Technical Information
- '<SYSTEM32>\net.exe' stop WLMS
- %TEMP%\mpaggk\mpaggk.cmd
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-ppdlic.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-oem-nonslp-1-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-oem-nonslp-1-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-oem-nonslp-1-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-oem-nonslp-1-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-oem-dm-1-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-oem-dm-1-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-oem-dm-1-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-oem-dm-1-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\defaultppd-enterprises-ppdlic.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\defaultppd-csvlk-pack-ppdlic.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-1-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-1-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-9-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-9-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-8-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-8-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-8-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-8-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-7-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-7-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-7-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-7-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-6-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-9-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\legacy\spc-generic-public.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-1-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-mak-1-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-mak-1-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-mak-1-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-gvlk-1-ul-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-gvlk-1-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-6-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-6-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-6-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-6-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-5-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-5-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-5-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-5-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-4-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-4-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-4-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-4-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-3-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-3-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-3-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-3-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-2-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-2-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-2-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-2-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-6-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-9-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-6-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-6-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-5-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\x64\psexec.exe
- %TEMP%\mpaggk\spp\tokens\legacy\client-issuance-spc.xrm-ms
- %TEMP%\mpaggk\spp\tokens\legacy\client-issuance-rac.xrm-ms
- %TEMP%\mpaggk\spp\tokens\issuance\client-issuance-wgalic.xrm-ms
- %TEMP%\mpaggk\spp\tokens\issuance\client-issuance-ul.xrm-ms
- %TEMP%\mpaggk\spp\tokens\issuance\client-issuance-ul-oob.xrm-ms
- %TEMP%\mpaggk\spp\tokens\issuance\client-issuance-stil.xrm-ms
- %TEMP%\mpaggk\spp\plugin-manifests-signed\sppwinob-spp-plugin-manifest-signed.xrm-ms
- %TEMP%\mpaggk\spp\plugin-manifests-signed\sppobjs-spp-plugin-manifest-signed.xrm-ms
- %TEMP%\mpaggk\x64\x64_win.cmd
- %TEMP%\mpaggk\x64\superuser.exe
- %TEMP%\mpaggk\x64\slc.dll
- %TEMP%\mpaggk\x64\hideexec.exe
- %TEMP%\mpaggk\spp\tokens\legacy\rac-generic-public.xrm-ms
- %TEMP%\mpaggk\x64\helevate.exe
- %TEMP%\mpaggk\x64\gatherosstate.exe
- %TEMP%\mpaggk\x64\clipup.exe
- %TEMP%\mpaggk\x32\x32_win.cmd
- %TEMP%\mpaggk\x32\superuser.exe
- %TEMP%\mpaggk\x32\slc.dll
- %TEMP%\mpaggk\x32\psexec.exe
- %TEMP%\mpaggk\x32\hideexec.exe
- %TEMP%\mpaggk\x32\helevate.exe
- %TEMP%\mpaggk\x32\gatherosstate.exe
- %TEMP%\mpaggk\x32\clipup.exe
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-mak-1-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\enterprises\enterprises-volume-csvlk-1-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\legacy\spc-generic-private.xrm-ms
- %TEMP%\mpaggk\spp\tokens\pkeyconfig\pkeyconfig-downlevel.xrm-ms
- %TEMP%\mpaggk\spp\tokens\legacy\rac-generic-private.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-5-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-5-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-5-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-4-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-4-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-4-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-4-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-3-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-3-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-3-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-3-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-2-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-2-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-2-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-2-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-1-ul-store-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-1-ul-phn-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-1-ul-oob-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-volume-csvlk-1-pl-rtm.xrm-ms
- %TEMP%\mpaggk\spp\tokens\skus\csvlk-pack\csvlk-pack-ppdlic.xrm-ms
- %TEMP%\mpaggk\spp\tokens\rules\ruleset-windowsapp.xrm-ms
- %TEMP%\mpaggk\spp\tokens\rules\ruleset-platformglobal.xrm-ms
- %TEMP%\mpaggk\spp\tokens\rules\ruleset-filteractions.xrm-ms
- %TEMP%\mpaggk\spp\tokens\pkeyconfig\pkeyconfig.xrm-ms
- %TEMP%\mpaggk\spp\tokens\pkeyconfig\pkeyconfig-csvlk.xrm-ms
- nul
- '%TEMP%\mpaggk\x64\hideexec.exe' "%TEMP%\MPAGGK\MPAGGK.cmd" win 3QP4N-RC9JQ-XD9MD-7Q647-HXQB9
- '%TEMP%\mpaggk\x64\superuser.exe' /w /c "%TEMP%\MPAGGK\x64\HideExec.exe" "<SYSTEM32>\SC.exe" config WLMS start= disabled
- '%TEMP%\mpaggk\x64\superuser.exe' /w /c "%TEMP%\MPAGGK\x64\HideExec.exe" "<SYSTEM32>\SC.exe" delete WLMS
- '%TEMP%\mpaggk\x64\superuser.exe' /w /c "%TEMP%\MPAGGK\x64\HideExec.exe" "<SYSTEM32>\SC.exe" config ClipSvc start= demand
- '%TEMP%\mpaggk\x64\superuser.exe' /w /c "%TEMP%\MPAGGK\x64\HideExec.exe" "<SYSTEM32>\SC.exe" config SppSvc start= delayed-auto
- '%TEMP%\mpaggk\x64\hideexec.exe' "%TEMP%\MPAGGK\MPAGGK.cmd" win 43TBQ-NH92J-XKTM7-KT3KK-P39PB
