Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\activationoffice
Malicious functions
Executes the following
- '<SYSTEM32>\net.exe' stop sppsvc /y
- '<SYSTEM32>\net.exe' stop osppsvc /y
- '<SYSTEM32>\netsh.exe' Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
- '<SYSTEM32>\taskkill.exe' /t /f /IM KMSSS.exe
Modifies file system
Creates the following files
- %TEMP%\activationoffice\consoleact.7z
- %TEMP%\activationoffice\stapt.cmd
- %TEMP%\activationoffice\7za.exe
- %TEMP%\activationoffice\dinjector.exe
- %TEMP%\aut3f22.tmp
- %TEMP%\rtmrvud
- %TEMP%\activationoffice\office.txt
- <Current directory>\days.txt
- %WINDIR%\aact\consoleact.exe
- nul
- <SYSTEM32>\sppextcomobjhook.dll
Deletes the following files
- %TEMP%\aut3f22.tmp
- %TEMP%\rtmrvud
- <SYSTEM32>\sppextcomobjhook.dll
- %TEMP%\activationoffice\7za.exe
- %TEMP%\activationoffice\consoleact.7z
- %TEMP%\activationoffice\dinjector.exe
- %TEMP%\activationoffice\office.txt
- %TEMP%\activationoffice\stapt.cmd
Miscellaneous
Creates and executes the following
- '%TEMP%\activationoffice\dinjector.exe' /A %WINDIR%\AAct
- '%WINDIR%\aact\consoleact.exe' /taskofs
- '%TEMP%\activationoffice\7za.exe' x "%TEMP%\ActivationOffice\ConsoleAct.7z" -y -p666 -aos -o"%WINDIR%\AAct""
- '%WINDIR%\aact\consoleact.exe' /ofs=act
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_ActivationInterval" /t REG_DWORD /d 120 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_RenewalInterval" /t REG_DWORD /d 10080 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "VerifierDlls" /t REG_SZ /d "SppExtComObjHook.dll" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /t REG_SZ /d 10.3.0.20 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /t REG_SZ /d 1688 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cscript.exe "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /act 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_Emulation" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "GlobalFlag" /t REG_DWORD /d 256 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Debugger" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_Emulation" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c taskkill.exe /t /f /IM KMSSS.exe 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "Debugger" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_Emulation" /t REG_DWORD /d 1 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c copy <SYSTEM32>\Tasks\ConsoleAct "%TEMP%\ConsoleAct.tmp" /Y 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_RenewalInterval" /t REG_DWORD /d 10080 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "VerifierDlls" /t REG_SZ /d "SppExtComObjHook.dll" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c REG QUERY HKLM\Software\Microsoft\Office /s /v Path /reg:64' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ipconfig.exe /flushdns 2>&1' (with hidden window)
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:64' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cscript.exe "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /sethst:10.3.0.20 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cscript.exe "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /setprt:1688 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c cscript.exe <SYSTEM32>\slmgr.vbs //NoLogo /skms 10.3.0.20:1688 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc.exe stop sppsvc >nul 2>&1 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net.exe stop sppsvc /y 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c net.exe stop osppsvc /y 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ActivationOffice\STAPT.CMD" <Current directory>"' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v "NoGenTicket" /f 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /delete /f /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger" 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v Debugger 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_Emulation" /t REG_DWORD /d 1 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "GlobalFlag" /t REG_DWORD /d 256 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_ActivationInterval" /t REG_DWORD /d 120 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c sc.exe stop osppsvc >nul 2>&1 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v Debugger 2>&1' (with hidden window)
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /create /TN ConsoleAct /XML %WINDIR%\ConsoleAct.xml 2>&1' (with hidden window)
Executes the following
- '<SYSTEM32>\cmd.exe' /c ""%TEMP%\ActivationOffice\STAPT.CMD" <Current directory>"
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /t REG_SZ /d 1688 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /t REG_SZ /d 10.3.0.20
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v "KeyManagementServiceName" /t REG_SZ /d 10.3.0.20 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "VerifierDlls" /t REG_SZ /d "SppExtComObjHook.dll"
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "VerifierDlls" /t REG_SZ /d "SppExtComObjHook.dll" 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_RenewalInterval" /t REG_DWORD /d 10080
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_RenewalInterval" /t REG_DWORD /d 10080 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform" /f /v "KeyManagementServicePort" /t REG_SZ /d 1688
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_ActivationInterval" /t REG_DWORD /d 120
