hxxps://archive[.]org/details/kms-pico-full-setup

Resubmissions

02/03/2024, 14:07

240302-rez5yaeb2s8

02/03/2024, 14:01

240302-rbzp1aed297

Analysis

max time kernel
62s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
02/03/2024, 14:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/details/kms-pico-full-setup
Sample240302-rez5yaeb2s

Score

8^/10

discovery persistence upx

Malware Config

Signatures

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe	KMSELDI.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe\Debugger = "C:\\Windows\\SECOH-QAD.exe"	KMSELDI.exe

Executes dropped EXE 6 IoCs

pid	Process
4784	KMS_pico.exe
1720	KMS_pico.exe
2796	KMS_pico.tmp
532	UninsHs.exe
1188	KMSELDI.exe
2260	SECOH-QAD.exe

Loads dropped DLL 1 IoCs

pid	Process
1480	SppExtComObj.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000700000002329c-940.dat	upx
behavioral1/memory/532-943-0x0000000000400000-0x0000000000417000-memory.dmp	upx
behavioral1/memory/532-944-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\is-L1VTD.tmp	KMS_pico.tmp
File created	C:\Windows\system32\is-VO0JM.tmp	KMS_pico.tmp
File opened for modification	C:\Windows\system32\Vestris.ResourceLib.dll	KMS_pico.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-R2JEP.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-J87U6.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\scripts\is-R6M7N.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-93H69.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-GGKTI.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-RMBA0.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-KRP1T.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\scripts\is-4PVF9.tmp	KMS_pico.tmp
File opened for modification	C:\Program Files\KMSpico\Vestris.ResourceLib.dll	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-ROFGC.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-RTBHG.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-UCPQM.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-I1MM5.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-QQCG6.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-3A3OC.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-PVDGV.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Access\is-SFHGN.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW10\is-E010S.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-VPTS3.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-UMSKJ.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-QFDPI.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-C2Q93.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-8S4R3.tmp	KMS_pico.tmp
File opened for modification	C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-K9CTL.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-9FEIS.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-K44TU.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-8N8HD.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-R9T5A.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-59A3U.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Word\is-FQUCM.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-CV4N5.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-V3RSS.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\sounds\is-NKEVJ.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-9UH95.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-LV1AV.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-JI5GI.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-HS0I4.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-SFIGK.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-HOD7A.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-78N70.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-1KHVH.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-R0RG8.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-EEMN4.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-RA7IB.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-A8OAB.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-60KBF.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-LIES1.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-VHO2K.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\sounds\is-EC9L5.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-D0277.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscertW8\Core\is-P0JHD.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\TokensBackup\Windows\cache\cache.dat	KMSELDI.exe
File created	C:\Program Files\KMSpico\TokensBackup\Windows\pkeyconfig.xrm-ms	KMSELDI.exe
File created	C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-ND1BE.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-KHGFQ.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\is-M1U0N.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-SVMBF.tmp	KMS_pico.tmp
File opened for modification	C:\Program Files\KMSpico\AutoPico.exe	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\is-DVESK.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-3274Q.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-H17CT.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\icons\is-NR400.tmp	KMS_pico.tmp
File created	C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-9H0DJ.tmp	KMS_pico.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SECOH-QAD.dll	KMSELDI.exe
File created	C:\Windows\SECOH-QAD.exe	KMSELDI.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1080	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4480	schtasks.exe
2896	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = "0"	KMS_pico.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter	KMS_pico.tmp

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_Classes\Local Settings	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2452	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
5064	msedge.exe
5064	msedge.exe
1536	msedge.exe
1536	msedge.exe
2272	identity_helper.exe
2272	identity_helper.exe
1408	msedge.exe
1408	msedge.exe
2796	KMS_pico.tmp
2796	KMS_pico.tmp
2260	SECOH-QAD.exe
2260	SECOH-QAD.exe
2260	SECOH-QAD.exe
2260	SECOH-QAD.exe
2260	SECOH-QAD.exe
2260	SECOH-QAD.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	1188	KMSELDI.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
2796	KMS_pico.tmp

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe
1536	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 560	1536	msedge.exe	90
PID 1536 wrote to memory of 560	1536	msedge.exe	90
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 3028	1536	msedge.exe	91
PID 1536 wrote to memory of 5064	1536	msedge.exe	92
PID 1536 wrote to memory of 5064	1536	msedge.exe	92
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93
PID 1536 wrote to memory of 3052	1536	msedge.exe	93

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://archive.org/details/kms-pico-full-setup
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd864646f8,0x7ffd86464708,0x7ffd86464718
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,15997576207735463069,1137344671982503683,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5860 /prefetch:1
  2⤵
  PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4236

C:\Users\Admin\Desktop\Setup_File_KMS_Pico.exe
"C:\Users\Admin\Desktop\Setup_File_KMS_Pico.exe"
1⤵
PID:1064
- C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
  "C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe"
  2⤵
  - Executes dropped EXE
  PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    /C schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\pnef\consev.exe""" """C:\Users\Admin\AppData\Roaming\pnef\consev.dat"""" /du 9700:18 /st 00:02 /sc once /ri 1 /f
    3⤵
    PID:2896
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\Admin\AppData\Roaming\pnef\consev.exe""" """C:\Users\Admin\AppData\Roaming\pnef\consev.dat"""" /du 9700:18 /st 00:02 /sc once /ri 1 /f
      4⤵
      Creates scheduled task(s)
      PID:4480
- - C:\Windows\SysWOW64\cmd.exe
    /C "C:\Users\Admin\AppData\Roaming\pnef\KMS_pico.exe"
    3⤵
    PID:1044
  - - C:\Users\Admin\AppData\Roaming\pnef\KMS_pico.exe
      C:\Users\Admin\AppData\Roaming\pnef\KMS_pico.exe
      4⤵
      Executes dropped EXE
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\is-TSD3D.tmp\KMS_pico.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-TSD3D.tmp\KMS_pico.tmp" /SL5="$901C6,2952592,69120,C:\Users\Admin\AppData\Roaming\pnef\KMS_pico.exe"
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Program Files directory
        Modifies Internet Explorer Phishing Filter
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        
        PID:2796
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""
        6⤵
        
