Technical Information
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program="<Full path to file>"
- %WINDIR%\scripttemp.ini
- %WINDIR%\_temp11221928421663\oem\emulateslic.bin
- %WINDIR%\_temp11221928421663\oem\gr1dr1
- %WINDIR%\_temp11221928421663\oem\gr1dr2
- %WINDIR%\_temp11221928421663\oem\gr1dr34
- %WINDIR%\_temp11221928421663\oem\gr1dr5
- %WINDIR%\_temp11221928421663\oem\cert\tosasu.xrm-ms
- %WINDIR%\_temp11221928421663\oem\gr1dr6
- %WINDIR%\_temp11221928421663\office2010ospp\ospp.vbs
- %WINDIR%\_temp11221928421663\office2010ospp\slerror.xml
- %WINDIR%\_temp11221928421663\otherofficeospp\ospp.vbs
- %WINDIR%\_temp11221928421663\otherofficeospp\slerror.xml
- %WINDIR%\_temp11221928421663\pic\backup-en.bmp
- %WINDIR%\_temp11221928421663\pic\backup-tra.bmp
- %WINDIR%\_temp11221928421663\oem\cert\yutc.xrm-ms
- %WINDIR%\_temp11221928421663\oem\gr1dr7
- %WINDIR%\_temp11221928421663\oem\emulateslic
- %WINDIR%\_temp11221928421663\oem\cert\_asus_.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\xplore.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\wortma.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\stinfo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\synnex.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\sysmax.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\tarox1.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\thoa21.xrm-ms
- %WINDIR%\_temp11221928421663\pic\backup.bmp
- %WINDIR%\_temp11221928421663\oem\cert\thtfpc.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\rm.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\tosbyd.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\toshib.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\tosinv.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\tosqci.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\trigem.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\vestel.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\seccsd.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\vscaio.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\toscpl.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\sony.xrm-ms
- %WINDIR%\_temp11221928421663\pic\ewm_wx.jpg
- %WINDIR%\_temp11221928421663\pic\inst-tra.bmp
- %WINDIR%\_temp11221928421663\oem\bootrest.exe
- %WINDIR%\_temp11221928421663\oem\bootsect.exe
- %WINDIR%\_temp11221928421663\oem\oemdumpnet35.exe
- %WINDIR%\_temp11221928421663\oem\oemdumpnet40.exe
- %WINDIR%\_temp11221928421663\oem\uefi.exe
- %WINDIR%\_temp11221928421663\x64\cleanospp.exe
- %WINDIR%\_temp11221928421663\kms-client.exe
- %WINDIR%\_temp11221928421663\x64\msvcr100.dll
- %WINDIR%\_temp11221928421663\x64\setacl.exe
- %WINDIR%\_temp11221928421663\x64\sppextcomobjhook.dll
- %WINDIR%\_temp11221928421663\x86\cleanospp.exe
- %WINDIR%\_temp11221928421663\x86\msvcr100.dll
- %WINDIR%\_temp11221928421663\x86\secopatcher.dll
- %WINDIR%\_temp11221928421663\x86\setacl.exe
- %WINDIR%\_temp11221928421663\kms.exe
- %WINDIR%\_temp11221928421663\kms_x64.exe
- %WINDIR%\_temp11221928421663\kms-server.exe
- %WINDIR%\_temp11221928421663\svctrigger.xml
- %WINDIR%\_temp11221928421663\oem\cert\hp.xrm-ms
- %WINDIR%\_temp11221928421663\pic\inst.bmp
- %WINDIR%\_temp11221928421663\pic\left.bmp
- %WINDIR%\_temp11221928421663\pic\office.bmp
- %WINDIR%\_temp11221928421663\pic\restore-en.bmp
- %WINDIR%\_temp11221928421663\pic\restore-tra.bmp
- %WINDIR%\_temp11221928421663\pic\ewm_zfb.jpg
- %WINDIR%\_temp11221928421663\pic\inst-en.bmp
- %WINDIR%\_temp11221928421663\pic\head.bmp
- %WINDIR%\_temp11221928421663\pic\restore.bmp
- %WINDIR%\_temp11221928421663\pic\uninst.bmp
- %WINDIR%\_temp11221928421663\pic\ver.ico
- %WINDIR%\_temp11221928421663\pic\windows.bmp
- %WINDIR%\_temp11221928421663\pic\zanzhu.ico
- %WINDIR%\_temp11221928421663\setupcomplete.data
- %WINDIR%\_temp11221928421663\pic\shuoming.jpg
- %WINDIR%\_temp11221928421663\pic\uninst-en.bmp
- %WINDIR%\_temp11221928421663\pic\uninst-tra.bmp
