Analysis

  • max time kernel
    84s
  • max time network
    112s
  • platform
    windows7_x64
  • resource
    win7-20230220-es
  • resource tags

    arch:x64arch:x86image:win7-20230220-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    18-05-2023 17:22

General

  • Target

    Setup_File_KMS_Pico.exe

  • Size

    5MB

  • MD5

    c2b81d548b4dd613a4ff3f3c05ea6716

  • SHA1

    3a0fce6c9030d95bd4d825a0e5eb9bdd7d442c75

  • SHA256

    057c4de6f0478c0abfa1f6ceb87be4381e1ac2a6ab5ab0bc0bfbf8e18de40cfe

  • SHA512

    beccbc9105da411667b83f7028df90ecd17e9d494f0535df4635cdc31b8a83e0c74b18d54223308d37095583683318ae548cb37a54f9a634a37e6d61d125b3e0

  • SSDEEP

    98304:5bQqRZbDm1gvsKm4U65d3JfHJ8bdvlC+chgnCN0g7YqBw/qfipVQMDkGhRCogKP:5BbDmuHm4U+Ml7chgVUBw4ELbHCogKP

Malware Config

Extracted

Family

cryptbot

C2

http://yawfyx24.top/gate.php

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup_File_KMS_Pico.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup_File_KMS_Pico.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe"
      2⤵
      • Executes dropped EXE
      • Maps connected drives based on registry
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:664
      • C:\Windows\SysWOW64\cmd.exe
        /C schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.exe""" """C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.dat"""" /sc once /du 9700:20 /ri 1 /st 00:05 /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1948
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.exe""" """C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.dat"""" /sc once /du 9700:20 /ri 1 /st 00:05 /f
          4⤵
          • Creates scheduled task(s)
          PID:596
      • C:\Windows\SysWOW64\cmd.exe
        /C "C:\Users\Admin\AppData\Roaming\yohbjrpfo\KMS_pico.exe"
        3⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Users\Admin\AppData\Roaming\yohbjrpfo\KMS_pico.exe
          C:\Users\Admin\AppData\Roaming\yohbjrpfo\KMS_pico.exe
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1124
          • C:\Users\Admin\AppData\Local\Temp\is-J36HA.tmp\KMS_pico.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-J36HA.tmp\KMS_pico.tmp" /SL5="$3017C,2952592,69120,C:\Users\Admin\AppData\Roaming\yohbjrpfo\KMS_pico.exe"
            5⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:972
            • C:\Program Files\KMSpico\UninsHs.exe
              "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\Admin\AppData\Roaming\yohbjrpfo\KMS_pico.exe
              6⤵
                PID:1048
              • C:\Windows\system32\cmd.exe
                "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""
                6⤵
                  PID:956
                • C:\Windows\system32\cmd.exe
                  "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""
                  6⤵
                    PID:1996
                    • C:\Windows\system32\sc.exe
                      sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
                      7⤵
                      • Launches sc.exe
                      PID:492
                  • C:\Program Files\KMSpico\KMSELDI.exe
                    "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup
                    6⤵
                      PID:1648
          • C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.exe
            C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.exe "C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.dat"
            1⤵
              PID:1160
            • C:\Windows\system32\taskeng.exe
              taskeng.exe {F52E9EA0-0AF8-41CC-A3A3-33A3AB67A5B3} S-1-5-21-1563773381-2037468142-1146002597-1000:YBHADZIG\Admin:Interactive:[1]
              1⤵
                PID:924
              • C:\Windows\system32\schtasks.exe
                SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
                1⤵
                • Creates scheduled task(s)
                PID:1020

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Execution

              Scheduled Task

              1
              T1053

              Persistence

              New Service

              1
              T1050

              Scheduled Task

              1
              T1053

              Privilege Escalation

              New Service

              1
              T1050

              Scheduled Task

              1
              T1053

              Credential Access

              Credentials in Files

              2
              T1081

              Discovery

              Query Registry

              3
              T1012

              Peripheral Device Discovery

              1
              T1120

              System Information Discovery

              3
              T1082

              Collection

              Data from Local System

              2
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll
                Filesize

