_AUR% EQU 1 (call :UpdateIFEOEntry %SppVer%call :UpdateIFEOEntry osppsvc.exe)if %External% EQU 1 if %_AUR% EQU 1 (call :UpdateOSPPEntry osppsvc.exe)SET Win10Gov=0SET "EditionWMI="SET "EditionID="IF %winbuild% LSS 14393 if %SSppHook% NEQ 0 GOTO :MainSET "RegKey=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "\Packages"SET "Pattern=Microsoft-Windows-*Edition~31bf3856ad364e35"SET "EditionPKG=FFFFFFFF"FOR /F "TOKENS=8 DELIMS=\" %%A IN ('REG QUERY "%RegKey%" /f "%Pattern%" /k %_Nul6% ^| FIND /I "CurrentVersion"') DO ( REG QUERY "%RegKey%\%%A" /v "CurrentState" %_Nul2% | FIND /I "0x70" %_Nul1% && ( FOR /F "TOKENS=3 DELIMS=-~" %%B IN ('ECHO %%A') DO SET "EditionPKG=%%B" ))IF /I "%EditionPKG:~-7%"=="Edition" (SET "EditionID=%EditionPKG:~0,-7%") ELSE (FOR /F "TOKENS=3 DELIMS=: " %%A IN ('DISM /English /Online /Get-CurrentEdition %_Nul6% ^| FIND /I "Current Edition :"') DO SET "EditionID=%%A")net start sppsvc /y %_Nul3%set "_qr=%_zz7% SoftwareLicensingProduct %_zz2% %_zz5%ApplicationID='%_wApp%' %adoff% AND PartialProductKey is not NULL%_zz6% %_zz3% LicenseFamily %_zz8%"FOR /F "TOKENS=2 DELIMS==" %%A IN ('%_qr% %_Nul6%') DO SET "EditionWMI=%%A"IF "%EditionWMI%"=="" (IF %winbuild% GEQ 17063 FOR /F "SKIP=2 TOKENS=2*" %%A IN ('REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "" /v EditionId') DO SET "EditionID=%%B"IF %winbuild% LSS 14393 ( FOR /F "SKIP=2 TOKENS=2*" %%A IN ('REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionId') DO SET "EditionID=%%B" GOTO :Main ))IF NOT "%EditionWMI%"=="" SET "EditionID=%EditionWMI%"IF /I "%EditionID%"=="IoTEnterprise" SET "EditionID=Enterprise"IF /I "%EditionID%"=="IoTEnterpriseS" IF %winbuild% LSS 22610 (SET "EditionID=EnterpriseS"IF %winbuild% GEQ 19041 IF %UBR% GEQ 2788 SET "EditionID=IoTEnterpriseS")IF /I "%EditionID%"=="ProfessionalSingleLanguage" SET "EditionID=Professional"IF /I "%EditionID%"=="ProfessionalCountrySpecific" SET "EditionID=Professional"IF /I "%EditionID%"=="EnterpriseG" SET Win10Gov=1IF /I "%EditionID%"=="EnterpriseGN" SET Win10Gov=1:Mainif defined EditionID (set "_winos=Windows %EditionID% edition") else (set "_winos=Detected Windows")for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName %_Nul6%') do if n" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "ot errorlevel 1 set "_winos=%%b"set "nKMS=does not support KMS activation..."set "nEval=Evaluation Editions cannot be activated. Please install full Windows OS."if exist "%SystemRoot%\Servicing\Packages\Microsoft-Windows-*EvalEdition~*.mum" set _eval=1if exist "%SystemRoot%\Servicing\Packages\Microsoft-Windows-Server*EvalEdition~*.mum" set "nEval=Server Evaluation cannot be activated. Please convert to full Server OS."if exist "%SystemRoot%\Servicing\Packages\Microsoft-Windows-Server*EvalCorEdition~*.mum" set _eval=1&set "nEval=Server Evaluation cannot be activated. Please convert to full Server OS."set "_C16R="reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath %_Nul3% && for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" (reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds %_Nul3% && set "_C16R=HKLM\SOFTWARE\Microsoft\Office\ClickT" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "oRun\Configuration")if not defined _C16R reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath %_Nul3% && for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" (reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds %_Nul3% && set "_C16R=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration")set "_C15R="reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath %_Nul3% && for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses\ProPlus*.xrm-ms" (reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds %_Nul3% && call set "_C15R=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration"if not defined _C15R reg query HKLM\SOFTWARE\Microsoft\Office\15.0\" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "ClickToRun\propertyBag /v productreleaseid %_Nul3% && call set "_C15R=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag")set "_C14R="if %_wow%==0 (reg query HKLM\SOFTWARE\Microsoft\Office\14.0\CVH /f Click2run /k %_Nul3% && set "_C14R=1") else (reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH /f Click2run /k %_Nul3% && set "_C14R=1")for %%A in (14,15,16,19,21) do call :officeLoc %%Aif %_O14MSI% EQU 1 set "_C14R="set S_OK=1call :RunSPPif %ActOffice% NEQ 0 call :RunOSPPif %ActOffice% EQU 0 (echo.&echo Office activation is OFF...)if %S_OK% EQU 0 if %External% EQU 0 call :CheckFRif exist "!_temp!\crv*.txt" del /f /q "!_temp!\crv*.txt"if exist "!_temp!\*chk.txt" del /f /q "!_temp!\*chk.txt"if exist "!_temp!\slmgr.vbs" del /f /q "!_temp!\slmgr.vbs"call :StopService sppsvcif %OsppHook% NEQ 0 call :StopService osppsvcif %_AUR% EQU 0 call :RemoveHooksc start sppsvc trigger=timer;sessionid=0 %_Nul3%if %_verb% EQU 1 (echo.&echo %line3%&echo.if %Extern" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "checking KMS Activation ID^(s^) for Windows.&echo Either sppsvc service or SppExtComObjHook.dll is not functional.&call :CheckWS exit /b ) ))if %WinVL% EQU 0 if %Off1ce% EQU 0 exit /bif %_AUR% EQU 0 (reg delete "HKLM\%SPPk%\%_wApp%" /f %_Null%rem reg delete "HKLM\%SPPk%\%_oApp%" /f %_Null%reg delete "HKU\S-1-5-20\%SPPk%\%_wApp%" /f %_Null%reg delete "HKU\S-1-5-20\%SPPk%\%_oApp%" /f %_Null%)set _gvlk=0set "_qr=%_zz1% %spp% %_zz2% %_zz5%ApplicationID='%_wApp%' and Description like '%%KMSCLIENT%%' and PartialProductKey is not NULL%_zz6% %_zz3% Name %_zz4%"if %winbuild% GEQ 10240 %_qr% %_Nul2% | findstr /i Windows %_Nul1% && (set _gvlk=1)set gpr=0set "_qr=%_zz7% %spp% %_zz2% %_zz5%ApplicationID='%_wApp%' and Description like '%%KMSCLIENT%%' and PartialProductKey is not NULL%_zz6% %_zz3% GracePeriodRemaining %_zz8%"if %winbuild% GEQ 10240 if %SkipKMS38% NEQ 0 if %_gvlk% EQU 1 for /f "tokens=2 delims==" %%A in ('%_qr% %_Nul6%') do set "gpr=%%A"set "_qr=%_zz1% %spp% %_zz2%" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin ""ApplicationID='%_wApp%' and Description like '%%KMSCLIENT%%' and PartialProductKey is not NULL" %_zz3% LicenseFamily %_zz4%"if %gpr% NEQ 0 if %gpr% GTR 259200 (set W1nd0ws=0%_qr% %_Nul2% | findstr /i EnterpriseG %_Nul1% && (call set W1nd0ws=1))set "_qr=%_zz7% %sps% %_zz3% Version %_zz8%"for /f "tokens=2 delims==" %%A in ('%_qr%') do set slsv=%%Areg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" %_Nul3%reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%if %winbuild% GEQ 9200 (if not %xOS%==x86 (reg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" /reg:32 %_Nul3%reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" /reg:32 %_Nul3%reg delete "HKLM\%SPPk%\%_oApp%" /f /reg:32 %_Null%reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" /reg:32 %_Nul3%reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" /reg:32" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "%_Nul3%)reg delete "HKLM\%SPPk%\%_oApp%" /f %_Null%reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" %_Nul3%reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%)set "_qr=%_zz7% %spp% %_zz2% %_zz5%ApplicationID='%_wApp%' and Description like '%%KMSCLIENT%%' %_zz6% %_zz3% ID %_zz8%"if %W1nd0ws% EQU 0 for /f "tokens=2 delims==" %%G in ('%_qr%') do (set app=%%G&call :sppchkwin)set "_qr=%_zz7% %spp% %_zz2% %_zz5%ApplicationID='%_wApp%' and Description like '%%KMSCLIENT%%' %adoff% %_zz6% %_zz3% ID %_zz8%"if %W1nd0ws% EQU 1 if %ActWindows% NEQ 0 for /f "tokens=2 delims==" %%G in ('%_qr%') do (set app=%%G&call :sppchkwin):: set "_qr=%_zz7% %spp% %_zz2% %_zz5%ApplicationID='%_wApp%' and Description like '%%KMSCLIENT%%' %addon% %_zz6% %_zz3% ID %_zz8%":: if %ESU_EDT% EQU 1 if %ActWindows% NEQ 0 for /f "tokens=2 delims==" %%G in ('%_qr%') do (set app=%%G&call :esuchk)if %W1nd0ws% EQU 1 if %ActWindows% EQU 0 (echo.