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\MPAGGK\MPAGGK.cmd" win 3QP4N-RC9JQ-XD9MD-7Q647-HXQB9"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\MPAGGK\MPAGGK.cmd" win 3QP4N-RC9JQ-XD9MD-7Q647-HXQB9"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\MPAGGK\MPAGGK.cmd" win 43TBQ-NH92J-XKTM7-KT3KK-P39PB"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\MPAGGK\MPAGGK.cmd" win 43TBQ-NH92J-XKTM7-KT3KK-P39PB"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\MPAGGK\MPAGGK.cmd" win 3QP4N-RC9JQ-XD9MD-7Q647-HXQB9"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-2-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-1-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-1-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-1-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-1-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-ppdlic.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-OEM-NONSLP-1-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-OEM-NONSLP-1-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-OEM-NONSLP-1-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-OEM-NONSLP-1-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-OEM-DM-1-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-OEM-DM-1-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-2-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-OEM-DM-1-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\DefaultPpd-EnterpriseS-ppdlic.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\DefaultPpd-csvlk-pack-ppdlic.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-9-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-9-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-9-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-9-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-8-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-8-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-8-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-8-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-7-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-7-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-OEM-DM-1-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-6-ul-oob-rtm.xrm-ms"
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\MPAGGK\MPAGGK.cmd" win 43TBQ-NH92J-XKTM7-KT3KK-P39PB"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-3-pl-rtm.xrm-ms"
- '<SYSTEM32>\reg.exe' Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentMajorVersionNumber"
- '<SYSTEM32>\find.exe' "REG_DWORD"
- '<SYSTEM32>\cmd.exe' /S /D /c" Call "<SYSTEM32>\Reg.exe" Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentMajorVersionNumber""
- '<SYSTEM32>\cmd.exe' /c Call "<SYSTEM32>\Reg.exe" Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentMajorVersionNumber"|"<SYSTEM32>\Find.exe" "REG_DWORD"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ipk "3QP4N-RC9JQ-XD9MD-7Q647-HXQB9"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-MAK-1-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-MAK-1-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-MAK-1-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-MAK-1-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-6-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-7-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-6-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-6-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-5-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-5-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-5-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-5-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-4-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-4-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-4-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-4-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-3-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-3-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-3-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-2-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\EnterpriseS\EnterpriseS-Volume-CSVLK-2-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-7-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\pkeyconfig\pkeyconfig-downlevel.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\legacy\spc-generic-private.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\legacy\rac-generic-public.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\legacy\rac-generic-private.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\legacy\client-issuance-spc.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\legacy\client-issuance-rac.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\issuance\client-issuance-wgalic.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\issuance\client-issuance-ul.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\issuance\client-issuance-ul-oob.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\issuance\client-issuance-stil.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\plugin-manifests-signed\sppwinob-spp-plugin-manifest-signed.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\plugin-manifests-signed\sppobjs-spp-plugin-manifest-signed.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /rilc
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\legacy\spc-generic-public.xrm-ms"
- '<SYSTEM32>\net1.exe' stop WLMS
- '<SYSTEM32>\find.exe' "REG_SZ"
- '<SYSTEM32>\cmd.exe' /S /D /c" Call "<SYSTEM32>\Reg.exe" Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentVersion""
- '<SYSTEM32>\cmd.exe' /c Call "<SYSTEM32>\Reg.exe" Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentVersion"|"<SYSTEM32>\Find.exe" "REG_SZ"
- '<SYSTEM32>\reg.exe' Query "HKU\S-1-5-19\Environment" /v "TEMP"
- '<SYSTEM32>\find.exe' "REG_EXPAND_SZ"
- '<SYSTEM32>\cmd.exe' /S /D /c" Call "<SYSTEM32>\Reg.exe" Query "HKU\S-1-5-19\Environment" /v "TEMP""
- '<SYSTEM32>\cmd.exe' /c Call "<SYSTEM32>\Reg.exe" Query "HKU\S-1-5-19\Environment" /v "TEMP"|"<SYSTEM32>\Find.exe" "REG_EXPAND_SZ"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\MPAGGK\MPAGGK.cmd" win 3QP4N-RC9JQ-XD9MD-7Q647-HXQB9"
- '%WINDIR%\syswow64\reg.exe' Query "HKU\S-1-5-19\Environment" /v "TEMP"
- '%WINDIR%\syswow64\find.exe' "REG_EXPAND_SZ"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" Call "<SYSTEM32>\Reg.exe" Query "HKU\S-1-5-19\Environment" /v "TEMP""
- '%WINDIR%\syswow64\cmd.exe' /c Call "<SYSTEM32>\Reg.exe" Query "HKU\S-1-5-19\Environment" /v "TEMP"|"<SYSTEM32>\Find.exe" "REG_EXPAND_SZ"
- '<SYSTEM32>\reg.exe' Query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "CurrentVersion"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-3-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-6-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\pkeyconfig\pkeyconfig.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-6-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-6-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-5-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-5-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-5-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-5-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-4-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-4-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-4-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-4-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-3-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-3-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-6-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-3-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-2-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-2-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-2-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-2-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-1-ul-store-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-1-ul-phn-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-1-ul-oob-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-Volume-CSVLK-1-pl-rtm.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\skus\csvlk-pack\csvlk-pack-ppdlic.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\rules\ruleset-windowsapp.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\rules\ruleset-platformglobal.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\rules\ruleset-filteractions.xrm-ms"
- '<SYSTEM32>\cscript.exe' //NoLogo "<SYSTEM32>\slmgr.vbs" /ilc "%TEMP%\MPAGGK\spp\tokens\pkeyconfig\pkeyconfig-csvlk.xrm-ms"
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\MPAGGK\MPAGGK.cmd" win 43TBQ-NH92J-XKTM7-KT3KK-P39PB"