                5MB

                MD5

                1397b23f30681f97049df61f94f54d05

                SHA1

                5cb1ce6966e3d6d8b8c398cbd537c814312f194d

                SHA256

                fa76151a783250014ac8fa55d4c833100a623fcad1d6e2ddadcde259f5709609

                SHA512

                7d001b5942dad8ce1a83831b5a87f2fa6a1571bc133ce3c1ebe9988a43a7fcefc5cdb7870a6e692ef89fb815cfcff0e9c4b41f24ba0716c6808f190ea3c53535

              • C:\Program Files\KMSpico\KMSELDI.exe
                Filesize

                921KB

                MD5

                f0280de3880ef581bf14f9cc72ec1c16

                SHA1

                43d348e164c35f9e02370f6f66186fbfb15ae2a3

                SHA256

                50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc

                SHA512

                ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

              • C:\Program Files\KMSpico\KMSELDI.exe
                Filesize

                921KB

                MD5

                f0280de3880ef581bf14f9cc72ec1c16

                SHA1

                43d348e164c35f9e02370f6f66186fbfb15ae2a3

                SHA256

                50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc

                SHA512

                ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

              • C:\Program Files\KMSpico\KMSELDI.exe
                Filesize

                921KB

                MD5

                f0280de3880ef581bf14f9cc72ec1c16

                SHA1

                43d348e164c35f9e02370f6f66186fbfb15ae2a3

                SHA256

                50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc

                SHA512

                ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

              • C:\Program Files\KMSpico\UninsHs.exe
                Filesize

                29KB

                MD5

                245824502aefe21b01e42f61955aa7f4

                SHA1

                a58682a8aae6302f1c934709c5aa1f6c86b2be99

                SHA256

                0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

                SHA512

                204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

              • C:\Program Files\KMSpico\UninsHs.exe
                Filesize

                29KB

                MD5

                245824502aefe21b01e42f61955aa7f4

                SHA1

                a58682a8aae6302f1c934709c5aa1f6c86b2be99

                SHA256

                0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

                SHA512

                204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

              • C:\Program Files\KMSpico\UninsHs.exe
                Filesize

                29KB

                MD5

                245824502aefe21b01e42f61955aa7f4

                SHA1

                a58682a8aae6302f1c934709c5aa1f6c86b2be99

                SHA256

                0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

                SHA512

                204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

              • C:\Program Files\KMSpico\scripts\Install_Service.cmd
                Filesize

                213B

                MD5

                9107cd31951f2cf90e0892740b9087c9

                SHA1

                efac5c2e59ddef2f0a7782ad1dea8f6b25a07395

                SHA256

                11578521b14c17fbbb070c13887161586d57196f4d408c41a0f02ed07ee32f2c

                SHA512

                f6b66dcbbb8aa55793b63f20fc3718038d7c35f94570cf487b6e8393f67be6bd004dd64f3b8fc8345b7e02e2e8ec2d48ceed2494d9f1282ca020dbbaa621f457

              • C:\Program Files\KMSpico\scripts\Install_Task.cmd
                Filesize

                220B

                MD5

                ade709ca6a00370a4a6fea2425f948c1

                SHA1

                5919c95ef78bd4ab200f8071b98970ff9541a24a

                SHA256

                5b067073b968361fe489017d173040655f21890605d39cdb012a030dd75b52a8

                SHA512

                860f9f12bc4995fae7c74481c2b24a346e763e32a782b3826c0f0772ad90be48377faefd883c9a28b221f8476fd203782932fee859b079fb7d4b1b152cce7b53

              • C:\Users\Admin\AppData\Local\Temp\775A.tmp
                Filesize

                32B

                MD5

                9007aba6f5ee53a482249147787479b2

                SHA1

                4ac87bdc6d0eb472030d4f70d9aa265d7fdcb730

                SHA256

                9e1905de40a93ef8708e59f3861320b915c8cd029c7614d92cb526407d4cca0f

                SHA512

                ff645e2a70960ce438921c2dd1eaec811facf54a865b5977b9f8d1327ac2a499a99d42df80b9cb75ff8b4e7746194d4748b49b27cda17832c59d90091b5584fb