        PID:3004
        
        C:\Windows\system32\sc.exe
        
        sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
        7⤵
        Launches sc.exe
        
        PID:1080
      - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""
        6⤵
        
        PID:4440
        
        C:\Windows\system32\schtasks.exe
        
        SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
        7⤵
        Creates scheduled task(s)
        
        PID:2896
      - C:\Program Files\KMSpico\UninsHs.exe
        
        "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\Admin\AppData\Roaming\pnef\KMS_pico.exe
        6⤵
        Executes dropped EXE
        
        PID:532
      - C:\Program Files\KMSpico\KMSELDI.exe
        
        "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup
        6⤵
        Sets file execution options in registry
        Executes dropped EXE
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:1188
      - C:\Program Files\KMSpico\AutoPico.exe
        
        "C:\Program Files\KMSpico\AutoPico.exe" /silent
        6⤵
        
        PID:1724

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_KMS_Pico_Full_Setup.zip\Password.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2452

C:\Windows\SECOH-QAD.exe
C:\Windows\SECOH-QAD.exe C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2260
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  - Loads dropped DLL
  PID:1480
- - C:\Windows\System32\SLUI.exe
    "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
    3⤵
    PID:972

C:\Program Files\KMSpico\KMSELDI.exe
"C:\Program Files\KMSpico\KMSELDI.exe"
1⤵
PID:3264

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x310 0x51c
1⤵
PID:1424

C:\Users\Admin\AppData\Roaming\pnef\consev.exe
C:\Users\Admin\AppData\Roaming\pnef\consev.exe "C:\Users\Admin\AppData\Roaming\pnef\consev.dat"
1⤵
PID:5740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AutoPico.exe

Path C:\Program Files\KMSpico\AutoPico.exe
Size 15KB
SHA256 45a41588db8119511abb2a65bec2cc26981c9b01e68eba8965ecc382b4e0a253
MD5 7425127c70ccd9930fecbef278cad6ff
SHA1 83a3bf5f1b738971c30afd2b26ed077cfe7345c2
SHA512 ec643a997594136b12a4724b95a1b02ed7421efdad7fb9b8290efe1b708c9507d210cf6856e97b42851720f10dfa8938d3202d2fb0aef0a9b3010bbc9daf42e1
SSDEEP 384:XjI3BOyuPiWt5ygqC/unOFkmNBDPgonucv6CsffifCS:U0yuv52OFF/n16CRqS
MD5 SHA1 SHA512 SSDEEP

Submit Download

AutoPico.exe

Path C:\Program Files\KMSpico\AutoPico.exe
Size 91KB
SHA256 30d91a00f2eb4da1216975cf1fb572d76b239985b6ef544964dbc80c593f8099
MD5 71c5e28f2e8061c335cdeea39cdd6a5e
SHA1 a1aa15d3dd5872fa61d70167663b045fa8fc35d7
SHA512 98dc73faed9ccc0864020366ecf68592fbab4e04f9bedfed76f254758f4a11c441f40ae19e7855382ab415efcac738e8c5ca15fd83baba6e3a8f42f170e119b5
SSDEEP 1536:HvLFF/n1FcSPZvSzc5i5hpLzsX1neB7oLEFgCr6kwziMfE5zs:HvBFzcSkAi5hZsX21FhmfEK
MD5 SHA1 SHA512 SSDEEP

Submit Download

AutoPico.exe

Path C:\Program Files\KMSpico\AutoPico.exe
Size 25KB
SHA256 9207582a787ac17c4c7714fe3c970c8cc110eb72d82efeadd6397976630ebf25
MD5 6ad0a3eb642d545839b3d8d90887e1e0
SHA1 b95f81053406c8f6d2a33b302cbaecac87032127
SHA512 61ff29116cf9a549ef14716d71e4f4244e5746e28044bef4e7086825f089dbe2ff0b3386e767ab78424decb5cba36ec4bf67a5cc7665a0f3adf90c8c5f4920ce
SSDEEP 384:XjI3BOyuPiWt5ygqC/unOFkmNBDPgonucv6CsffifCVJY0HSX+SWdAN14GlriqZf:U0yuv52OFF/n16CRqXwW214U/ZJN
MD5 SHA1 SHA512 SSDEEP

Submit Download

DevComponents.DotNetBar2.dll

Path C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll
Size 3.6MB
SHA256 8f691588eea5c0843cf0fbd977ed41678bcd30e18f0098420e7b5c62515f239a
MD5 b8e407b2b61ef156f82878a45b478914
SHA1 27d7f057a939b0c9adb9ed40c31cbfe37c27eaeb
SHA512 a83c2dcb983ba068a1f1346aef7c73c204c02c67a7fd782589670a576e2d541bd75393092ed73bb26d0497e02c79740a5f644ee8ec931937e5b36e2bc9c77fe8
SSDEEP 49152:qfbOajjGpxko0ppeUIyIhObj0oCt3OFQHVD5m:Tajj0xP0jeUIyIhObj0oCt3Vq
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMSELDI.exe

Path C:\Program Files\KMSpico\KMSELDI.exe
Size 921KB
SHA256 50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc
MD5 f0280de3880ef581bf14f9cc72ec1c16
SHA1 43d348e164c35f9e02370f6f66186fbfb15ae2a3
SHA512 ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6
SSDEEP 12288:sBMSCV2RM+V8PW/+jSZOgJ38Ry3niRTiAH7UrbwIpmOs8b2i:snCEM68Lj5gNi2niRTiq7UrbnbsQ2i
MD5 SHA1 SHA512 SSDEEP