- %WINDIR%\_temp11221928421663\oem\cert\quanmx.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\qbexco.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\prdgt.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\benq.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\bgh.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\casper.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\ccelnf.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\cgwall.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\cmscom.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\exo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\creaas.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\datate.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\dealin.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\dell.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\dsgltd.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\equus.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\aquari.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\alware.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\bekopc.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\acrsys.xrm-ms
- %WINDIR%\_temp11221928421663\heu_set.ini
- %TEMP%\aut6824.tmp
- %TEMP%\aut760a.tmp
- %WINDIR%\_temp11221928421663\kmsmini.7z
- %TEMP%\aut77a1.tmp
- %WINDIR%\_temp11221928421663\digital.7z
- %TEMP%\aut781f.tmp
- %WINDIR%\_temp11221928421663\oem\cert\exc.xrm-ms
- %WINDIR%\_temp11221928421663\cert.7z
- %WINDIR%\_temp11221928421663\oem\cert\czc011.xrm-ms
- %WINDIR%\_temp11221928421663\digitallicence.7z
- %WINDIR%\_temp11221928421663\7z.exe
- %WINDIR%\heukmsrenewal\heu_kms_activator.exe
- %WINDIR%\_temp11221928421663\getproductkey.data
- %WINDIR%\_temp11221928421663\heu_configuration.ini
- %WINDIR%\_temp11221928421663\heu_kms_renewal.xml
- %TEMP%\aut78ac.tmp
- %WINDIR%\splashlogo.gif
- %TEMP%\aut790b.tmp
- %WINDIR%\_temp11221928421663\oem\cert\atcomp.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\foundr.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\lge.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\matbio.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\matech.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\medion.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\mitac.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\msi_nb.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\lenovo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\fsc.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\login2.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\navihb.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\olipro.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\olislp.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\onkyo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\philco.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\positi.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\nec.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\nokia.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\oegrou.xrm-ms
- %WINDIR%\_temp11221928421663\x64\secopatcher.dll
- %WINDIR%\_temp11221928421663\x86\sppextcomobjhook.dll
- %WINDIR%\_temp11221928421663\oem\cert\k.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\gbt.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\gensys.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\haier.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hasee.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hclinf.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hedy06.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\krftwy.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\lanix1.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\higrad.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hspw07.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hyrslp.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\ibm.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\itinfo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\jetway.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\jooyon.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\fuj.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hpqoem.xrm-ms
- %WINDIR%\_temp11221928421663\scriptdir.ini
- %WINDIR%\_temp11221928421663\getproductkey.data
- %WINDIR%\_temp11221928421663\office2010ospp\slerror.xml
- %WINDIR%\_temp11221928421663\otherofficeospp\ospp.vbs
- %WINDIR%\_temp11221928421663\otherofficeospp\slerror.xml
- %WINDIR%\_temp11221928421663\pic\backup-en.bmp
- %WINDIR%\_temp11221928421663\pic\backup-tra.bmp
- %WINDIR%\_temp11221928421663\oem\gr1dr7
- %WINDIR%\_temp11221928421663\office2010ospp\ospp.vbs
- %WINDIR%\_temp11221928421663\pic\backup.bmp
- %WINDIR%\_temp11221928421663\pic\head.bmp
- %WINDIR%\_temp11221928421663\pic\inst-en.bmp
- %WINDIR%\_temp11221928421663\pic\inst-tra.bmp
- %WINDIR%\_temp11221928421663\pic\inst.bmp
- %WINDIR%\_temp11221928421663\pic\left.bmp
- %WINDIR%\_temp11221928421663\pic\ewm_wx.jpg
- %WINDIR%\_temp11221928421663\pic\ewm_zfb.jpg
- %WINDIR%\_temp11221928421663\oem\gr1dr6