              • C:\Users\Admin\AppData\Local\Temp\79CE.tmp
                Filesize

                71KB

                MD5

                dfeffc3924409d9c9d3c8cae05be922b

                SHA1

                a89046cbf54c00e17ff0a5f3e1a8f01eb399bce4

                SHA256

                06ea3ad1c1c1067bfdfaa5ad8a91632fac6cad9776ded85fa65d3b6181d89be6

                SHA512

                d9614ecf528a2bf48cafe99a4c54d5c9f3656d628001fbf575d367d5ad8008cf30a58a7b3d9489d8534064442df89a7263df4a91d0863dcd6cc33574c576da33

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
                Filesize

                230MB

                MD5

                9f219986dba2511836fe5f069803df5d

                SHA1

                548372676cbb63c46b6f451123d62db2cb504619

                SHA256

                383c56e5c4e77d596546884868e747f935a31c1f72f41a917ba5cf873dad4be1

                SHA512

                31accab85f45fef086c9ef7a3b3307ad6e160ec6e82d92d9ccfbf9fcae25169c23afc4440a6fb54aceb6dfaf7deb505ec18401550786fdae1560a46087d9bdcc

              • C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
                Filesize

                236MB

                MD5

                3e338108f4b74ec857b486f131e6bfd6

                SHA1

                05d85c12241f6b8951351bfaf751249aa8f79a78

                SHA256

                951e9326c2ba8fda7135ab99b9f219186ef7f6acb4086146efd9c153c53298e8

                SHA512

                2f1b62225192838bf65a4c5fdbd99509be09c84cd6e7e2efc614a3f0bd03ae0cb68b6263fbe293c8a1252ef9067bc74b8fa06f08756c55cc4eec7bd0c2e3a265

              • C:\Users\Admin\AppData\Local\Temp\is-J36HA.tmp\KMS_pico.tmp
                Filesize

                703KB

                MD5

                1778c1f66ff205875a6435a33229ab3c

                SHA1

                5b6189159b16c6f85feed66834af3e06c0277a19

                SHA256

                95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

                SHA512

                8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

              • C:\Users\Admin\AppData\Local\Temp\is-J36HA.tmp\KMS_pico.tmp
                Filesize

                703KB

                MD5

                1778c1f66ff205875a6435a33229ab3c

                SHA1

                5b6189159b16c6f85feed66834af3e06c0277a19

                SHA256

                95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

                SHA512

                8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

              • C:\Users\Admin\AppData\Roaming\yohbjrpfo\KMS_pico.exe
                Filesize

                3MB

                MD5

                a02164371a50c5ff9fa2870ef6e8cfa3

                SHA1

                060614723f8375ecaad8b249ff07e3be082d7f25

                SHA256

                64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

                SHA512

                6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

              • C:\Users\Admin\AppData\Roaming\yohbjrpfo\KMS_pico.exe
                Filesize

                3MB

                MD5

                a02164371a50c5ff9fa2870ef6e8cfa3

                SHA1

                060614723f8375ecaad8b249ff07e3be082d7f25

                SHA256

                64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

                SHA512

                6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

              • C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.dat
                Filesize

                136KB

                MD5

                0bb6c9e676ac5a89004e97587a3ed419

                SHA1

                f619dcf92595c4541a36c04a11cb0c95fbaf602e

                SHA256

                7c3d215e085c842786240fd5aff5fe910c2409a2ce16ec2749193dde70ea33c2

                SHA512

                881c26d40389160f92e8f204e74a41ee3a8270942b7664192dfb5fc7bc2162586bb523af3cdc59f056f0ecad5f2f0404721ccc6c93e1c256beacbca89cddecb7

              • C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.exe
                Filesize