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "GlobalFlag" /t REG_DWORD /d 256
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "GlobalFlag" /t REG_DWORD /d 256 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_Emulation" /t REG_DWORD /d 1
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_Emulation" /t REG_DWORD /d 1 2>&1
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v Debugger
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v Debugger 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "VerifierDlls" /t REG_SZ /d "SppExtComObjHook.dll"
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_ActivationInterval" /t REG_DWORD /d 120 2>&1
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Debugger"
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /create /TN ConsoleAct /XML %WINDIR%\ConsoleAct.xml 2>&1
- '<SYSTEM32>\cscript.exe' "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /act
- '<SYSTEM32>\cmd.exe' /c copy <SYSTEM32>\Tasks\ConsoleAct "%TEMP%\ConsoleAct.tmp" /Y 2>&1
- '<SYSTEM32>\cmd.exe' /c taskkill.exe /t /f /IM KMSSS.exe 2>&1
- '<SYSTEM32>\netsh.exe' Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
- '<SYSTEM32>\cmd.exe' /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP 2>&1
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f 2>&1
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_Emulation"
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "VerifierDlls" /t REG_SZ /d "SppExtComObjHook.dll" 2>&1
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "KMS_Emulation" 2>&1
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\osppsvc.exe" /f /v "Debugger" 2>&1
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f 2>&1
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_Emulation"
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_Emulation" 2>&1
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "Debugger"
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "Debugger" 2>&1
- '<SYSTEM32>\cmd.exe' /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688 2>&1
- '<SYSTEM32>\cmd.exe' /c cscript.exe "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /act 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_RenewalInterval" /t REG_DWORD /d 10080
- '<SYSTEM32>\sc.exe' stop sppsvc
- '<SYSTEM32>\cmd.exe' /c cscript.exe <SYSTEM32>\slmgr.vbs //NoLogo /skms 10.3.0.20:1688 2>&1
- '<SYSTEM32>\cscript.exe' "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /setprt:1688
- '<SYSTEM32>\cmd.exe' /c cscript.exe "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /setprt:1688 2>&1
- '<SYSTEM32>\cscript.exe' "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /sethst:10.3.0.20
- '<SYSTEM32>\cmd.exe' /c cscript.exe "%ProgramFiles%\Microsoft Office\Office14\ospp.vbs" //NoLogo /sethst:10.3.0.20 2>&1
- '<SYSTEM32>\reg.exe' DELETE "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663" /f /reg:64
- '<SYSTEM32>\ipconfig.exe' /flushdns
- '<SYSTEM32>\cscript.exe' <SYSTEM32>\slmgr.vbs //NoLogo /skms 10.3.0.20:1688
- '<SYSTEM32>\cmd.exe' /c ipconfig.exe /flushdns 2>&1
- '<SYSTEM32>\cmd.exe' /c REG QUERY HKLM\Software\Microsoft\Office /s /v Path /reg:64
- '<SYSTEM32>\find.exe' /n /v "" %TEMP%\ActivationOffice\temp.txt
- '<SYSTEM32>\cmd.exe' /c find /n /v "" %TEMP%\ActivationOffice\temp.txt
- '<SYSTEM32>\find.exe' /i "REMAINING GRACE:"
- '<SYSTEM32>\cmd.exe' /S /D /c" type "%TEMP%\ActivationOffice\Office.txt" "
- '<SYSTEM32>\cscript.exe' ospp.vbs /dstatus
- '<SYSTEM32>\schtasks.exe' /create /tn ActivationOffice /tr "%WINDIR%\AAct\ActivationOffice.exe" /sc DAILY /mo 5 /f /ru System"
- '<SYSTEM32>\reg.exe' QUERY HKLM\Software\Microsoft\Office /s /v Path /reg:64
- '<SYSTEM32>\cmd.exe' /c schtasks.exe /delete /f /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger" 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_ActivationInterval" /t REG_DWORD /d 120
- '<SYSTEM32>\cmd.exe' /c net.exe stop sppsvc /y 2>&1
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_ActivationInterval" /t REG_DWORD /d 120 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "GlobalFlag" /t REG_DWORD /d 256
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "GlobalFlag" /t REG_DWORD /d 256 2>&1
- '<SYSTEM32>\reg.exe' add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_Emulation" /t REG_DWORD /d 1
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_Emulation" /t REG_DWORD /d 1 2>&1
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v Debugger
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v Debugger 2>&1
- '<SYSTEM32>\cmd.exe' /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe" /f /v "KMS_RenewalInterval" /t REG_DWORD /d 10080 2>&1
- '<SYSTEM32>\schtasks.exe' /delete /f /tn "\Microsoft\Windows\SoftwareProtectionPlatform\SvcTrigger"
- '<SYSTEM32>\reg.exe' delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v "NoGenTicket" /f
- '<SYSTEM32>\cmd.exe' /c reg.exe delete "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\Software Protection Platform" /v "NoGenTicket" /f 2>&1
- '<SYSTEM32>\net1.exe' stop osppsvc /y
- '<SYSTEM32>\cmd.exe' /c net.exe stop osppsvc /y 2>&1
- '<SYSTEM32>\sc.exe' stop osppsvc
- '<SYSTEM32>\cmd.exe' /c sc.exe stop osppsvc >nul 2>&1 2>&1
- '<SYSTEM32>\net1.exe' stop sppsvc /y
- '<SYSTEM32>\cmd.exe' /c sc.exe stop sppsvc >nul 2>&1 2>&1
- '<SYSTEM32>\schtasks.exe' /create /TN ConsoleAct /XML %WINDIR%\ConsoleAct.xml