&echo W" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "indows activation is OFF...)set "_qr=%_zz7% %spp% %_zz2% %_zz5%ApplicationID='%_oApp%' and Description like '%%KMSCLIENT%%' %_zz6% %_zz3% ID %_zz8%"if %Off1ce% EQU 1 if %ActOffice% NEQ 0 for /f "tokens=2 delims==" %%G in ('%_qr%') do (set app=%%G&call :sppchkoff 1)if %_AUR% EQU 0 (call :cREG %_Nul3%) else (reg delete "HKLM\%SPPk%" /f /v DisableDnsPublishing %_Null%reg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCaching %_Null%)exit /b:sppoffset OffUWP=0if %winbuild% GEQ 10240 reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe" %_Nul3% && (dir /b "%ProgramFiles%\WindowsApps\Microsoft.Office.Desktop*" %_Nul3% && set OffUWP=1if not %xOS%==x86 dir /b "%ProgramW6432%\WindowsApps\Microsoft.Office.Desktop*" %_Nul3% && set OffUWP=1)rem nothing installedif %loc_off21% EQU 0 if %loc_off19% EQU 0 if %loc_off16% EQU 0 if %loc_off15% EQU 0 (if %winbuild% GEQ 9200 ( if %OffUWP% EQU 0 (echo.&echo No Installed Office 2013-2021 Product Detect" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "ed...) else (echo.&echo %_mOuwp%) exit /b )if %winbuild% LSS 9200 (if %loc_off14% EQU 0 (echo.&echo No Installed Office %aword% Product Detected...&exit /b)))if %vNextOverride% EQU 1 if %AutoR2V% EQU 1 (set sub_o365=0set sub_proj=0set sub_vsio=0if %sub_next% EQU 1 reg delete HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing /f %_Nul3%)set Off1ce=1set _sC2R=sppoffset _fC2R=ReturnSPPset vol_off14=0&set vol_off15=0&set vol_off16=0&set vol_off19=0&set vol_off21=0set "_qr=%_zz1% %spp% %_zz2% %_zz5%Description like '%%KMSCLIENT%%' AND NOT Name like '%%MondoR_KMS_Automation%%' %_zz6% %_zz3% Name %_zz4%"%_qr% > "!_temp!\sppchk.txt" 2>&1find /i "Office 21" "!_temp!\sppchk.txt" %_Nul1% && (set vol_off21=1)find /i "Office 19" "!_temp!\sppchk.txt" %_Nul1% && (set vol_off19=1)find /i "Office 16" "!_temp!\sppchk.txt" %_Nul1% && (set vol_off16=1)find /i "Office 15" "!_temp!\sppchk.txt" %_Nul1% && (set vol_off15=1)if %winbuild% LSS 9200 find /i "Office 14" "!_temp!\sppchk.txt"" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "tr "1" %_Nul1% && (exit /b))set "_qr=%_zz1% %spp% %_zz2% %_zz5%PartialProductKey is not NULL%_zz6% %_zz3% ID %_zz4%"%_qr% %_Nul2% | findstr /i "%app%" %_Nul1% && (echo.&call :activate&exit /b)call :insKeyexit /b:RunOSPPset spp=OfficeSoftwareProtectionProductset sps=OfficeSoftwareProtectionServiceset Off1ce=0set RanR2V=0set aC2R21=0set aC2R19=0set aC2R16=0set aC2R15=0if %winbuild% LSS 9200 (set "aword=2010-2021") else (set "aword=2010")if %OsppHook% EQU 0 (echo.&echo No Installed Office %aword% Product Detected...&exit /b)if %winbuild% GEQ 9200 if %loc_off14% EQU 0 (echo.&echo No Installed Office %aword% Product Detected...&exit /b)set err_offsvc=0net start osppsvc /y %_Nul3% || (sc start osppsvc %_Nul3%if !errorlevel! EQU 1053 set err_offsvc=1)if %err_offsvc% EQU 1 (echo.&echo Error: osppsvc service is not running...&exit /b)if %winbuild% GEQ 9200 call :oppoffif %winbuild% LSS 9200 call :sppoffif %Off1ce% EQU 0 exit /bif %_AUR% EQU 0 (reg delete "HKLM\" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "%OPPk%\%_oA14%" /f %_Null%reg delete "HKLM\%OPPk%\%_oApp%" /f %_Null%)set "vPrem="&set "vProf="set "_qr=%_zz7% %spp% %_zz2% %_zz5%LicenseFamily='OfficeVisioPrem-MAK'%_zz6% %_zz3% LicenseStatus %_zz8%"if %loc_off14% EQU 1 for /f "tokens=2 delims==" %%A in ('%_qr% %_Nul6%') do set vPrem=%%Aset "_qr=%_zz7% %spp% %_zz2% %_zz5%LicenseFamily='OfficeVisioPro-MAK'%_zz6% %_zz3% LicenseStatus %_zz8%"if %loc_off14% EQU 1 for /f "tokens=2 delims==" %%A in ('%_qr% %_Nul6%') do set vProf=%%Aset "_qr=%_zz7% %sps% %_zz3% Version %_zz8%"for /f "tokens=2 delims==" %%A in ('%_qr% %_Nul6%') do set slsv=%%Areg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" %_Nul3%reg add "HKLM\%OPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%set "_qr=%_zz7% %spp% %_zz2% %_zz5%Description like '%%KMSCLIENT%%' %_zz6% %_zz3% ID %_zz8%"for /f "tokens=2 delims==" %%G in ('%_qr%') do (set app=%%G&call :sppchkoff 2)if %_AUR% EQU 0 (call :cREG %_Nul3%) else (reg delete "HK" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "LM\%OPPk%" /f /v DisableDnsPublishing %_Null%reg delete "HKLM\%OPPk%" /f /v DisableKeyManagementServiceHostCaching %_Null%)exit /b:oppoffset "_qr=%_zz1% %spp% %_zz3% Description %_zz4%"%_qr% %_Nul2% | findstr /i KMSCLIENT %_Nul1% && (set Off1ce=1exit /b)set ret_off14=0%_qr% %_Nul2% | findstr /i channel %_Nul1% && (set ret_off14=1)if defined _C14R (echo.&echo %_mO14c%) else if %_O14MSI% EQU 1 (if %ret_off14% EQU 1 echo.&echo %_mO14m%)exit /b:offchkset ls=0set ls2=0set ls3=0set "_qr=%_zz7% %spp% %_zz2% %_zz5%LicenseFamily='Office%~1'%_zz6% %_zz3% LicenseStatus %_zz8%"for /f "tokens=2 delims==" %%A in ('%_qr% %_Nul6%') do set /a ls=%%Aset "_qr=%_zz7% %spp% %_zz2% %_zz5%LicenseFamily='Office%~3'%_zz6% %_zz3% LicenseStatus %_zz8%"if /i not "%~3"=="" for /f "tokens=2 delims==" %%A in ('%_qr% %_Nul6%') do set /a ls2=%%Aset "_qr=%_zz7% %spp% %_zz2% %_zz5%LicenseFamily='Office%~5'%_zz6% %_zz3% LicenseStatus %_zz8%"if /i not "%~5"=="" for /f "tokens=2 delims==" %%A in (" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "seIds %_Nul2% | findstr 2021 %_Nul1% && set loc_off%1=1exit /b)for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\%1.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" (set loc_off%1=1set _O%1MSI=1)for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\%1.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" (set loc_off%1=1set _O%1MSI=1)if %1 EQU 16 if defined _C16R (for /f "skip=2 tokens=2*" %%a in ('reg query %_C16R% /v ProductReleaseIds') do echo %%b> "!_temp!\c2rchk.txt"for %%a in (%LV16Ids%,ProjectProX,ProjectStdX,VisioProX,VisioStdX) do ( findstr /I /C:"%%aVolume" "!_temp!\c2rchk.txt" %_Nul1% && set loc_off%1=1 )for %%a in (%LR16Ids%) do ( findstr /I /C:"%%aRetail" "!_temp!