                872KB

                MD5

                c56b5f0201a3b3de53e561fe76912bfd

                SHA1

                2a4062e10a5de813f5688221dbeb3f3ff33eb417

                SHA256

                237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                SHA512

                195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

              • C:\Users\Admin\AppData\Roaming\yohbjrpfo\corsve.exe
                Filesize

                872KB

                MD5

                c56b5f0201a3b3de53e561fe76912bfd

                SHA1

                2a4062e10a5de813f5688221dbeb3f3ff33eb417

                SHA256

                237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d

                SHA512

                195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c

              • C:\Windows\System32\Vestris.ResourceLib.dll
                Filesize

                88KB

                MD5

                3d733144477cadcf77009ef614413630

                SHA1

                0a530a2524084f1d2a85b419f033e1892174ab31

                SHA256

                392d73617fd0a55218261572ece2f50301e0cfa29b5ed24c3f692130aa406af3

                SHA512

                be6b524d67d69385a02874a2d96d4270335846bece7b528308e136428fd67af66a4216d90da4f288aeefd00a0ba5d5f3b5493824fcb352b919ab25e7ef50b81c

              • \Program Files\KMSpico\AutoPico.exe
                Filesize

                728KB

                MD5

                cfe1c391464c446099a5eb33276f6d57

                SHA1

                9999bfcded2c953e025eabaa66b4971dab122c24

                SHA256

                4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa

                SHA512

                4119a1722202bbc33339747ea02fd35b327890d55bb472cd1e2146ca446d8ba6fddb1e8cf8bbfaeb08aec8ed2a9d5c0fa71b73510d409ffacd3908fa72bb53b4

              • \Program Files\KMSpico\KMSELDI.exe
                Filesize

                921KB

                MD5

                f0280de3880ef581bf14f9cc72ec1c16

                SHA1

                43d348e164c35f9e02370f6f66186fbfb15ae2a3

                SHA256

                50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc

                SHA512

                ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

              • \Program Files\KMSpico\KMSELDI.exe
                Filesize

                921KB

                MD5

                f0280de3880ef581bf14f9cc72ec1c16

                SHA1

                43d348e164c35f9e02370f6f66186fbfb15ae2a3

                SHA256

                50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc

                SHA512

                ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

              • \Program Files\KMSpico\UninsHs.exe
                Filesize

                29KB

                MD5

                245824502aefe21b01e42f61955aa7f4

                SHA1

                a58682a8aae6302f1c934709c5aa1f6c86b2be99

                SHA256

                0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

                SHA512

                204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

              • \Program Files\KMSpico\UninsHs.exe
                Filesize

                29KB

                MD5

                245824502aefe21b01e42f61955aa7f4

                SHA1

                a58682a8aae6302f1c934709c5aa1f6c86b2be99

                SHA256

                0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

                SHA512

                204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

              • \Program Files\KMSpico\UninsHs.exe
                Filesize

                29KB

                MD5

                245824502aefe21b01e42f61955aa7f4

                SHA1

                a58682a8aae6302f1c934709c5aa1f6c86b2be99

                SHA256

                0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

                SHA512

                204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

              • \Program Files\KMSpico\UninsHs.exe
                Filesize

                29KB

                MD5

                245824502aefe21b01e42f61955aa7f4

                SHA1

                a58682a8aae6302f1c934709c5aa1f6c86b2be99

                SHA256

                0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

                SHA512

                204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

              • \Program Files\KMSpico\UninsHs.exe
                Filesize

                29KB

                MD5

                245824502aefe21b01e42f61955aa7f4

                SHA1

                a58682a8aae6302f1c934709c5aa1f6c86b2be99

                SHA256

                0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

                SHA512

                204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

              • \Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
                Filesize

                218MB

                MD5

                852e01a4f0e5a953847f06ba76393698

                SHA1

                6c8a35f862cee758c4cfa7305775f5a90ab5de05

                SHA256

                fb8587b41ef108a31bfaa3e1fb1140a79d61bce265a5feaf09ff00c85fba66cc

                SHA512

                0a381473a5d4d61bed2de81d17e1a667445ff222b680b8e3bdd7c3c2b2c1d119c443fa549d5b5fa238689a9dd45b04f05c28f1309a9582afb1fa12bd6a725750

              • \Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
                Filesize

