Technical Information
Modifies file system
Creates the following files
- %TEMP%\winact\actstat.cmd
- %TEMP%\aut209a.tmp
- %TEMP%\ofiwktq
- %TEMP%\aut1d9e.tmp
- %TEMP%\rgrmuzm
- %TEMP%\aut1a82.tmp
- %TEMP%\xniqqwf
- %TEMP%\aut1709.tmp
- %TEMP%\onkkkde
- %TEMP%\nujgskg
- %TEMP%\aut12a6.tmp
- %WINDIR%\setup\scripts\winact\windows_loader.exe
- %WINDIR%\setup\scripts\winact\w10digitalactivation.exe
- %WINDIR%\setup\scripts\winact\dinjector.exe
- %WINDIR%\setup\scripts\winact\consoleact.exe
- %WINDIR%\setup\scripts\winact\keys.ini
- %WINDIR%\setup\scripts\winact\add_defender_exclusion.cmd
- %WINDIR%\setup\scripts\winact\activation.cmd
- %TEMP%\winact\winact.exe
- nul
- %TEMP%\slmgr.vbs
Deletes the following files
- %TEMP%\aut12a6.tmp
- %WINDIR%\setup\scripts\winact\w10digitalactivation.exe
- %WINDIR%\setup\scripts\winact\keys.ini
- %WINDIR%\setup\scripts\winact\dinjector.exe
- %WINDIR%\setup\scripts\winact\consoleact.exe
- %WINDIR%\setup\scripts\winact\add_defender_exclusion.cmd
- %WINDIR%\setup\scripts\winact\activation.cmd
- %TEMP%\nujgskg
- %TEMP%\aut209a.tmp
- %TEMP%\ofiwktq
- %TEMP%\aut1d9e.tmp
- %TEMP%\rgrmuzm
- %TEMP%\aut1a82.tmp
- %TEMP%\xniqqwf
- %TEMP%\aut1709.tmp
- %TEMP%\onkkkde
- %WINDIR%\setup\scripts\winact\windows_loader.exe
- %TEMP%\slmgr.vbs
Miscellaneous
Searches for the following windows
- ClassName: 'STATIC' WindowName: 'q3TDgcZ4p2up0Z77amQP 00000994'
Creates and executes the following
- '%TEMP%\winact\winact.exe'
- '%TEMP%\winact\winact.exe' -sfxwaitall:1 "activation.cmd"
- '%WINDIR%\setup\scripts\winact\dinjector.exe' /A "%WINDIR%\Setup\Scripts"
- '%WINDIR%\setup\scripts\winact\dinjector.exe' /A "%WINDIR%\ConsoleAct.exe"
- '%WINDIR%\setup\scripts\winact\dinjector.exe' /A "%WINDIR%\Setup\Scripts\WinAct\ConsoleAct.exe"
- '%WINDIR%\setup\scripts\winact\dinjector.exe' /A "%WINDIR%\Setup\Scripts\WinAct\W10DigitalActivation.exe"
- '%WINDIR%\setup\scripts\winact\dinjector.exe' /A "%WINDIR%\Setup\Scripts\WinAct\Windows_Loader.exe"
- '%WINDIR%\setup\scripts\winact\windows_loader.exe' /silent
- '%TEMP%\winact\winact.exe' ' (with hidden window)
- '%TEMP%\winact\winact.exe' -sfxwaitall:1 "activation.cmd"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Setup\Scripts\WinAct\activation.cmd" "' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /A /C "compact /u \\?\Volume{c84d25cc-f368-11e4-889d-806e6f6e6963}\XELDZ"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\WinAct\ActStat.cmd" "' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c ""%WINDIR%\Setup\Scripts\WinAct\activation.cmd" "
- '<SYSTEM32>\net1.exe' start sppsvc /y
- '<SYSTEM32>\net.exe' start sppsvc /y
- '<SYSTEM32>\mode.com' con cols=62 lines=20
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\WinAct\ActStat.cmd" "
- '%WINDIR%\syswow64\mode.com' con cols=62 lines=20
- '%WINDIR%\syswow64\cmd.exe' /c ""%TEMP%\WinAct\ActStat.cmd" "
- '<SYSTEM32>\cscript.exe' //nologo slmgr.vbs /dli
- '%WINDIR%\syswow64\compact.exe' /u \\?\Volume{c84d25cc-f368-11e4-889d-806e6f6e6963}\XELDZ
- '%WINDIR%\syswow64\dism.exe' /Online /Get-CurrentEdition
- '%WINDIR%\syswow64\findstr.exe' "Enterprise"
- '%WINDIR%\syswow64\cmd.exe' /S /D /c" start "" /b /w dism /Online /Get-CurrentEdition "
- '%WINDIR%\syswow64\cmd.exe' /c ver
- '%WINDIR%\syswow64\attrib.exe' -R -A -S -H *.*
- '%WINDIR%\syswow64\reg.exe' query "HKU\S-1-5-19\Environment"
- '%WINDIR%\syswow64\cmd.exe' /A /C "compact /u \\?\Volume{c84d25cc-f368-11e4-889d-806e6f6e6963}\XELDZ"
- '<SYSTEM32>\cscript.exe' //nologo slmgr.vbs /xpr
