Техническая информация
- '%TEMP%\KMS.exe' Windows=Random Office2010=Random Office2013=Random RenewalInterval=43200 ActivationInterval=43200 Port=2025
- '%TEMP%\activation.exe'
- '<SYSTEM32>\findstr.exe' /i Office
- '<SYSTEM32>\wbem\wmic.exe' path SoftwareLicensingProduct where (Description like '%KMSCLIENT%') get Name /format:list
- '<SYSTEM32>\wbem\wmic.exe' path OfficeSoftwareProtectionService get version /format:list
- '<SYSTEM32>\findstr.exe' /i Windows
- '<SYSTEM32>\openfiles.exe'
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\install.cmd" "
- '<SYSTEM32>\schtasks.exe' /create /tn "KMS Aktivasyon " /tr "%WINDIR%\KMS.exe" /SC DAILY /RU SYSTEM /RL Highest /F
- '<SYSTEM32>\schtasks.exe' /create /tn "KMS Aktivasyon" /tr "%WINDIR%\KMS.exe" /SC ONSTART /RU SYSTEM /RL Highest /F
- <SYSTEM32>\wbem\AutoRecover\C8463ECBE33BC240263A0B094E46D510.mof
- %TEMP%\tmp2.tmp
- %TEMP%\tmp1.tmp
- <SYSTEM32>\wbem\Logs\WMIC.LOG
- <SYSTEM32>\wbem\AutoRecover\23BDE61F1F4FACE17E9B0C01F2A1FD9B.mof
- %TEMP%\tmp3.tmp
- %TEMP%\activation.exe
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\$inst\2.tmp
- %WINDIR%\KMS.exe
- %TEMP%\KMS.exe
- %TEMP%\install.cmd
- %TEMP%\KMS.exe
- %TEMP%\activation.exe
- %TEMP%\tmp2.tmp
- %TEMP%\tmp3.tmp
- %TEMP%\$inst\temp_0.tmp
- %TEMP%\tmp1.tmp
- ClassName: 'EDIT' WindowName: ''
- ClassName: 'Shell_TrayWnd' WindowName: ''