                215MB

                MD5

                6658893b889beafcb77ae0c4e416f6ed

                SHA1

                f8d2b18b4c26faa7a596f51269d4ef0ca0b4823d

                SHA256

                746005f36e0364c61373bc3b484a48e20ea2e650a5bc581a4f4d29efbbd2e965

                SHA512

                c4cd477a0340452464150fef34a050d7424e3d0c790a1691c0005a57a43ec71e2f58c981a1bc87d1c4f526c060216a36e4732c4dbf30e421901d66acd65a2c11

              • \Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
                Filesize

                220MB

                MD5

                297eb855245f291f45974c9ae1cd8164

                SHA1

                0b63e9ced99d8e1f7b679af4cdf906d48ae477f8

                SHA256

                3b39f80b97e94fcf8211bff424206b7b9ec75a3a12121d9eb8a54fceffdd1aac

                SHA512

                0b3f3d8de525fa2ec0465b2e262f38fe6e3cb48fd4cddc49f49837c617022e0928100d7309c0caeea925782a53d0df51204135f3e3b4573e647d44a9e84716d5

              • \Users\Admin\AppData\Local\Temp\is-1F3L1.tmp\_isetup\_shfoldr.dll
                Filesize

                22KB

                MD5

                92dc6ef532fbb4a5c3201469a5b5eb63

                SHA1

                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                SHA256

                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                SHA512

                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

              • \Users\Admin\AppData\Local\Temp\is-1F3L1.tmp\_isetup\_shfoldr.dll
                Filesize

                22KB

                MD5

                92dc6ef532fbb4a5c3201469a5b5eb63

                SHA1

                3e89ff837147c16b4e41c30d6c796374e0b8e62c

                SHA256

                9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

                SHA512

                9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

              • \Users\Admin\AppData\Local\Temp\is-J36HA.tmp\KMS_pico.tmp
                Filesize

                703KB

                MD5

                1778c1f66ff205875a6435a33229ab3c

                SHA1

                5b6189159b16c6f85feed66834af3e06c0277a19

                SHA256

                95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

                SHA512

                8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

              • \Users\Admin\AppData\Roaming\yohbjrpfo\KMS_pico.exe
                Filesize

                3MB

                MD5

                a02164371a50c5ff9fa2870ef6e8cfa3

                SHA1

                060614723f8375ecaad8b249ff07e3be082d7f25

                SHA256

                64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

                SHA512

                6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

              • memory/664-162-0x00000000001D0000-0x000000000028F000-memory.dmp
                Filesize

                764KB

              • memory/664-67-0x0000000000020000-0x0000000000022000-memory.dmp
                Filesize

                8KB

              • memory/664-74-0x00000000001D0000-0x000000000028F000-memory.dmp
                Filesize

                764KB

              • memory/972-954-0x0000000000400000-0x00000000004C0000-memory.dmp
                Filesize

                768KB

              • memory/972-955-0x0000000008960000-0x0000000008968000-memory.dmp
                Filesize

                32KB

              • memory/972-159-0x0000000000400000-0x00000000004C0000-memory.dmp
                Filesize

                768KB

              • memory/972-977-0x0000000000400000-0x00000000004C0000-memory.dmp
                Filesize

                768KB

              • memory/972-170-0x0000000000400000-0x00000000004C0000-memory.dmp
                Filesize

                768KB

              • memory/972-92-0x0000000000240000-0x0000000000241000-memory.dmp
                Filesize

                4KB

              • memory/972-182-0x0000000000400000-0x00000000004C0000-memory.dmp
                Filesize

                768KB

              • memory/972-235-0x0000000000400000-0x00000000004C0000-memory.dmp
                Filesize

                768KB

              • memory/1048-966-0x0000000000400000-0x0000000000417000-memory.dmp
                Filesize

                92KB

              • memory/1124-75-0x0000000000400000-0x0000000000417000-memory.dmp
                Filesize

                92KB

              • memory/1124-104-0x0000000000400000-0x0000000000417000-memory.dmp
                Filesize

                92KB

              • memory/1648-973-0x00000000013D0000-0x00000000014BA000-memory.dmp
                Filesize

                936KB

              • memory/1648-974-0x0000000000590000-0x0000000000610000-memory.dmp
                Filesize

                512KB

              • memory/1648-978-0x000000001B2F0000-0x000000001B830000-memory.dmp
                Filesize

                5MB