c085209c5b01d2a516a40e18cefdf5b4bdf5131f3a7f66bf91762cc151169a60

Analysis

max time kernel
95s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
17/10/2024, 16:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

KMSAuto Lite x64 1.8.6.exe
Size

6.3MB
MD5

7b3563b8dae4dc736c16716eb88a3a37
SHA1

639455f16ad599cdaef71f906cea414ab73bb68b
SHA256

c085209c5b01d2a516a40e18cefdf5b4bdf5131f3a7f66bf91762cc151169a60
SHA512

b36a1d8698b8aaf21ec58212afd2b7ff41d3c6a4e2cb9e5f75cf84e6e58d37cb5b8c742f0f4d8ed487c8815d1db9f965dabf3ca83095df933d0baa78058f3ef0
SSDEEP

98304:vUfwPRIkF+DywzlCbj/TSYDExAdmcROSdT7RX1:vUfaRTFzwzehoAwI7h1

Score

8^/10

defense_evasion discovery evasion execution persistence privilege_escalation

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 3 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe\Debugger = "rundll32.exe SECOPatcher.dll,PatcherMain"	reg.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
4964	netsh.exe
3232	netsh.exe
4884	netsh.exe
1576	netsh.exe
3960	netsh.exe
4712	netsh.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\KMSEmulator\ImagePath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\KMSAuto_Files\\bin\\KMSSS.exe\" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP"	KMSAuto Lite x64 1.8.6.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1836	signtool.exe
2420	conv.exe
2916	KMSSS.exe

Loads dropped DLL 2 IoCs

pid	Process
640	rundll32.exe
1264	SppExtComObj.exe

Modifies file permissions 1 TTPs 3 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3384	icacls.exe
2340	icacls.exe
4844	icacls.exe

Indicator Removal: Clear Persistence 1 TTPs 2 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe	reg.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe\Debugger	reg.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\SECOPatcher.dll	cmd.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4752	sc.exe
1352	sc.exe
1852	sc.exe
1428	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	KMSAuto Lite x64 1.8.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	signtool.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	conv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KMSSS.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
3428	taskkill.exe
4564	taskkill.exe