\c2rchk.txt" %_Nul1% && set loc_off%1=1 )exit /b)if %1 EQU 15 if defined _C15R (set loc_off%1=1exit /b)if exist "%ProgramFiles%\Microsoft Office\Office%1\OSPP.VBS" set loc_off%1=1if" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "BS% NEQ 0 set "_qr=%_csm% "%sps%.Version='%slsv%'" RefreshLicenseStatus"if %sps% EQU SoftwareLicensingService %_qr% %_Nul3%:activateset S_OK=1if %sps% EQU SoftwareLicensingService (if %_officespp% EQU 0 (reg delete "HKLM\%SPPk%\%_wApp%\%app%" /f %_Null%) else (reg delete "HKLM\%SPPk%\%_oApp%\%app%" /f %_Null%)) else (reg delete "HKLM\%OPPk%\%_oA14%\%app%" /f %_Null%reg delete "HKLM\%OPPk%\%_oApp%\%app%" /f %_Null%)set "_qr=%_zz7% %spp% %_zz2% %_zz5%ID='%app%'%_zz6% %_zz3% Name %_zz8%"if %W1nd0ws% EQU 0 if %_officespp% EQU 0 if %sps% EQU SoftwareLicensingService (reg add "HKLM\%SPPk%\%_wApp%\%app%" /f /v KeyManagementServiceName /t REG_SZ /d "127.0.0.2" %_Nul3%reg add "HKLM\%SPPk%\%_wApp%\%app%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%reg add "HKU\S-1-5-20\%SPPk%\%_wApp%\%app%" /f /v DiscoveredKeyManagementServiceIpAddress /t REG_SZ /d "127.0.0.2" %_Nul3%for /f "tokens=2 delims==" %%x in ('%_qr%') do echo Checking: %%xecho Product is KMS 2038 Activated." in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "teIFEOEntry SppExtComObj.exeif %SSppHook% NEQ 0 if not exist %w7inf% ( if %_verb% EQU 1 (echo.&echo Adding migration fail-safe...&echo %w7inf%) if not exist "%SystemRoot%\Migration\WTR" md "%SystemRoot%\Migration\WTR" ( echo [WTR] echo Name="KMS_VL_ALL" echo. echo [WTR.*] echo NotifyUser="No" echo. echo [System.Registry] echo "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe [*]" )>%w7inf% ))if %_AUR% EQU 1 if %OSType% EQU Win8 call :CreateTaskif %_verb% EQU 1 echo.&echo %line3%&echo.goto :%_rtr%:RemoveHookif %_dDbg%==Yes (set "_para=/d /r"goto :DoDebug)set "RemExc="set "_qr=WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionPath=%_Hook% Force=True"if %WMI_VBS% NEQ 0 set "_qr=%_csd% Remove %_Hook%"if %winbuild% GEQ 9600 ( for %%# in (NoGenTicket,NoAcquireGT) do reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platf" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "eg add "%IFEO%\%1" /f /v KMS_HWID /t REG_QWORD /d "%KMS_HWID%" %_Nul3%)goto :eof:RemoveIFEOEntryif %_verb% EQU 1 (echo [%IFEO%\%1])if /i %1 NEQ osppsvc.exe (reg delete "%IFEO%\%1" /f %_Null%goto :eof)if %OsppHook% EQU 0 (reg delete "%IFEO%\%1" /f %_Null%)if %OsppHook% NEQ 0 for %%A in (Debugger,VerifierDlls,VerifierDebug,VerifierFlags,GlobalFlag,KMS_Emulation,KMS_ActivationInterval,KMS_RenewalInterval,Office2010,Office2013,Office2016,Office2019) do reg delete "%IFEO%\%1" /v %%A /f %_Null%reg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%" %_Nul3%reg add "HKLM\%OPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "1688" %_Nul3%goto :eof:UpdateIFEOEntryreg add "%IFEO%\%1" /f /v KMS_ActivationInterval /t REG_DWORD /d %KMS_ActivationInterval% %_Nul3%reg add "%IFEO%\%1" /f /v KMS_RenewalInterval /t REG_DWORD /d %KMS_RenewalInterval% %_Nul3%if /i %1 EQU SppExtComObj.exe if %winbuild% GEQ 9600 (reg add "%IFEO%\%1" /f /v KMS_HWID /t REG_QWORD /d "%K" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "MS_HWID%" %_Nul3%)if /i %1 EQU sppsvc.exe (reg add "%IFEO%\SppExtComObj.exe" /f /v KMS_ActivationInterval /t REG_DWORD /d %KMS_ActivationInterval% %_Nul3%reg add "%IFEO%\SppExtComObj.exe" /f /v KMS_RenewalInterval /t REG_DWORD /d %KMS_RenewalInterval% %_Nul3%):UpdateOSPPEntryif /i %1 EQU osppsvc.exe (reg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" %_Nul3%reg add "HKLM\%OPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%)goto :eof:CheckFRif not exist %_Hook% (echo.echo %_err%echo File existence failed.echo "%SystemRoot%\System32\SppExtComObjHook.dll"echo.echo Verify that Antivirus protection is OFF or the file path is excluded.)for /f "skip=1 tokens=* delims=" %%# in ('certutil -hashfile %_Hook% SHA1^|findstr /i /v CertUtil') do set "_hash=%%#"set "_hash=%_hash: =%"if /i not "%_hash%"=="%_orig%" (echo.echo %_err%echo SHA1 hash verification failed.echo "%SystemRoot%\System32\SppExtComObjHook.dll"echo E" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "s OFF or the registry path is excluded.)set WMIe=0call :CheckWSif %WMIe% EQU 1 (echo.echo %_err%echo Failed running WMI query check.echo.echo Verify that these services are working correctly:echo Windows Management Instrumentation [WinMgmt]echo Software Protection [sppsvc])goto :eof:CheckWSset "_qrw=%_zz1% Win32_ComputerSystem %_zz3% CreationClassName %_zz4%"set "_qrs=%_zz1% SoftwareLicensingService %_zz3% Version %_zz4%"%_qrs% %_Nul2% | findstr /r "[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*" %_Nul1% || ( set WMIe=1 %_qrw% %_Nul2% | find /i "ComputerSystem" %_Nul1% && ( echo Error: SPP is not responding ) || ( echo Error: WMI ^& SPP are not responding ))goto :eof:cREGreg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%"reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "1688"reg delete "HKLM\%SPPk%" /f /v DisableDnsPublishingreg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCachingreg delete "" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "HKLM\%SPPk%\%_wApp%" /fif %winbuild% GEQ 9200 (if not %xOS%==x86 (reg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%" /reg:32reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32reg delete "HKLM\%SPPk%\%_oApp%" /f /reg:32reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%" /reg:32reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32)reg delete "HKLM\%SPPk%\%_oApp%" /freg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%"reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServicePort /t REG_SZ /d "1688")if %winbuild% GEQ 9600 (reg delete "HKU\S-1-5-20\%SPPk%\%_wApp%" /freg delete "HKU\S-1-5-20\%SPPk%\%_oApp%" /f)if %OsppHook% EQU 0 (goto :eof)reg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%"reg delete "HKLM\%OPPk%" /f /v KeyManagementServicePortreg delete "HKLM\%OPPk%" /f /v DisableDnsPublishingreg dele" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "te "HKLM\%OPPk%" /f /v DisableKeyManagementServiceHostCachingreg delete "HKLM\%OPPk%\%_oA14%" /freg delete "HKLM\%OPPk%\%_oApp%" /fgoto :eof:rREGreg delete "HKLM\%SPPk%" /f /v KeyManagementServiceNamereg delete "HKLM\%SPPk%" /f /v KeyManagementServicePortreg delete "HKLM\%SPPk%" /f /v DisableDnsPublishingreg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCachingreg delete "HKLM\%SPPk%\%_wApp%" /fif %winbuild% GEQ 9200 (if not %xOS%==x86 (reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName /reg:32reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort /reg:32reg delete "HKLM\%SPPk%\%_oApp%" /f /reg:32)reg delete "HKLM\%SPPk%\%_oApp%" /f)if %winbuild% GEQ 9600 (reg delete "HKU\S-1-5-20\%SPPk%\%_wApp%" /freg delete "HKU\S-1-5-20\%SPPk%\%_oApp%" /f)reg delete "HKLM\%OPPk%" /f /v KeyManagementServiceNamereg delete "HKLM\%OPPk%" /f /v KeyManagementServicePortreg delete "HKLM\%OPPk%" /f /v DisableDnsPublishingreg delete "HKLM\%OPPk%" /f /v DisableKey" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "ManagementServiceHostCachingreg delete "HKLM\%OPPk%\%_oA14%" /freg delete "HKLM\%OPPk%\%_oApp%" /fgoto :eof:cCacheecho.echo Clearing KMS Cache...call :rREG %_Nul3%set "_C16R="for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" set "_C16R=1"for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath /reg:32" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" set "_C16R=1"if %winbuild% GEQ 9200 if defined _C16R (echo.echo ## Notice ##echo.echo To make sure Office programs do not show a non-genuine bannerecho please apply manual or auto-renewal activation, and don't uninstall afterward.)if %Unattend% NEQ 0 goto :TheEndecho.