Submit Download

UninsHs.exe

Path C:\Program Files\KMSpico\UninsHs.exe
Size 29KB
SHA256 0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d
MD5 245824502aefe21b01e42f61955aa7f4
SHA1 a58682a8aae6302f1c934709c5aa1f6c86b2be99
SHA512 204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981
SSDEEP 768:W9UWjkIgObdRPcgs7KJPdTyf83EMpX/E9Et:pWj3gOLI7edWf4D/B
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProPlusVL_KMS_Client-ppd.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms
Size 10KB
SHA256 7f13c766991b4f23618844f83cb659cf7b3d5321da8925a82ea5357d8f7364d7
MD5 6ba22dbe6a7804b7d2e6f2a416d5235e
SHA1 5e5eb958d16a18f5be2437b8ee0397edcf3e850c
SHA512 341fc408e00b97d81a1d0b1aa75520f238ed24f4a3b68006b7967c75ea80cb089b5722e081a3668a083dd7e016e4af94a004f39221eb9093d9bce174a1570904
SSDEEP 96:Ym3Jf3i3UYEnn3LOQLsDQaCkCzg2MfdG4wHo7uRGZ8ODX46ZXzG5ggRAaZY3ph:JxoUDnnbOasUaXIg2oGZysr9mT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProPlusVL_KMS_Client-ul-oob.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms
Size 11KB
SHA256 37a1eeb50f69f20a4bf0bafb63b13308d51dbdc8f992832ffa64b87ffed84e2e
MD5 f24231ee95d34878b9e88d2647a61861
SHA1 3ce6bb335d12db05fa604fbd13cea6616ebdaadd
SHA512 e4ee5f4feaaa7a730be00754416f98fef52803d6343a642102d9c020ff8ea4452320c0d18b1e4872589e410b795c295b82d7f422f8892a06a1181c063fb3e1f0
SSDEEP 192:IZ9UUUbUfgc4s22ljm7Wkrc6TSUm9GjmT:IZOdK4s2mKFXSxQKT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ProPlusVL_KMS_Client-ul.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms
Size 9KB
SHA256 3aecba9f064a51d12785341fec10f7ac57ec156019dd71711ca1a8e0d844470e
MD5 a08a813759a501db6500133ededcd0fe
SHA1 399c186e5c00cba369aaeece635f9ad319f30b01
SHA512 8f96292c2bf483f55d08a55bc94eb2afa2fdbc2db60de68369becdb4eecd117dc4f4d86876b98d56ba4c1dcdc5ba4c9e99d24e8cd770d52b8bf1ffd77805d890
SSDEEP 96:lcm3T0xgRAaZsRqZmGb+cXXjo0qbgRAaCY3dgVHHjD8t6Wm3aRqZhgRAaZuXVzI+:jF9UUpljo0qEem+Et672Um9J5Cemmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

client-issuance-bridge-office.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-bridge-office.xrm-ms
Size 3KB
SHA256 65bccc008f5b44d2dbd880c0c33afcfff27c07dd24dc0cc7dda2b3bfa7e9ae74
MD5 33c1695d278f5917f28067d27b4868ee
SHA1 55137aa9a24d6a622f05315dfbb65fb1a0c74e03
SHA512 84389ef315ff2f9d86062470ea6033dcb409a3061b898ab677987aa881e2f6d4be1dacc4fad0c606dde6a301f04dfa2f1ff54af86e3a3767ab9bcf6ac368e2f2
MD5 SHA1 SHA512

Submit Download

client-issuance-root-bridge-test.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms
Size 3KB
SHA256 f050e6022511f0f16661f82809ba65ab8d912bd9971d3747f6b58f2042a4a921
MD5 c8a546ad00a2f81bd39f23ac1d70b24a
SHA1 cfbb628b1c014d0264536d908f6557dd6a01f4a9
SHA512 5b5cab22e808835a37fc1f1e17718baca95c03f1659022d51deca23685503cd4313fbf1363385e3f5c404c9958f6b6bd6b4b0efa7c1548113dd46f13f9ba33b0
MD5 SHA1 SHA512

Submit Download

client-issuance-root.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root.xrm-ms
Size 3KB
SHA256 6e058fd0c8a4c2aafac6502de3ea739340917c6e75e6ec26ee60298c01baa826
MD5 aee8dc4536129edc9c1df17cb288e3e9
SHA1 13c872ac505add867c944da550e96bc69c8a4165
SHA512 a27811053173d30b56ce85837017305cc2d58a673498e4ef7e562e23147a22ed416e0e4dae9d062064bec77b3cf89e46302807cb2f0022189b88fcc8e31f0124
MD5 SHA1 SHA512

Submit Download

client-issuance-stil.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-stil.xrm-ms
Size 3KB
SHA256 afe8c45943567e747425f87e43f774c783c07392888078693188882bde1339e3
MD5 072b400f6cbb1123397d1c452740da04
SHA1 5f5615f5840252f4998c1c07ea717dfd7da970cc
SHA512 e7b8481e37f5ecc775b1e0e946c22051ff7c2b320c7deecd2fe6ae33b69abb230782ca397e5d799d8863026eee62f331000f7bf5b6f4f5b6614195c78dd2142f
MD5 SHA1 SHA512

Submit Download

client-issuance-ul-oob.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul-oob.xrm-ms
Size 4KB
SHA256 d40dbfddc97849f246a397e59187a3f97f70fa1687d578b3dacb92044fd51bea
MD5 582e03b41356083d04ce6191f560092a
SHA1 607b41ac3d642b91655e0af54556f441682acacf
SHA512 c28f7d286369d8d4f9a9f79ed67912d2390030013ac4e3b549176cff8378ab0c34db37f2bf6712b5d9eb9b06cb7fe72203e85340889e38b85623e1dbb7d33887
SSDEEP 96:tTm3SYgRAaZAUSXXU2EuBj4oy7/93N4HY3Vk:mS9pRtvcmi
MD5 SHA1 SHA512 SSDEEP