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64	SppExtComObj.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\d450596f-894d-49e0-966a-fd39ed4c4c64\DiscoveredKeyManagementServiceIpAddress = "10.3.0.20"	SppExtComObj.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\85dd8b5f-eaa4-4af3-a628-cce9e77c9a03\DiscoveredKeyManagementServiceIpAddress = "10.3.0.20"	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion	SppExtComObj.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588\DiscoveredKeyManagementServiceIpAddress = "10.3.0.20"	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\0ff1ce15-a989-479d-af46-f275c6370663\85dd8b5f-eaa4-4af3-a628-cce9e77c9a03	SppExtComObj.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\55c92734-d682-4d71-983e-d6ec3f16059f\2de67392-b7a7-462a-b1ca-108dd189f588	SppExtComObj.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	signtool.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	signtool.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254830400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	signtool.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	signtool.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1104	KMSAuto Lite x64 1.8.6.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3928	wmic.exe
Token: SeSecurityPrivilege	3928	wmic.exe
Token: SeTakeOwnershipPrivilege	3928	wmic.exe
Token: SeLoadDriverPrivilege	3928	wmic.exe
Token: SeSystemProfilePrivilege	3928	wmic.exe
Token: SeSystemtimePrivilege	3928	wmic.exe
Token: SeProfSingleProcessPrivilege	3928	wmic.exe
Token: SeIncBasePriorityPrivilege	3928	wmic.exe
Token: SeCreatePagefilePrivilege	3928	wmic.exe
Token: SeBackupPrivilege	3928	wmic.exe
Token: SeRestorePrivilege	3928	wmic.exe
Token: SeShutdownPrivilege	3928	wmic.exe
Token: SeDebugPrivilege	3928	wmic.exe
Token: SeSystemEnvironmentPrivilege	3928	wmic.exe
Token: SeRemoteShutdownPrivilege	3928	wmic.exe
Token: SeUndockPrivilege	3928	wmic.exe
Token: SeManageVolumePrivilege	3928	wmic.exe
Token: 33	3928	wmic.exe
Token: 34	3928	wmic.exe
Token: 35	3928	wmic.exe
Token: 36	3928	wmic.exe
Token: SeIncreaseQuotaPrivilege	3928	wmic.exe
Token: SeSecurityPrivilege	3928	wmic.exe
Token: SeTakeOwnershipPrivilege	3928	wmic.exe
Token: SeLoadDriverPrivilege	3928	wmic.exe
Token: SeSystemProfilePrivilege	3928	wmic.exe
Token: SeSystemtimePrivilege	3928	wmic.exe
Token: SeProfSingleProcessPrivilege	3928	wmic.exe
Token: SeIncBasePriorityPrivilege	3928	wmic.exe
Token: SeCreatePagefilePrivilege	3928	wmic.exe
Token: SeBackupPrivilege	3928	wmic.exe
Token: SeRestorePrivilege	3928	wmic.exe
Token: SeShutdownPrivilege	3928	wmic.exe
Token: SeDebugPrivilege	3928	wmic.exe
Token: SeSystemEnvironmentPrivilege	3928	wmic.exe
Token: SeRemoteShutdownPrivilege	3928	wmic.exe
Token: SeUndockPrivilege	3928	wmic.exe
Token: SeManageVolumePrivilege	3928	wmic.exe
Token: 33	3928	wmic.exe
Token: 34	3928	wmic.exe
Token: 35	3928	wmic.exe
Token: 36	3928	wmic.exe
Token: SeIncreaseQuotaPrivilege	3436	wmic.exe
Token: SeSecurityPrivilege	3436	wmic.exe
Token: SeTakeOwnershipPrivilege	3436	wmic.exe
Token: SeLoadDriverPrivilege	3436	wmic.exe
Token: SeSystemProfilePrivilege	3436	wmic.exe
Token: SeSystemtimePrivilege	3436	wmic.exe
Token: SeProfSingleProcessPrivilege	3436	wmic.exe
Token: SeIncBasePriorityPrivilege	3436	wmic.exe
Token: SeCreatePagefilePrivilege	3436	wmic.exe
Token: SeBackupPrivilege	3436	wmic.exe
Token: SeRestorePrivilege	3436	wmic.exe
Token: SeShutdownPrivilege	3436	wmic.exe
Token: SeDebugPrivilege	3436	wmic.exe
Token: SeSystemEnvironmentPrivilege	3436	wmic.exe
Token: SeRemoteShutdownPrivilege	3436	wmic.exe
Token: SeUndockPrivilege	3436	wmic.exe
Token: SeManageVolumePrivilege	3436	wmic.exe
Token: 33	3436	wmic.exe
Token: 34	3436	wmic.exe
Token: 35	3436	wmic.exe
Token: 36	3436	wmic.exe
Token: SeIncreaseQuotaPrivilege	3436	wmic.exe