- %WINDIR%\_temp11221928421663\oem\gr1dr5
- %WINDIR%\_temp11221928421663\oem\gr1dr34
- %WINDIR%\_temp11221928421663\oem\cert\toshib.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\tosinv.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\tosqci.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\trigem.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\vestel.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\vscaio.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\toscpl.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\wortma.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\yutc.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\_asus_.xrm-ms
- %WINDIR%\_temp11221928421663\oem\emulateslic
- %WINDIR%\_temp11221928421663\oem\emulateslic.bin
- %WINDIR%\_temp11221928421663\oem\gr1dr1
- %WINDIR%\_temp11221928421663\oem\gr1dr2
- %WINDIR%\_temp11221928421663\oem\cert\xplore.xrm-ms
- %WINDIR%\_temp11221928421663\pic\office.bmp
- %WINDIR%\_temp11221928421663\pic\restore-tra.bmp
- %WINDIR%\_temp11221928421663\kmsmini.7z
- %WINDIR%\_temp11221928421663\pic\restore.bmp
- %WINDIR%\_temp11221928421663\x64\secopatcher.dll
- %WINDIR%\_temp11221928421663\x64\setacl.exe
- %WINDIR%\_temp11221928421663\x64\sppextcomobjhook.dll
- %WINDIR%\_temp11221928421663\x86\cleanospp.exe
- %WINDIR%\_temp11221928421663\x86\msvcr100.dll
- %WINDIR%\_temp11221928421663\x64\cleanospp.exe
- %WINDIR%\_temp11221928421663\x64\msvcr100.dll
- %WINDIR%\_temp11221928421663\x86\secopatcher.dll
- %WINDIR%\_temp11221928421663\7z.exe
- %WINDIR%\_temp11221928421663\cert.7z
- %WINDIR%\_temp11221928421663\digital.7z
- %WINDIR%\_temp11221928421663\digitallicence.7z
- %WINDIR%\_temp11221928421663\heu_configuration.ini
- %WINDIR%\_temp11221928421663\x86\setacl.exe
- %WINDIR%\_temp11221928421663\x86\sppextcomobjhook.dll
- %WINDIR%\_temp11221928421663\oem\uefi.exe
- %WINDIR%\_temp11221928421663\oem\oemdumpnet40.exe
- %WINDIR%\_temp11221928421663\oem\oemdumpnet35.exe
- %WINDIR%\_temp11221928421663\pic\uninst-en.bmp
- %WINDIR%\_temp11221928421663\pic\uninst-tra.bmp
- %WINDIR%\_temp11221928421663\pic\uninst.bmp
- %WINDIR%\_temp11221928421663\pic\ver.ico
- %WINDIR%\_temp11221928421663\pic\windows.bmp
- %WINDIR%\_temp11221928421663\pic\zanzhu.ico
- %WINDIR%\_temp11221928421663\pic\shuoming.jpg
- %WINDIR%\_temp11221928421663\setupcomplete.data
- %WINDIR%\_temp11221928421663\kms-client.exe
- %WINDIR%\_temp11221928421663\kms-server.exe
- %WINDIR%\_temp11221928421663\kms.exe
- %WINDIR%\_temp11221928421663\kms_x64.exe
- %WINDIR%\_temp11221928421663\oem\bootrest.exe
- %WINDIR%\_temp11221928421663\oem\bootsect.exe
- %WINDIR%\_temp11221928421663\svctrigger.xml
- %WINDIR%\_temp11221928421663\oem\cert\tosbyd.xrm-ms
- %WINDIR%\_temp11221928421663\pic\restore-en.bmp
- %WINDIR%\_temp11221928421663\oem\cert\tosasu.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hspw07.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\exc.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\exo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\foundr.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\fsc.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\fuj.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\dsgltd.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\equus.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\gbt.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hasee.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hclinf.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hedy06.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\higrad.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hp.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\gensys.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\haier.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\dell.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\dealin.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\datate.xrm-ms
- %WINDIR%\_temp11221928421663\heu_set.ini
- %WINDIR%\_temp11221928421663\oem\cert\acrsys.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\alware.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\aquari.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\atcomp.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\bekopc.xrm-ms
- %WINDIR%\_temp11221928421663\heu_kms_renewal.xml