&echo %line3%&echo.echo Press any key to continue...pause >nulgoto :MainMenu:CreateTaskschtasks /query /tn "%_TaskEx%" %_Nul3% || ( schtasks /query /tn "%_TaskOs%" %_Nul3% && (" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "_oem!\KMS_VL_ALL_AIO-bin"echo.&echo %line3%&echo.echo.echo Press any key to continue...pause >nulgoto :eof:C2RR2Vset RanR2V=1set "_SLMGR=%SysPath%\slmgr.vbs"if %_Debug% EQU 0 (set "_cscript=cscript //Nologo //B") else (set "_cscript=cscript //Nologo")set _LTSC=0set "_tag="&set "_ons= 2016"sc query ClickToRunSvc %_Nul3%set error1=%errorlevel%sc query OfficeSvc %_Nul3%set error2=%errorlevel%if %error1% EQU 1060 if %error2% EQU 1060 (echo Error: Office C2R service is not detectedgoto :%_fC2R%)set _Office16=0for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" ( set _Office16=1)for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" ( set _Office16=1)set _Office15=0for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFT" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "WARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses\ProPlus*.xrm-ms" ( set _Office15=1)for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses\ProPlus*.xrm-ms" ( set _Office15=1)if %_Office16% EQU 0 if %_Office15% EQU 0 (echo Error: Office C2R InstallPath is not detectedgoto :%_fC2R%):Reg16istryif %_Office16% EQU 0 goto :Reg15istryset "_InstallRoot="set "_ProductIds="set "_GUID="set "_Config="set "_PRIDs="set "_LicensesPath="set "_Integrator="for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do (set "_InstallRoot=%%b\root")if not "%_InstallRoot%"=="" ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do (set "_OSPPVBS=%%b\Office16\OSPP.VBS") for /f "skip=2 tokens=2*" %%a in ('"reg query" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v PackageGUID" %_Nul6%') do (set "_GUID=%%b") for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do (set "_ProductIds=%%b") set "_Config=HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration" set "_PRIDs=HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs") else ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do (set "_InstallRoot=%%b\root") for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do (set "_OSPPVBS=%%b\Office16\OSPP.VBS") for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v PackageGUID" %_Nul6%') do (set "_GUID=%%b") for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductRe" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "leaseIds" %_Nul6%') do (set "_ProductIds=%%b") set "_Config=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration" set "_PRIDs=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\ProductReleaseIDs")set "_LicensesPath=%_InstallRoot%\Licenses16"set "_Integrator=%_InstallRoot%\integration\integrator.exe"for /f "skip=2 tokens=2*" %%a in ('"reg query %_PRIDs% /v ActiveConfiguration" %_Nul6%') do set "_PRIDs=%_PRIDs%\%%b"if "%_ProductIds%"=="" (if %_Office15% EQU 0 (echo Error: Office C2R ProductIDs are not detected&goto :%_fC2R%) else (goto :Reg15istry))if not exist "%_LicensesPath%\ProPlus*.xrm-ms" (if %_Office15% EQU 0 (echo Error: Office C2R Licenses files are not detected&goto :%_fC2R%) else (goto :Reg15istry))if not exist "%_Integrator%" (if %_Office15% EQU 0 (echo Error: Office C2R Licenses Integrator is not detected&goto :%_fC2R%) else (goto :Reg15istry))if exist "%_LicensesPath%\Word2019VL_KMS_Client_AE*.xrm-ms" (set "_tag=2019"&set "_ons= 2019")if exist" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, ""%_LicensesPath%\Word2021VL_KMS_Client_AE*.xrm-ms" (set _LTSC=1)if %winbuild% LSS 10240 if !_LTSC! EQU 1 (set "_tag=2021"&set "_ons= 2021")if %_Office15% EQU 0 goto :CheckC2R:Reg15istryset "_Install15Root="set "_Product15Ids="set "_Con15fig="set "_PR15IDs="set "_OSPP15Ready="set "_Licenses15Path="for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do (set "_Install15Root=%%b\root")if not "%_Install15Root%"=="" ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do (set "_Product15Ids=%%b") set "_Con15fig=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds" set "_PR15IDs=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs" set "_OSPP15Ready=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration") else ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW643" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "2Node\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do (set "_Install15Root=%%b\root") for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do (set "_Product15Ids=%%b") set "_Con15fig=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds" set "_PR15IDs=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs" set "_OSPP15Ready=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\Configuration")set "_OSPP15ReadT=REG_SZ"if "%_Product15Ids%"=="" (reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid %_Nul3% && ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid" %_Nul6%') do (set "_Product15Ids=%%b") set "_Con15fig=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid" set "_OS" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "PP15Ready=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun" set "_OSPP15ReadT=REG_DWORD" )reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid %_Nul3% && ( for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid" %_Nul6%') do (set "_Product15Ids=%%b") set "_Con15fig=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid" set "_OSPP15Ready=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun" set "_OSPP15ReadT=REG_DWORD" ))set "_Licenses15Path=%_Install15Root%\Licenses"if exist "%ProgramFiles%\Microsoft Office\Office15\OSPP.VBS" ( set "_OSPP15VBS=%ProgramFiles%\Microsoft Office\Office15\OSPP.VBS") else if exist "%ProgramW6432%\Microsoft Office\Office15\OSPP.VBS" ( set "_OSPP15VBS=%ProgramW6432%\Microsoft Office\Office15\OSPP.VBS") else if exist "%ProgramFiles(x86)%\Microsoft Office\Office15\OSPP.VBS" (" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "set "_OSPP15VBS=%ProgramFiles(x86)%\Microsoft Office\Office15\OSPP.VBS")if "%_Product15Ids%"=="" (if %_Office16% EQU 0 (echo Error: Office 2013 C2R ProductIDs are not detected&goto :%_fC2R%) else (goto :CheckC2R))if not exist "%_Licenses15Path%\ProPlus*.xrm-ms" (if %_Office16% EQU 0 (echo Error: Office 2013 C2R Licenses files are not detected&goto :%_fC2R%) else (goto :CheckC2R))if %winbuild% LSS 9200 if not exist "%_OSPP15VBS%" (if %_Office16% EQU 0 (echo Error: Office 2013 C2R Licensing tool OSPP.vbs is not detected&goto :%_fC2R%) else (goto :CheckC2R)):CheckC2Rset _OMSI=0if %_Office16% EQU 0 (for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1)if %_Office15% EQU 0 (for /f "skip=2 tokens=2*" %%a in" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1)if %winbuild% GEQ 9200 (set _spp=SoftwareLicensingProductset _sps=SoftwareLicensingServiceset "_vbsi=%_SLMGR% /ilc "set "_vbsf=%_SLMGR% /ilc ") else (set _spp=OfficeSoftwareProtectionProductset _sps=OfficeSoftwareProtectionServiceset _vbsi="!_OSPP15VBS!" /inslic:set _vbsf="!