Suspicious use of FindShellTrayWindow 16 IoCs

pid	Process
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1104	KMSAuto Lite x64 1.8.6.exe
1104	KMSAuto Lite x64 1.8.6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3324	1104	KMSAuto Lite x64 1.8.6.exe	77
PID 1104 wrote to memory of 3324	1104	KMSAuto Lite x64 1.8.6.exe	77
PID 1104 wrote to memory of 1836	1104	KMSAuto Lite x64 1.8.6.exe	79
PID 1104 wrote to memory of 1836	1104	KMSAuto Lite x64 1.8.6.exe	79
PID 1104 wrote to memory of 1836	1104	KMSAuto Lite x64 1.8.6.exe	79
PID 1104 wrote to memory of 3928	1104	KMSAuto Lite x64 1.8.6.exe	81
PID 1104 wrote to memory of 3928	1104	KMSAuto Lite x64 1.8.6.exe	81
PID 1104 wrote to memory of 3436	1104	KMSAuto Lite x64 1.8.6.exe	84
PID 1104 wrote to memory of 3436	1104	KMSAuto Lite x64 1.8.6.exe	84
PID 1104 wrote to memory of 2420	1104	KMSAuto Lite x64 1.8.6.exe	86
PID 1104 wrote to memory of 2420	1104	KMSAuto Lite x64 1.8.6.exe	86
PID 1104 wrote to memory of 2420	1104	KMSAuto Lite x64 1.8.6.exe	86
PID 1104 wrote to memory of 1772	1104	KMSAuto Lite x64 1.8.6.exe	88
PID 1104 wrote to memory of 1772	1104	KMSAuto Lite x64 1.8.6.exe	88
PID 1772 wrote to memory of 4120	1772	cmd.exe	90
PID 1772 wrote to memory of 4120	1772	cmd.exe	90
PID 1104 wrote to memory of 3712	1104	KMSAuto Lite x64 1.8.6.exe	91
PID 1104 wrote to memory of 3712	1104	KMSAuto Lite x64 1.8.6.exe	91
PID 3712 wrote to memory of 1608	3712	cmd.exe	93
PID 3712 wrote to memory of 1608	3712	cmd.exe	93
PID 1104 wrote to memory of 4880	1104	KMSAuto Lite x64 1.8.6.exe	94
PID 1104 wrote to memory of 4880	1104	KMSAuto Lite x64 1.8.6.exe	94
PID 4880 wrote to memory of 3300	4880	cmd.exe	96
PID 4880 wrote to memory of 3300	4880	cmd.exe	96
PID 1104 wrote to memory of 4352	1104	KMSAuto Lite x64 1.8.6.exe	97
PID 1104 wrote to memory of 4352	1104	KMSAuto Lite x64 1.8.6.exe	97
PID 4352 wrote to memory of 1500	4352	cmd.exe	99
PID 4352 wrote to memory of 1500	4352	cmd.exe	99
PID 1104 wrote to memory of 2216	1104	KMSAuto Lite x64 1.8.6.exe	100
PID 1104 wrote to memory of 2216	1104	KMSAuto Lite x64 1.8.6.exe	100
PID 2216 wrote to memory of 3928	2216	cmd.exe	102
PID 2216 wrote to memory of 3928	2216	cmd.exe	102
PID 1104 wrote to memory of 1876	1104	KMSAuto Lite x64 1.8.6.exe	103
PID 1104 wrote to memory of 1876	1104	KMSAuto Lite x64 1.8.6.exe	103
PID 1876 wrote to memory of 3708	1876	cmd.exe	105
PID 1876 wrote to memory of 3708	1876	cmd.exe	105
PID 1104 wrote to memory of 1852	1104	KMSAuto Lite x64 1.8.6.exe	106
PID 1104 wrote to memory of 1852	1104	KMSAuto Lite x64 1.8.6.exe	106
PID 1852 wrote to memory of 1564	1852	cmd.exe	108
PID 1852 wrote to memory of 1564	1852	cmd.exe	108
PID 1104 wrote to memory of 3448	1104	KMSAuto Lite x64 1.8.6.exe	109
PID 1104 wrote to memory of 3448	1104	KMSAuto Lite x64 1.8.6.exe	109
PID 1104 wrote to memory of 2260	1104	KMSAuto Lite x64 1.8.6.exe	111
PID 1104 wrote to memory of 2260	1104	KMSAuto Lite x64 1.8.6.exe	111
PID 1104 wrote to memory of 1900	1104	KMSAuto Lite x64 1.8.6.exe	114
PID 1104 wrote to memory of 1900	1104	KMSAuto Lite x64 1.8.6.exe	114
PID 1104 wrote to memory of 1796	1104	KMSAuto Lite x64 1.8.6.exe	116
PID 1104 wrote to memory of 1796	1104	KMSAuto Lite x64 1.8.6.exe	116
PID 1104 wrote to memory of 3600	1104	KMSAuto Lite x64 1.8.6.exe	118
PID 1104 wrote to memory of 3600	1104	KMSAuto Lite x64 1.8.6.exe	118
PID 1104 wrote to memory of 1880	1104	KMSAuto Lite x64 1.8.6.exe	120
PID 1104 wrote to memory of 1880	1104	KMSAuto Lite x64 1.8.6.exe	120
PID 1104 wrote to memory of 412	1104	KMSAuto Lite x64 1.8.6.exe	122
PID 1104 wrote to memory of 412	1104	KMSAuto Lite x64 1.8.6.exe	122
PID 1104 wrote to memory of 4724	1104	KMSAuto Lite x64 1.8.6.exe	124
PID 1104 wrote to memory of 4724	1104	KMSAuto Lite x64 1.8.6.exe	124
PID 1104 wrote to memory of 2000	1104	KMSAuto Lite x64 1.8.6.exe	126
PID 1104 wrote to memory of 2000	1104	KMSAuto Lite x64 1.8.6.exe	126
PID 1104 wrote to memory of 4732	1104	KMSAuto Lite x64 1.8.6.exe	128
PID 1104 wrote to memory of 4732	1104	KMSAuto Lite x64 1.8.6.exe	128
PID 4732 wrote to memory of 3428	4732	cmd.exe	130
PID 4732 wrote to memory of 3428	4732	cmd.exe	130
PID 1104 wrote to memory of 3176	1104	KMSAuto Lite x64 1.8.6.exe	131
PID 1104 wrote to memory of 3176	1104	KMSAuto Lite x64 1.8.6.exe	131