Submit Download

client-issuance-ul.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul.xrm-ms
Size 4KB
SHA256 08e15263cdd59b78c18c21777fd67579d14e65dfac15531312bed2c9c5497c0d
MD5 90642c5fd30ae5a2a34d4c217b4cab7f
SHA1 b89cf6d9033a7bb52b4eb9e98c97b8978d91af43
SHA512 8ceadd13adafe4a582d64481dd357c9906e5a082629e4ebf576a9cb84c30b8bc9bd17f28b186594aae164415e4c42ffe78dcf83048a1f8377b97a4c24fa422dd
SSDEEP 48:3wkHG3F5P2PolZGVMfX4S06b6shtxw+tlaDu08aNqFYTO6T4HY3Ek:Lm3/uYZBQiX/kDuw3N4HY3Ek
MD5 SHA1 SHA512 SSDEEP

Submit Download

pkeyconfig-office.xrm-ms

Path C:\Program Files\KMSpico\cert\kmscert2016\pkeyconfig-office.xrm-ms
Size 576KB
SHA256 90ba4e3c11f7a8260ae8fb93a73ab5af5fcfbb45b9fb2b15800c38485d3384f4
MD5 6a46a4977e1b2780b9907de0530f5ee7
SHA1 22b19e90035112dd43d6c6dc100ebbbd2b57676c
SHA512 34a54f48dda9d1422c2949b4add88ec03f77f4f7c6b83386e395c1764cf9eedb5c75ed04119fbf6f53ee3670abefec60af1fbff49f54ba4854e4354f44ea1c6c
SSDEEP 3072:7dm23ethgnrQnUlysokIfPTaBJDmN+Pt1XAlkd3VsLva+utR54MfFVkr73Pgg8l2:B/Bh0plIJG
MD5 SHA1 SHA512 SSDEEP

Submit Download

AutoPico.log

Path C:\Program Files\KMSpico\logs\AutoPico.log
Size 3B
SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
MD5 SHA1 SHA512

Submit Download

AutoPico.log

Path C:\Program Files\KMSpico\logs\AutoPico.log
Size 4KB
SHA256 7f63bfe706d0f915f31534e6d0ab4e3531929650116cd406a5c92d006363ce06
MD5 e186c3729cfd45cab0cfbbc6eabb6a84
SHA1 1c1a1a11d0abf5bf117c011fc78700485e4bef9b
SHA512 9662b8095d4cbffbb715493af8dec4ffae72ef9a72081f7cd63a07be8cea9bd6edb6adf399d1967990e428bbec5574d7fec8d2511ee1636b388bdb5218b5c98f
SSDEEP 96:EhhousP5GYP5mTITCZeSbra5zgSQOQgdJA:EhhopP5VBig4eUa5zgSQOQ6A
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMSELDI.log

Path C:\Program Files\KMSpico\logs\KMSELDI.log
Size 4KB
SHA256 6690cf4f79a5143be2620531778cf7d491ecfd00333b4a4dfd723dce11be687c
MD5 f5ce1bde44ef3e236c71eada7e6950ef
SHA1 b4b17d48e89d3d9afea83a7e08aca12e8a704762
SHA512 86d289ef3eaddb9ff11ea0f2acaec51da1e02a2acbff43b5a55a3c5a2a39f0fa28a3a3713cae725ffa59f8ef470b8063d8ed54dcaf74d88fe50b82c21b7cb821
SSDEEP 48:34diWzV6UchLJBEOv4O9cCFm0hX0eAVSmQ/98iILCN5+twXBMTL4r9J:3OhQPVqKF9cQ0lVxQ18iILCNpXS34r9J
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMSELDI.log

Path C:\Program Files\KMSpico\logs\KMSELDI.log
Size 17KB
SHA256 8b49486fca4e14239dd61a3e99e4ce107a56e6ecc83bf04aef16baa2d0223187
MD5 4993dac1bc0eb67e7c17ad2cfafbed61
SHA1 cd86b50b17d8a5e7275b0d1c73b57f09007fd103
SHA512 13ced47d83c756a492d6f5323759931fab3d92e63f33c663caca8a3c67f32a09142f0603f112ac86ea0602ef4ed2ce7a8c2fd71d3f283521919a2fb428681e75
SSDEEP 384:GQPcKF9lvxF8AiewigiZf7ZdZy9wds5TDpK:GO1F9lvxFPZdZy2dV
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMSELDI.log

Path C:\Program Files\KMSpico\logs\KMSELDI.log
Size 1KB
SHA256 20bd75b15bb930e5a075cf5cfafa567d9d5724e40179d1c0463131a42757ae15
MD5 d4fc3af3588c255316c60aec71e488cc
SHA1 0d258f21b6bf69a815964b6bbbbaffdd951a671e
SHA512 28afee40fc7dc5ec2861cc471c969899b26e1d513abba3f2a44611da0e9cc94a3bacaf3276a3ba4a55becc7f181a0065af0c05c8f063cfae427aa1cbf3293942
MD5 SHA1 SHA512

Submit Download

KMSELDI.log

Path C:\Program Files\KMSpico\logs\KMSELDI.log
Size 1KB
SHA256 b8018f28d291e7fcb1608c47625f98735dfcca1fcfed50e5b70c3a18f28a864e
MD5 974af93ea92b9ab55f5126a9fa3e7533
SHA1 7b947f8882380e2a69bae96bbf92f8f3798a2228
SHA512 820b36b241212667394fa87306fa425299188d2a29893af8d7b6a3f50c38d2bc78d2b623afd80a18cf7ce6314b9cae385ecb28b9c75d2765ca9b351364d294f7
MD5 SHA1 SHA512

Submit Download

KMSELDI.log

Path C:\Program Files\KMSpico\logs\KMSELDI.log
Size 4KB
SHA256 f82cbcfc67d1f9ecbbf77e6ee7479b3fc12d09854cca5fe3eda6684577d91132
MD5 f8abc34999fdab7f6d5948dd667da006
SHA1 3e29e35f0e72068337a268c40fab8ef00d6f451e
SHA512 037fc49618889f110c68c060f7712b4a2752701a6e945f4f5f28cc36430c404f9d011f4e406ccdcdb1b38c0d841727f3a9acef07167cb49d89383e68d6cb4c3d
SSDEEP 96:7OhQf1LTRUXPyhQuiXiPUkUTjITC0v3eJdPxv:qhQf1LTRgKhQVBPg9v3eJxx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Install_Service.cmd