- %WINDIR%\_temp11221928421663\oem\cert\benq.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\casper.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\ccelnf.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\cgwall.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\cmscom.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\creaas.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\czc011.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\bgh.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hpqoem.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\hyrslp.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\thoa21.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\ibm.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\onkyo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\philco.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\positi.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\prdgt.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\qbexco.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\olipro.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\olislp.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\quanmx.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\sony.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\stinfo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\synnex.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\sysmax.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\tarox1.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\rm.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\seccsd.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\oegrou.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\nokia.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\nec.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\jetway.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\jooyon.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\k.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\krftwy.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\lanix1.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\lenovo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\itinfo.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\lge.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\matbio.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\matech.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\medion.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\mitac.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\msi_nb.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\navihb.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\login2.xrm-ms
- %WINDIR%\_temp11221928421663\oem\cert\thtfpc.xrm-ms
- %WINDIR%\_temp11221928421663\scriptdir.ini
- %TEMP%\aut6824.tmp
- %TEMP%\aut760a.tmp
- %TEMP%\aut77a1.tmp
- %TEMP%\aut781f.tmp
- %TEMP%\aut78ac.tmp
- %TEMP%\aut790b.tmp
- ClassName: 'MS_AutodialMonitor' WindowName: ''
- ClassName: 'MS_WebCheckMonitor' WindowName: ''
- '%WINDIR%\_temp11221928421663\7z.exe' x %WINDIR%\_temp11221928421663\KMSmini.7z -y -o%WINDIR%\_temp11221928421663
- '%WINDIR%\_temp11221928421663\kms_x64.exe'
- '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_temp11221928421663 >>%windir%\ScriptTemp.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...' (with hidden window)
- '%WINDIR%\_temp11221928421663\7z.exe' x %WINDIR%\_temp11221928421663\KMSmini.7z -y -o%WINDIR%\_temp11221928421663' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_temp11221928421663\ScriptDir.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Current directory> >>%windir%\_temp11221928421663\ScriptDir.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<File name>.exe >>%windir%\_temp11221928421663\ScriptDir.ini' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c echo [Temp] >%windir%\ScriptTemp.ini
- '%WINDIR%\syswow64\cmd.exe' /c echo Temp=_temp11221928421663 >>%windir%\ScriptTemp.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall delete rule name="HEU_KMS_Activator"
- '%WINDIR%\syswow64\netsh.exe' advfirewall firewall delete rule name="HEU_KMS_Activator"
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & netsh advfirewall firewall add rule name="HEU_KMS_Activator" dir=in action=allow profile=any program...
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo [Direction] >%windir%\_temp11221928421663\ScriptDir.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Dir=<Current directory> >>%windir%\_temp11221928421663\ScriptDir.ini
- '%WINDIR%\syswow64\cmd.exe' /c set "Path=%SystemRoot%;<SYSTEM32>;<SYSTEM32>\Wbem;<SYSTEM32>\WindowsPowerShell\v1.0\;" & echo Name=<File name>.exe >>%windir%\_temp11221928421663\ScriptDir.ini