_OSPPVBS!" /inslic:)set "_wmi="set "_qr=%_zz7% %_sps% %_zz3% Version %_zz8%"for /f "tokens=2 delims==" %%# in ('%_qr%') do set _wmi=%%#if "%_wmi%"=="" (echo Error: %_sps% WMI version is not detectedcall :CheckWSgoto :%_fC2R%)set _Retail=0set "_ocq=ApplicationID='%_oApp%' AND LicenseStatus='1' AND PartialProductKey is not NULL"if %WMI_VBS% EQU 0 wmic path %_spp% where (%_ocq%) get Description %_Nul2% |" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "uting slmgr.vbs&del /f /q slmgr.vbs&popd&goto :casVend)cscript //nologo slmgr.vbs /xprdel /f /q slmgr.vbs >nul 2>&1popdecho %line3%:casVo16set office=for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")if exist "!office!\ospp.vbs" (set _sO16vbs=1echo.echo %line2%if %_sO15vbs% EQU 0 (echo *** Office 2016 %_bit%-bit Status ***) else (echo *** Office 2013/2016 Status ***)echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus)if %_wow%==0 goto :casVo13set office=for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")if exist "!office!\ospp.vbs" (set _sO16vbs=1echo.echo %line2%if %_sO15vbs% EQU 0 (echo *** Office 2016 32-bit Status ***) else (echo *** Office 2013/2016 Statu" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "s ***)echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus):casVo13if %_sO16vbs% EQU 1 goto :casVo10set office=for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")if exist "!office!\ospp.vbs" (echo.echo %line2%echo *** Office 2013 %_bit%-bit Status ***echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus)if %_wow%==0 goto :casVo10set office=for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")if exist "!office!\ospp.vbs" (echo.echo %line2%echo *** Office 2013 32-bit Status ***echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus):casVo10set office=for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "if exist "!office!\ospp.vbs" (echo.echo %line2%echo *** Office 2010 %_bit%-bit Status ***echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus)if %_wow%==0 goto :casVc16set office=for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")if exist "!office!\ospp.vbs" (echo.echo %line2%echo *** Office 2010 32-bit Status ***echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus):casVc16reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath >nul 2>&1 || (reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath >nul 2>&1 || goto :casVc13)set office=for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2^>nul') do (set "office=%%b\Office16")if exist "!office!\ospp.vbs" (set _sO16vbs=1echo.echo %line2%if %_sO15vbs% EQU 0 (e" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "cho *** Office 2016-2021 C2R Status ***) else (echo *** Office 2013-2021 Status ***)echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus)if %_wow%==0 goto :casVc13set office=for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" 2^>nul') do (set "office=%%b\Office16")if exist "!office!\ospp.vbs" (set _sO16vbs=1echo.echo %line2%if %_sO15vbs% EQU 0 (echo *** Office 2016-2021 C2R Status ***) else (echo *** Office 2013-2021 Status ***)echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus):casVc13if %_sO16vbs% EQU 1 goto :casVc10reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath >nul 2>&1 || (reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath >nul 2>&1 || goto :casVc10)set office=if exist "%ProgramFiles%\Microsoft Office\Office15" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "\ospp.vbs" ( set "office=%ProgramFiles%\Microsoft Office\Office15") else if exist "%ProgramW6432%\Microsoft Office\Office15\ospp.vbs" ( set "office=%ProgramW6432%\Microsoft Office\Office15") else if exist "%ProgramFiles(x86)%\Microsoft Office\Office15\ospp.vbs" ( set "office=%ProgramFiles(x86)%\Microsoft Office\Office15")if exist "!office!\ospp.vbs" (echo.echo %line2%echo *** Office 2013 C2R Status ***echo %line2%cscript //nologo "!office!\ospp.vbs" /dstatus):casVc10if %_wow%==0 reg query HKLM\SOFTWARE\Microsoft\Office\14.0\CVH /f Click2run /k >nul 2>&1 || goto :casVendif %_wow%==1 reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH /f Click2run /k >nul 2>&1 || goto :casVendset office=if exist "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" ( set "office=%ProgramFiles%\Microsoft Office\Office14") else if exist "%ProgramW6432%\Microsoft Office\Office14\ospp.vbs" ( set "office=%ProgramW6432%\Microsoft Office\Office14"" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "gementServiceHostCaching%if defined KeyManagementServiceLookupDomain echo. KMS SRV record lookup domain: %KeyManagementServiceLookupDomain%if defined ExpireMsg echo.&echo. %ExpireMsg%exit /b:casWendif %_Identity% EQU 1 if %_prsh% EQU 1 (echo %line2%echo *** Office vNext Status ***echo %line2%%_psc% "$f=[IO.File]::ReadAllText('!_batp!') -split ':vNextDiag\:.*';iex ($f[1])"title Check Activation Status [wmi]echo %line3%echo.)echo.echo Press any key to continue...pause >nulgoto :eof:vNextDiag:function PrintModePerPridFromRegistry{$vNextRegkey = "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext"$vNextPrids = Get-Item -Path $vNextRegkey -ErrorAction Ignore | Select-Object -ExpandProperty 'property' | Where-Object -FilterScript {$_.ToLower() -like "*retail" -or $_.ToLower() -like "*volume"}If ($vNextPrids -Eq $null){Write-Host "No registry keys found."Return}$vNextPrids | ForEach `{" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "$mode = (Get-ItemProperty -Path $vNextRegkey -Name $_).$_Switch ($mode){2 { $mode = "vNext"; Break }3 { $mode = "Device"; Break }Default { $mode = "Legacy"; Break }}Write-Host $_ = $mode}}function PrintSharedComputerLicensing{$scaRegKey = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"$scaValue = Get-ItemProperty -Path $scaRegKey -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore$scaRegKey2 = "HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\Licensing"$scaValue2 = Get-ItemProperty -Path $scaRegKey2 -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction Ignore$scaPolicyKey = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing"$scaPolicyValue = Get-ItemProperty -Path $scaPolicyKey -ErrorAction Ignore | Select-Object -ExpandProperty "SharedComputerLicensing" -ErrorAction IgnoreIf ($scaValue -Eq $null -And $scaValue2 -Eq $null -And $scaPolicyValue -Eq $n" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "@([IntPtr], [int], [Guid].MakeByRefType(), [int], [int].MakeByRefType(), [IntPtr].MakeByRefType()), 1, 3).SetImplementationFlags(128) [void]$TB.DefinePInvokeMethod('SLUninstallLicense', $DllPath, 22, 1, [int], @([IntPtr], [IntPtr]), 1, 3) $SPPC = $TB.CreateType() $Handle = 0 [void]$SPPC::SLOpen([ref]$Handle) $pnReturnIds = 0 $ppReturnIds = 0 if (!$SPPC::SLGetSLIDList($Handle, 0, [ref][Guid]"0ff1ce15-a989-479d-af46-f275c6370663", 6, [ref]$pnReturnIds, [ref]$ppReturnIds)) { foreach ($i in 0..($pnReturnIds - 1)) { [void]$SPPC::SLUninstallLicense($Handle, [Int64]$ppReturnIds + [Int64]16 * $i) } }}$OSPP = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" -ErrorAction SilentlyContinue).Pathif ($OSPP) { UninstallLicenses ($OSPP + "osppc.dll")}UninstallLicenses "sppc.dll":embdbin::spptask:

KMS_VL_ALL scripts make use of Windows Management Instrumentation WMI utilities which query the properties and executes the methods of Windows and Office licensing classes
providing a native activation processing which is almost identical to the official VBScript tools slmgr.vbs and ospp.vbs but in an automated way.

The script make these changes to the system (if the emulator is used):
copy or link the file "C:\Windows\System32\SppExtComObjHook.dll"
add the hook registry keys to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"
add osppsvc.exe keys to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"
create scheduled task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger" (on Windows 8 and later)

" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin, "Home Server 2011... etc)

______________________________

Office C2R 'Your license isn't genuine' notification banner

Office Click-to-Run builds (since February 2021) that are activated with KMS checks the existence of the KMS server name in the registry.
If KMS server is not present, a banner is shown in Office programs notifying that "Office isn't licensed properly", see here.
Therefore in manual mode, KeyManagementServiceName value containing an internal private-network IP address 172.16.0.2 will be kept in the below registry keys:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
This is perfectly fine" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "order to fix that, open command prompt as administrator, then copy/paste and execute these commands:

set _r=^%SystemRoot^%reg add HKLM\SOFTWARE\Classes\batfile\shell\runas\command /f /v "" /t REG_EXPAND_SZ /d "%_r%\System32\cmd.exe /C \"\"%1\" %*\""reg add HKLM\SOFTWARE\Classes\cmdfile\shell\runas\command /f /v "" /t REG_EXPAND_SZ /d "%_r%\System32\cmd.exe /C \"\"%1\" %*\""

Troubleshooting

If the activation failed at first attempt:

Run the script one more time.
Reboot the system and try again.
Verify that Antivirus software is not blocking C:\Windows\SppExtComObjHook.dll
Check System integrity, open command prompt as administrator, and execute these command respectively:
for Windows 11, 10 or 8.1 only: Dism /online /Cleanup-Image /RestoreHealth
" in Source: KMS_VL_ALL_AIO_crackshash.cmd.bin "Reg Query HKCU\Console | %SystemRoot%\System32\findstr.exe /LIC:"VirtualTerminalLevel REG_DWORD 0x1" > nul || (" in Source: urlref_httpsstackoverflow.coma10407642 "Reg Add HKCU\Console /f /v VirtualTerminalLevel /t REG_DWORD /d 1" in Source: urlref_httpsstackoverflow.coma10407642 "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{0" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp "reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoGenTicket /t REG_DWORD /d 1 /f %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if %winbuild% EQU 14393 reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v NoAcquireGT /t REG_DWORD /d 1 /f %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "SET "RegKey=HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages"" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%\%_wApp%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "rem reg delete "HKLM\%SPPk%\%_oApp%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKU\S-1-5-20\%SPPk%\%_wApp%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKU\S-1-5-20\%SPPk%\%_oApp%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" /reg:32 %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" /reg:32 %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%\%_oApp%" /f /reg:32 %_Null%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" /reg:32 %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" /reg:32 %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%\%_oApp%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" %_Nul3%" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagement" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006716.00000000.72361.46DE0000.00000004.mdmp "reg query HKLM\SYSTEM\CurrentControlSet\Services\WinMgmt /v Start 2>nul | find /i "0x4" 1>nul && (goto :E_WMS)" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp "1>nul 2>nul reg query HKU\S-1-5-19 && (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop') do call set "_dsk=%%b"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp "if %winbuild% GEQ 7601 for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v UBR 2^>nul') do if not errorlevel 1 set /a UBR=%%b" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query "HKCU\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled 2>nul | find /i "0x0" 1>nul && (set _WSH=0)" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if %winbuild% GEQ 10586 reg query "HKCU\Console" /v ForceV2 2>nul | find /i "0x0" 1>nul && (set _NCS=0)" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "IFEO=HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "OPPk=SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "SPPk=SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set kNext=HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "IF %winbuild% GEQ 17063 FOR /F "SKIP=2 TOKENS=2*" %%A IN ('REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionId') DO SET "EditionID=%%B"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "FOR /F "SKIP=2 TOKENS=2*" %%A IN ('REG QUERY "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v EditionId') DO SET "EditionID=%%B"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v ProductName %_Nul6%') do if not errorlevel 1 set "_winos=%%b"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath %_Nul3% && for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds %_Nul3% && set "_C16R=HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if not defined _C16R reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath %_Nul3% && for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds %_Nul3% && set "_C16R=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath %_Nul3% && for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses\ProPlus*.xrm-ms" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds %_Nul3% && call set "_C15R=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if not defined _C15R reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid %_Nul3% && call set "_C15R=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if %_wow%==0 (reg query HKLM\SOFTWARE\Microsoft\Office\14.0\CVH /f Click2run /k %_Nul3% && set "_C14R=1") else (reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH /f Click2run /k %_Nul3% && set "_C14R=1")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%" /f /v DisableDnsPublishing %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCaching %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if %winbuild% GEQ 10240 reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msoxmled.exe" %_Nul3% && (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if %sub_next% EQU 1 reg delete HKCU\SOFTWARE\Microsoft\Office\16.0\Common\Licensing /f %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%\%_oA14%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%\%_oApp%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%KMS_IP%" %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%OPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%" /f /v DisableDnsPublishing %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%" /f /v DisableKeyManagementServiceHostCaching %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\%1.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\%1.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if %_officespp% EQU 0 (reg delete "HKLM\%SPPk%\%_wApp%\%app%" /f %_Null%) else (reg delete "HKLM\%SPPk%\%_oApp%\%app%" /f %_Null%)" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%\%_oA14%\%app%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%\%_oApp%\%app%" /f %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_wApp%\%app%" /f /v KeyManagementServiceName /t REG_SZ /d "127.0.0.2" %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_wApp%\%app%" /f /v KeyManagementServicePort /t REG_SZ /d "%KMS_Port%" %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKU\S-1-5-20\%SPPk%\%_wApp%\%app%" /f /v DiscoveredKeyManagementServiceIpAddress /t REG_SZ /d "127.0.0.2" %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "echo "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe [*]"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for %%# in (NoGenTicket,NoAcquireGT) do reg delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v %%# /f %_Null%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%" %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%OPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "1688" %_Nul3%" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "1688"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%" /f /v DisableDnsPublishing" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%" /f /v DisableKeyManagementServiceHostCaching" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%\%_wApp%" /f" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%" /reg:32" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%\%_oApp%" /f /reg:32" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%" /reg:32" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServicePort /t REG_SZ /d "1688" /reg:32" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%\%_oApp%" /f" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%SPPk%\%_oApp%" /f /v KeyManagementServicePort /t REG_SZ /d "1688"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKU\S-1-5-20\%SPPk%\%_wApp%" /f" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKU\S-1-5-20\%SPPk%\%_oApp%" /f" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg add "HKLM\%OPPk%" /f /v KeyManagementServiceName /t REG_SZ /d "%_uIP%"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%" /f /v KeyManagementServicePort" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%" /f /v DisableDnsPublishing" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%" /f /v DisableKeyManagementServiceHostCaching" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%\%_oA14%" /f" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%\%_oApp%" /f" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%" /f /v KeyManagementServiceName /reg:32" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%SPPk%" /f /v KeyManagementServicePort /reg:32" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg delete "HKLM\%OPPk%" /f /v KeyManagementServiceName" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" set "_C16R=1"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath /reg:32" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" set "_C16R=1"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses16\ProPlus*.xrm-ms" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses\ProPlus*.xrm-ms" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do if exist "%%b\root\Licenses\ProPlus*.xrm-ms" (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do (set "_InstallRoot=%%b\root")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do (set "_OSPPVBS=%%b\Office16\OSPP.VBS")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v PackageGUID" %_Nul6%') do (set "_GUID=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do (set "_ProductIds=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_Config=HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_PRIDs=HKLM\SOFTWARE\Microsoft\Office\ClickToRun\ProductReleaseIDs"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do (set "_InstallRoot=%%b\root")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" %_Nul6%') do (set "_OSPPVBS=%%b\Office16\OSPP.VBS")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v PackageGUID" %_Nul6%') do (set "_GUID=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do (set "_ProductIds=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_Config=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_PRIDs=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun\ProductReleaseIDs"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do (set "_Install15Root=%%b\root")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do (set "_Product15Ids=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_Con15fig=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_PR15IDs=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_OSPP15Ready=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\Configuration"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath" %_Nul6%') do (set "_Install15Root=%%b\root")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds" %_Nul6%') do (set "_Product15Ids=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_Con15fig=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\Configuration /v ProductReleaseIds"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_PR15IDs=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\ProductReleaseIDs"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_OSPP15Ready=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\Configuration"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid %_Nul3% && (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid" %_Nul6%') do (set "_Product15Ids=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_Con15fig=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_OSPP15Ready=HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid %_Nul3% && (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid" %_Nul6%') do (set "_Product15Ids=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_Con15fig=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun\propertyBag /v productreleaseid"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "set "_OSPP15Ready=HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" %_Nul6%') do if exist "%%b\OSPP.VBS" set _OMSI=1" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\16.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\15.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\Common\InstallRoot /v Path" 2^>nul') do (set "office=%%b")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath >nul 2>&1 || (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath >nul 2>&1 || goto :casVc13" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun /v InstallPath" 2^>nul') do (set "office=%%b\Office16")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "for /f "skip=2 tokens=2*" %%a in ('"reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\ClickToRun /v InstallPath" 2^>nul') do (set "office=%%b\Office16")" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\Microsoft\Office\15.0\ClickToRun /v InstallPath >nul 2>&1 || (" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "reg query HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\15.0\ClickToRun /v InstallPath >nul 2>&1 || goto :casVc10" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if %_wow%==0 reg query HKLM\SOFTWARE\Microsoft\Office\14.0\CVH /f Click2run /k >nul 2>&1 || goto :casVend" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "if %_wow%==1 reg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\14.0\CVH /f Click2run /k >nul 2>&1 || goto :casVend" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "$vNextRegkey = "HKCU:\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\LicensingNext"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "$scaRegKey = "HKLM:\SOFTWARE\Microsoft\Office\ClickToRun\Configuration"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "$scaRegKey2 = "HKLM:\SOFTWARE\Microsoft\Office\16.0\Common\Licensing"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "$scaPolicyKey = "HKLM:\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Licensing"" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "$OSPP = (Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" -ErrorAction SilentlyContinue).Path" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "add the hook registry keys to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"
" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "add osppsvc.exe keys to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"
" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
" in Source: 00000000-00006716.00000000.72361.489A0000.00000004.mdmp 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform

" (Indicator: "twitter"; File: "urlref_httpssourceforge.netprojectsmingw-w64filesx86_64-8.1.0-release-win32-sjlj-rt_v6-rev0.7z") Found string "

" (Indicator: "facebook.com"; File: "urlref_httpssourceforge.netprojectsmingw-w64filesx86_64-8.1.0-release-win32-sjlj-rt_v6-rev0.7z") Found string "

" (Indicator: "linkedin.com"; File: "urlref_httpssourceforge.netprojectsmingw-w64filesx86_64-8.1.0-release-win32-sjlj-rt_v6-rev0.7z") Found string "" (Indicator: "twitter"; File: "urlref_httpswww.microsoft.comLicensingservicecenterHelpFAQDetails.aspxid_201#215") Found string "" (Indicator: "twitter"; File: "urlref_httpswww.microsoft.comLicensingservicecenterHelpFAQDetails.aspxid_201#215") Found string "

Facebook
Twitter
LinkedIn

KMS_VL_ALL scripts make use of Windows Management Instrumentation WMI utilities, which query the properties and executes the methods of Windows and Office licensing classes,
providing a native activation processing, which is almost identical to the official VBScript tools slmgr.vbs and ospp.vbs, but in an automated way.

The script make these changes to the system (if the emulator is used):
copy or link the file "C:\Windows\System32\SppExtComObjHook.dll"
add the hook registry keys to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"
add osppsvc.exe keys to "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform"
create scheduled task "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger" (on Windows 8 and later)

query and execute WMI functions using wmic.exe, or vbscripting

It uses the color feature of the findstr command.

Findstr can be configured to output line numbers or filenames in a defined color.
" (Indicator: "findstr "; File: "urlref_httpsstackoverflow.coma10407642") Found string "findstr /p /A:%1 "." "!param!\..\X" nul" (Indicator: "findstr "; File: "urlref_httpsstackoverflow.coma10407642") file/memory contains long string with (Indicator: "findstr "; File: "urlref_httpsstackoverflow.coma10407642") Found string "findstr /p /A:%1 "." "!str!\..\x" nul" (Indicator: "findstr "; File: "urlref_httpsstackoverflow.coma10407642") Found string "

This method fails on XP because FINDSTR displays backspace as a period on the screen. jeb's original answer works on XP, albeit with the limitations already noted

Therefore in manual mode, KeyManagementServiceName value containing an internal private-network IP address 172.16.0.2 will be kept in the below registry keys:\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://www.crackshash.comset\" - Source: \"00000000-00006716.00000000.72361.489A0000.00000004.mdmp\")\n Found URL \"https://github.com/aveyo/compressed2txt::\" - Source: \"00000000-00006716.00000000.72361.489A0000.00000004.mdmp\")\n Found URL \"https://github.com/aveyo/compressed2txt::\" - Source: \"00000000-00006716.00000000.72361.48FB0000.00000004.mdmp\")\n Found URL \"http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan\" - Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\"\n Found HTTPS url \"https://forums.mydigitallife.net\"\n Found HTTPS url \"https://pastebin.com\"\n Found HTTPS url \"https://textuploader.com\"\n Found HTTPS url \"https://www.microsoft.com\"\n Found HTTPS url \"https://technet.microsoft.com\"\n Found HTTPS url \"https://docs.microsoft.com\"\n Found HTTPS url \"https://support.microsoft.com\"\n Found HTTPS url \"https://i.imgur.com\"\n Found HTTPS url \"https://infohost.github.io\"\n Found HTTPS url \"https://app.box.com\"\n Found HTTPS url \"https://sourceforge.net\"\n Found HTTPS url \"https://foru\"\n Found HTTPS url \"https://gist.github.com\"\n Found HTTPS url \"https://stackoverflow.com\"\n Found HTTPS url \"https://forums.mydigi\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"WScript.exe\" called \"CreateCompatibleBitmap\" with parameters {\"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system services using Tasklist","description":"Observed string: \"for /f usebackq^ delims^=^\"^ tokens^=^* %%a in (`tasklist /fi \"PID eq %PID%\" /m /fo CSV`) do set \"MODULES=%%a\"\" [Source: urlref_httpsstackoverflow.coma10407642]","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-173","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegQueryValueA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyExA\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExA\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExA\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"file/memory contains long string with (Indicator: \"where \"; File: \"KMS_VL_ALL_AIO_crackshash.cmd.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir /b \"%ProgramFiles%\\WindowsApps\\Microsoft.Office.Desktop*\" %_Nul3% && set OffUWP=1\" (Indicator: \"dir \"; Source: \"00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp\")\n Found string \"dir /b /s /a:-d \"!_Local!\\Microsoft\\Office\\Licenses\\*1*\" 1>nul 2>nul && set _Identity=1\" (Indicator: \"dir \"; Source: \"00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp\")\n Found string \"dir /b /s /a:-d \"!ProgramData!\\Microsoft\\Office\\Licenses\\*1*\" 1>nul 2>nul && set _Identity=1\" (Indicator: \"dir \"; Source: \"00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp, 00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00006716.00000000.72361.DAC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00006716.00000000.72361.5C722000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to search for patterns of text (possibly credentials) in files","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1552","relevance":1,"id":"string-334","sources":[{"report_type":"sandbox","report_id":"64fd99b1cd0ad18fc7062444"},{"report_type":"sandbox","report_id":"64fc701d5e9e5459ed03f7f1"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Do you already have an account?\" (Indicator: \"password\"; File: \"urlref_httpsforums.mydigitallife.netposts309737\")\n Found string \"Yes, my password is:

Forgot your password?

\" (Indicator: \"LogonTrigger\"; Source: \"00000000-00006716.00000000.72361.489A0000.00000004.mdmp, 00000000-00006716.00000000.72361.48FB0000.00000004.mdmp\")\n Found string \"