Path C:\Program Files\KMSpico\scripts\Install_Service.cmd
Size 213B
SHA256 11578521b14c17fbbb070c13887161586d57196f4d408c41a0f02ed07ee32f2c
MD5 9107cd31951f2cf90e0892740b9087c9
SHA1 efac5c2e59ddef2f0a7782ad1dea8f6b25a07395
SHA512 f6b66dcbbb8aa55793b63f20fc3718038d7c35f94570cf487b6e8393f67be6bd004dd64f3b8fc8345b7e02e2e8ec2d48ceed2494d9f1282ca020dbbaa621f457
MD5 SHA1 SHA512

Submit Download

Install_Task.cmd

Path C:\Program Files\KMSpico\scripts\Install_Task.cmd
Size 220B
SHA256 5b067073b968361fe489017d173040655f21890605d39cdb012a030dd75b52a8
MD5 ade709ca6a00370a4a6fea2425f948c1
SHA1 5919c95ef78bd4ab200f8071b98970ff9541a24a
SHA512 860f9f12bc4995fae7c74481c2b24a346e763e32a782b3826c0f0772ad90be48377faefd883c9a28b221f8476fd203782932fee859b079fb7d4b1b152cce7b53
MD5 SHA1 SHA512

Submit Download

affirmative.mp3

Path C:\Program Files\KMSpico\sounds\affirmative.mp3
Size 4KB
SHA256 e7fc9406c360d22ed281fb415a2eec396b6a7d0c733c828b2a8c106a30753de5
MD5 249dca86cbb375d84b52ed4eb5cefdc6
SHA1 244c2ce65343dcfa613c26c94fa8255c7e6789fe
SHA512 84cb0128518618b3142276e7f84f0fdf42b4e662699d822b96957f7ee31630d55eb432148c7f204bd3be46efedc2eea5ea703f3795ffd9edb7181a1e748fb947
SSDEEP 96:lRPcYBn+/1CbXywuEiG5BFEvnRdGEDZbV9GwM/BwaYZ8eaI/aFCGJ1:7pk1CTpuEPF+RokbVL4+aY0rFz
MD5 SHA1 SHA512 SSDEEP

Submit Download

begin.mp3

Path C:\Program Files\KMSpico\sounds\begin.mp3
Size 9KB
SHA256 443d23bd2705246cd64ff39d61b999ab74be6d60db1703d6782bb0d36a20eef3
MD5 f33f2a16a46920b5c8227ffd558060b2
SHA1 a8f7192d34d585a981b5a2ea92b04a21a17b67a8
SHA512 9cf3f48adfae4c7ff8bf60f313939c956b331373bd262f5b4a25fbb04d79b86abc5d73204d5c21a8e6f8f3fd51e503016a1f930e1dc2ea6696c3c7e056af7361
SSDEEP 192:lXZxZjOIcfwzOg8BdxZRkM20cx+7gyZTSc7HHAN+xZk/:xZxQBaOg+dxZRkMg5yZTSc7HLbk/
MD5 SHA1 SHA512 SSDEEP

Submit Download

complete.mp3

Path C:\Program Files\KMSpico\sounds\complete.mp3
Size 5KB
SHA256 4d73c58c680396759508b34b169d1fd9c6aa292141c7c58634842a92d68d3c7b
MD5 0d0e8e30d6007cf99f3951424e1d88e6
SHA1 56a6a3a39a5c9210e97a27190464cd25014db68c
SHA512 8c2ad7488e52af3aabcbbfddefe0e82c594401e279b07f5f4096b695e6f365e932085a8b4b01c91b3e29cba0fa3b0f160537d4962daed70a74854b55e67f8541
SSDEEP 96:ZDVgBx3fCTjx1Cdc9+DHOc/kLddOQaeYfJZaW6Lx:Akhodc9mOc/GdOyYBvW
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagnostic.mp3

Path C:\Program Files\KMSpico\sounds\diagnostic.mp3
Size 13KB
SHA256 2445c403447490dd7227617f7e8017da429ad65985fe013c6662906af15da4b0
MD5 06c9a7d36b9b6390faa90ca9c0650bee
SHA1 a27a0fdc48c678a9bd34b379d4f4e2c0e9776a9c
SHA512 00aec80c11219c86f52c1984f8f40f992e24b6aeda1a953b20891ecd8976cdd767aa78c066924ee5c732e10149449dadc4dc7425e5ba3be9c8ca0fc150498bc9
SSDEEP 192:0AdBlgWNuZm9IxN0sxX2v9VgpMVn0QiCbldPIFvewG5HaolFjlj2Hw5CIauTi3Fw:nBDqb4ZVgpMj7PykFaorlkaCLX3a
MD5 SHA1 SHA512 SSDEEP

Submit Download

inputok.mp3

Path C:\Program Files\KMSpico\sounds\inputok.mp3
Size 2KB
SHA256 0131a883e4b66e77becc17594a386bcd69e04f1e5185e4ae8a554fc3a39bb81a
MD5 28a23b81aefec1336a1046671dc5af30
SHA1 5c89b9b708d26cd44af9635fce8c0abd1fb71433
SHA512 bc300f57b91a13ec31c9722c87004ea560fee7c6bedb12703281827163734819edaf3a22e322dd7f39c192ac0c319b34171a36dd9190985be33d106fa19a30bb
MD5 SHA1 SHA512

Submit Download

processing.mp3

Path C:\Program Files\KMSpico\sounds\processing.mp3
Size 6KB
SHA256 9390c99249423929fb82c2aad89e19249e493e4845d0c8babc99e1b594643f34
MD5 fa3dfa3bd735d73281f10a91d593d52a
SHA1 4e859fc874b61d09f0c63714385cb73843fb07e7
SHA512 bb3908c9458e1494a83a33532e6e165a05acacfe44820cda5c82d70e3662e7b9571c7020d9720a694f8b91e41284779b5df09d300193a46e70656d449310aa4f
SSDEEP 96:LJhkGiKlWnjw8KloRC80QkbGer/iwYmvh6p0qb8a9zUuLpv5p3pMFfU:XdEP+oSLbbvh6pn4WzU+f06
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMSELDI.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KMSELDI.exe.log
Size 2KB
SHA256 e7f1a47be2997ef1945bf41a26b3b6ab83dac9fd2f13ee0bf7dc7c94413ee3d0
MD5 24eaaf0e3ae77da46a1c6550530622ee
SHA1 82a6892ef327923c23921c71635a02d18cfa97c7
SHA512 554a5de629ab1b04907dd8e98e550d7f5687c25a0296d995bf38f071d0c710dd0f2e82089fe896a9a70a9082628bc4d2120f573fbcc1756f7069e2167a1842db
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 14e3c9871e1b95d66b6daefe8ad048ed0d2c1229c6fb81f5b7837670f11971d7
MD5 b10a5147f1d7749482ae4ad6f85dfbd1
SHA1 1181e016bd4939d1ee3a1beba55fcf380606be38
SHA512 f73e5b68eec7688c84c742f4647fae6004c2e9ca708482ecac02297d980ec04ff7f5066abf3d5718a35482c1f73b718ec2c89f91685c5c92ee17d1a8f1ef2ea0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 417B
SHA256 91767133c750eac39e5d2c8871c7e5e330c9c8d22a914a7dc6a93a3b87c986db
MD5 544544725fb8f86c9b624ba508dcc1ed
SHA1 73a2aa38ee6a571aa9f11e82053b4520ca44b47a
SHA512 44da7f85ba2cccf1f14bc1dc69ce6ebd949436cb64edef9274e249fbe8a28d1a8bc42c2eb13b0287d07ebf75ba2de3bd5fe04d4863d2e100178fbcfa13d2f532
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 4b364aeee755db92ed4fe314ea5da66dd4e82c30216f54298b58e95dcaab4bba
MD5 ad0e7b6deae85d24999d778820a00799
SHA1 52746b51dbbd0212dc360aaa1df2ddda0f3bcac7
SHA512 be246ec9835c0628e7470a1536d8425e47fca4c701894daa416047580ca750691728dfd81e787110dbccde9c20f0041143a4a40591d3ef8a88f9f7d7ef879d00
SSDEEP 96:nzk8sQXxm/KhmqH1O9CwpvWMoiwR5mdeFuu1jOHTtNyWQyV+VD7AiEwb:nzkbToqCGWMwnuuhETnlg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5a496cd117b88f7bef7ef1cdbe965a5471ea09580b90966bce6aa3573c62472e
MD5 8de772a21439735f9ab676a90242a6cd
SHA1 df71cea7009011121b5c6fab0d5703556b285682
SHA512 7c3812f0fa21493dd883ee4bb4c8353dcaad869067c97b7b4385940198142adfeab8a5e14eaa309345b4fc1338ec31a0e1ca7303afd1df608656faca6b37f572
SSDEEP 96:nzkExm/KQYmqH1OV2wpvWMoiVmdeHOHTscUWQyV+VD7ziEwb:nzkdTo62GWMXETprt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 07066e792973816e060b1f9e5af4df81fe78e5f3d20f9874adbde06ac14eed3d
MD5 cae4fafe73c24ab185f3879347be956d
SHA1 895b124c4501599dbb2b5ffc545ececc3ca7ea96
SHA512 c746e936f2cc30c0bf784daea9c74ea82a0b15eb7f2926f40abd2cb9962b14dfd9bf7f393a9a285f5fde858684055f2398e5a3e60b39d7695e2b5b62d20ed555
SSDEEP 96:nzkExm/KhmqH1O9mwpvWMoiVmdeFuu1jOHTycUWQyV+VD7AiEwb:nzkdToqmGWMVuuhETLrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 832fa5213c3eb4ba58a1e21c6a35e59720c3fe6acd6fc63c3199497038c9be42
MD5 c4f8eb07b4f428db5c66112b461208a2
SHA1 45a7ae219a79fdbf45d392175d4bd8f4d3815657
SHA512 f0aa79583838556f94f0b44c2eb6f9730ed964cb5429f483ca08369a90cbd7d58f5f90ec32cc7521a7ca017ef35d3e09729ef731bfe78d0f12021b3cc0760bc5
SSDEEP 96:nzkrsQOxm/KhmqH1O9mwpvWMoiVmdeFuu1jOHTyeUWQyV+VD7AiEwb:nzkNToqmGWMVuuhETLrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 de505e9ab29afd9ec3fc93122f118313da384236e245feaccaea395c88921085
MD5 546c6b7365b2b910992c35c7e6537fa9
SHA1 603e1c2f8b82cc49daece1473da54f85e830aa42
SHA512 e2b9a9863ebee6b499d00502b93ccf15ec8d22e14cbfc92508bad0cc0171471ecbe768d6b9a654dfb8a20bd7b0f45758e6a0db641fcbb3ba84e27f507ddec949
SSDEEP 384:A9iIxuERzA83h09RZxY0ZoR9E1MeuBOfSkVS:rIxuERzA83h09RZxroRTOKcS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c86838847477c15046a0f91c6e280550d87d6e6f07fc30ca3573f9d768e7b34c
MD5 b39ab2a5106f966ec07f8ec2e2e8eaa3
SHA1 210be6a6493180f86c973ddded0b8bae41e6cfef
SHA512 cb142c4a24742d4bd1e730dac5e1c07deca8b42fa467438dc9ae1285d3390fc8cebba8a78a3d52f500b7f351a7a55b18a5c44dcfd5011e5940a93fcb8e88d751
SSDEEP 384:a9iIxuERzA83h09RZxY0ZoF9E1MeuBOfSkVS:5IxuERzA83h09RZxroFTOKcS
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMS_pico.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
Size 119.4MB
SHA256 8ef677bedf57bb4690e83696fde7f65748b22e441b53b8afc6c08b15bb32607c
MD5 953c7b127238bc74d06a69194baacc59
SHA1 93dd30e7cd962a09457f257fde785d634c7dda31
SHA512 1e2f000c17791f50e5a855a41ed3aa6b6d4c46afbaacee0202f1cda44d603d2e7eefbd2fa73930244231657abc6d2fe1718f4c1dd72653aeacdb053d4d21c3d8
SSDEEP 196608:EKLWvNeMTcZ/86S5GvQP6JtddHvh+NsJ:EZTA/KY6+ZvY
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMS_pico.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
Size 24.1MB
SHA256 2aa724a7945b4f3071b8146baaf8a010d1f66071191fa60d83ebc8a1876d67f9
MD5 d80822e23813793b4ad0fa1cb668ce9d
SHA1 f253068b5ce8bce66d08ce233fc4318b67248b1c
SHA512 42bed1d85779c56aa931ba30edee5f2a3863009ecbb62afd98c93365cf7084d3ef43eaafd7747daecf3300f9ebd5f8b5bc9d1c13ebd046249c17e091ef92beb7
SSDEEP 196608:EKLWvNeMTcZ/86S5GvQP6JtddHvh+NsJ:EZTA/KY6+ZvY
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMS_pico.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe
Size 21.7MB
SHA256 624497da394ea71446fbb0c5e8b20143427f3de8b07dbe2d301a5f560a0e11d9
MD5 8564f1f5d2ed3f4947d022d408dee083
SHA1 11ca0100cd8be8586bb251cebed14fdbf7282556
SHA512 766f8438203b96dd98f275082e0da9e7fbbe618573f1677e5ff047731c29a7b46566d1d2c9689984487fc0b3e9ba6fa15f38c8cc59cdb80a50fb22c85f56d8d5
SSDEEP 196608:EKLWvNeMTcZ/86S5GvQP6JtddHvh+NsJ:EZTA/KY6+ZvY
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMS_pico.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-TSD3D.tmp\KMS_pico.tmp
Size 703KB
SHA256 95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6
MD5 1778c1f66ff205875a6435a33229ab3c
SHA1 5b6189159b16c6f85feed66834af3e06c0277a19
SHA512 8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0
SSDEEP 12288:0QszP8NRMXpc/rPx37/zHBA66pE+4p1YR71CERdH6rN9by7HaOMebmx9Ru:0QQP8YXpc/rPx37/zHBA6plp+51CErzf
MD5 SHA1 SHA512 SSDEEP

Submit Download

KMS_pico.exe

Path C:\Users\Admin\AppData\Roaming\pnef\KMS_pico.exe
Size 3.1MB
SHA256 64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a
MD5 a02164371a50c5ff9fa2870ef6e8cfa3
SHA1 060614723f8375ecaad8b249ff07e3be082d7f25
SHA512 6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326
SSDEEP 98304:CgbTbhBxCLS0Kx/XRCsFlPsKh9ApbeicTkxchy6pA32b7SuzWl:rxBxCLS3xZCsFyBzxcE6pAGbq
MD5 SHA1 SHA512 SSDEEP

Submit Download

consev.dat

Path C:\Users\Admin\AppData\Roaming\pnef\consev.dat
Size 169KB
SHA256 dfb8264953a5d0d7db1eb289430285b488a147f44ddebaec70b6ec7d7219faf0
MD5 532b7cc788160997ea22deec6f7d69f8
SHA1 9c909dfade8f1644cb300f1dd00ac3b8080bda8b
SHA512 8827bbeb097af6eb9df4b6668f7f317dc627ec2781fa01b7841f455b7785f94fe3b3b44f9fab9189ccaf3ca8a6f224d7a14adae9061fdad64beb490b292b2c3e
SSDEEP 1536:8LHvXxgGlCPm3gaLkqpR3l3oWlxhE76Z3tsIS5IMhXF8D3fVU0TuvqF:8rPiqF
MD5 SHA1 SHA512 SSDEEP

Submit Download

consev.exe

Path C:\Users\Admin\AppData\Roaming\pnef\consev.exe
Size 872KB
SHA256 237d1bca6e056df5bb16a1216a434634109478f882d3b1d58344c801d184f95d
MD5 c56b5f0201a3b3de53e561fe76912bfd
SHA1 2a4062e10a5de813f5688221dbeb3f3ff33eb417
SHA512 195b98245bb820085ae9203cdb6d470b749d1f228908093e8606453b027b7d7681ccd7952e30c2f5dd40f8f0b999ccfc60ebb03419b574c08de6816e75710d2c
SSDEEP 12288:6pVWeOV7GtINsegA/hMyyzlcqikvAfcN9b2MyZa31twoPTdFxgawV2M01:6T3E53Myyzl0hMf1tr7Caw8M01
MD5 SHA1 SHA512 SSDEEP

Submit Download

Unconfirmed 342595.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 342595.crdownload
Size 6.4MB
SHA256 cf639e09ae54c151d476c52f8493450cebc73f4ecc0164940e35bf8158e4b945
MD5 79c15fad8c15504e536ce3b52995118b
SHA1 faa9f7e6b3e7080535f9e7f750dc0f315d25b302
SHA512 e6b4d060c8840bf760f3776aa06366db052af987a2b9e462ba1bc1e355f520af1a600c8f40fc10fb874da4bfb0ed82d8e44be618ef9849427fafc3f5e8da969d
SSDEEP 196608:kB+jPg2gaOIlQ7RiJ+DbHSjs3jqfpPrm0GXV5:C+jYMOID+DDr32jNGXT
MD5 SHA1 SHA512 SSDEEP

Submit Download

SECOH-QAD.dll

Path C:\Windows\SECOH-QAD.dll
Size 3KB
SHA256 0398221231cff97e1fdc03d357ac4610afb8f3cdde4c90a9ec4d7823b405699e
MD5 6d7fdbf9ceac51a76750fd38cf801f30
SHA1 6ef8310627537b1d24409574bc3c398cd97c474c
SHA512 b48d7eb268f8b46ff6a4782070bf6f2109ccc43166b8c64beb73348533b98f69aab5630386f4b5966b6e706f906b599fec5ff885d3e4572ed24acb6c6691fec8
MD5 SHA1 SHA512

Submit Download

SECOH-QAD.exe

Path C:\Windows\SECOH-QAD.exe
Size 4KB
SHA256 9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f
MD5 38de5b216c33833af710e88f7f64fc98
SHA1 66c72019eafa41bbf3e708cc3824c7c4447bdab6
SHA512 99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490
SSDEEP 48:iluEJs+6z2rItbQLcX5c3RQlH52gdScX5aNBUv4Hvf1T14cMbRuqS:+uES+u2wpXGmdbXUJtmx
MD5 SHA1 SHA512 SSDEEP

Submit Download

Vestris.ResourceLib.dll

Path C:\Windows\System32\Vestris.ResourceLib.dll
Size 88KB
SHA256 392d73617fd0a55218261572ece2f50301e0cfa29b5ed24c3f692130aa406af3
MD5 3d733144477cadcf77009ef614413630
SHA1 0a530a2524084f1d2a85b419f033e1892174ab31
SHA512 be6b524d67d69385a02874a2d96d4270335846bece7b528308e136428fd67af66a4216d90da4f288aeefd00a0ba5d5f3b5493824fcb352b919ab25e7ef50b81c
SSDEEP 1536:b/FDU3h+VPU57ZfHVe1U4WuAFWl5s02zAFYAGKeK94aXBhHA:JDU3h+VPULHVYWTFm5GzAFdG/K94H
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/532-944-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/532-943-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1188-951-0x00007FFD72890000-0x00007FFD73351000-memory.dmp

Download

memory/1188-950-0x0000000000CA0000-0x0000000000D8A000-memory.dmp

Download

memory/1188-1227-0x000000001F0C0000-0x000000001F1C0000-memory.dmp

Download

memory/1188-959-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Download

memory/1188-1319-0x000000001F0C0000-0x000000001F1C0000-memory.dmp

Download

memory/1188-1318-0x00007FFD72890000-0x00007FFD73351000-memory.dmp

Download

memory/1188-1003-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Download

memory/1188-954-0x000000001C030000-0x000000001C570000-memory.dmp

Download

memory/1188-952-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Download

memory/1188-976-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Download

memory/1188-1358-0x00007FFD72890000-0x00007FFD73351000-memory.dmp

Download

memory/1188-978-0x000000001B9F0000-0x000000001BA00000-memory.dmp

Download

memory/1188-1172-0x000000001F0C0000-0x000000001F1C0000-memory.dmp

Download

memory/1720-999-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1720-1434-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1720-155-0x0000000000400000-0x0000000000417000-memory.dmp

Download

memory/1724-1362-0x0000000000C20000-0x0000000000CDA000-memory.dmp

Download

memory/1724-1429-0x00007FFD72890000-0x00007FFD73351000-memory.dmp

Download

memory/1724-1368-0x00007FFD72890000-0x00007FFD73351000-memory.dmp

Download

memory/1724-1369-0x000000001BDF0000-0x000000001BE00000-memory.dmp

Download

memory/2796-1433-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/2796-1124-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/2796-165-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/2796-1364-0x0000000000400000-0x00000000004C0000-memory.dmp

Download

memory/2796-1127-0x0000000000750000-0x0000000000751000-memory.dmp

Download

memory/3264-1445-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1520-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1448-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1449-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1446-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1452-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1454-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1457-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1456-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1455-0x000000001FC40000-0x000000001FC50000-memory.dmp

Download

memory/3264-1461-0x000000001FC40000-0x000000001FC42000-memory.dmp

Download

memory/3264-1460-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1463-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1464-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1459-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1466-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1447-0x000000001FC10000-0x000000001FC20000-memory.dmp

Download

memory/3264-1472-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1473-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1471-0x0000000020550000-0x0000000020560000-memory.dmp

Download

memory/3264-1474-0x0000000001560000-0x0000000001570000-memory.dmp

Download

memory/3264-1475-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1477-0x0000000001560000-0x0000000001570000-memory.dmp

Download

memory/3264-1476-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1468-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1467-0x00007FFD71B90000-0x00007FFD72651000-memory.dmp

Download

memory/3264-1465-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1478-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1479-0x000000001FC10000-0x000000001FC20000-memory.dmp

Download

memory/3264-1481-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1480-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1482-0x000000001FC40000-0x000000001FC50000-memory.dmp

Download

memory/3264-1485-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1484-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1486-0x000000001FC40000-0x000000001FC42000-memory.dmp

Download

memory/3264-1444-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1510-0x0000000001560000-0x0000000001570000-memory.dmp

Download

memory/3264-1443-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1515-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1518-0x000000001EB60000-0x000000001EB70000-memory.dmp

Download

memory/3264-1517-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1521-0x0000000020550000-0x0000000020560000-memory.dmp

Download

memory/3264-1522-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1442-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1519-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1516-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1514-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1534-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1535-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1537-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1539-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1541-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1540-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1542-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1546-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1547-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1548-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1551-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1550-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1552-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1553-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1560-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1559-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1561-0x0000000001560000-0x0000000001570000-memory.dmp

Download

memory/3264-1562-0x0000000001560000-0x0000000001570000-memory.dmp

Download

memory/3264-1566-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1565-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1573-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1571-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1570-0x000000001FCB0000-0x000000001FCC0000-memory.dmp

Download

memory/3264-1569-0x000000001FCB0000-0x000000001FCC0000-memory.dmp

Download

memory/3264-1568-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1580-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1439-0x0000000001560000-0x0000000001570000-memory.dmp

Download

memory/3264-1558-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1584-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1557-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1556-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1594-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/3264-1438-0x0000000001560000-0x0000000001570000-memory.dmp

Download

memory/3264-1437-0x00007FFD71B90000-0x00007FFD72651000-memory.dmp

Download

memory/3264-1612-0x000000001FC60000-0x000000001FC70000-memory.dmp

Download

memory/4784-166-0x000000002CB50000-0x000000002CC0D000-memory.dmp

Download

memory/4784-151-0x000000002CB50000-0x000000002CC0D000-memory.dmp

Download

memory/4784-149-0x000000002CA60000-0x000000002CA62000-memory.dmp

Download