C:\Users\Admin\AppData\Local\Temp\KMSAuto Lite x64 1.8.6.exe
"C:\Users\Admin\AppData\Local\Temp\KMSAuto Lite x64 1.8.6.exe"
1⤵
- Sets service image path in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  PID:3324
- C:\Users\Admin\AppData\Local\Temp\signtool.exe
  "C:\Users\Admin\AppData\Local\Temp\signtool.exe" verify /v /ph /sha1 648384a4dee53d4c1c87e10d67cc99307ccc9c98 "C:\Users\Admin\AppData\Local\Temp\KMSAuto Lite x64 1.8.6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:1836
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3928
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where (Name LIKE 'Office%%') get Name, Description, ID, PartialProductKey, LicenseStatus, KeyManagementServiceMachine, KeyManagementServicePort, VLRenewalInterval, GracePeriodRemaining, KeyManagementServicePort, KeyManagementServiceProductKeyID /FORMAT:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Users\Admin\AppData\Local\Temp\conv.exe
  "conv.exe" -y -pkmsauto
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2420
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_KMS_Client-ppd.xrm-ms"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\cscript.exe
    cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_KMS_Client-ppd.xrm-ms"
    3⤵
    PID:4120
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_KMS_Client-ul-oob.xrm-ms"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3712
- - C:\Windows\system32\cscript.exe
    cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_KMS_Client-ul-oob.xrm-ms"
    3⤵
    PID:1608
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_KMS_Client-ul.xrm-ms"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\cscript.exe
    cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_KMS_Client-ul.xrm-ms"
    3⤵
    PID:3300
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_MAK-pl.xrm-ms"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4352
- - C:\Windows\system32\cscript.exe
    cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_MAK-pl.xrm-ms"
    3⤵
    PID:1500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_MAK-ppd.xrm-ms"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\system32\cscript.exe
    cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_MAK-ppd.xrm-ms"
    3⤵
    PID:3928
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_MAK-ul-oob.xrm-ms"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\system32\cscript.exe
    cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_MAK-ul-oob.xrm-ms"
    3⤵
    PID:3708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_MAK-ul-phn.xrm-ms"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1852
- - C:\Windows\system32\cscript.exe
    cscript.exe "C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS" //NoLogo /inslic:"C:\Users\Admin\AppData\Local\Temp\lic16\ProPlusVL_MAK-ul-phn.xrm-ms"
    3⤵
    PID:1564
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where (PartialProductKey is Not NULL) get Description, ID, PartialProductKey /FORMAT:List
  2⤵
  PID:3448
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path OfficeSoftwareProtectionProduct where (PartialProductKey is Not NULL) get Description, ID, PartialProductKey /FORMAT:List
  2⤵
  PID:2260
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path OfficeSoftwareProtectionProduct where (Name LIKE 'Office%%') get Name, Description, ID, PartialProductKey, LicenseStatus, KeyManagementServiceMachine, KeyManagementServicePort, VLRenewalInterval, GracePeriodRemaining, KeyManagementServicePort, KeyManagementServiceProductKeyID /FORMAT:List
  2⤵
  PID:1900
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where (Name LIKE 'Office%%') get Name, Description, ID, PartialProductKey, LicenseStatus, KeyManagementServiceMachine, KeyManagementServicePort, VLRenewalInterval, GracePeriodRemaining, KeyManagementServicePort, KeyManagementServiceProductKeyID /FORMAT:List
  2⤵
  PID:1796
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService get Version /value /FORMAT:List
  2⤵
  PID:3600
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where Version='10.0.22000.493' call InstallProductKey ProductKey="NMMKJ-6RK4F-KMJVX-8D9MJ-6MWKP"
  2⤵
  PID:1880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where Version='10.0.22000.493' call InstallProductKey ProductKey="XQNVK-8JYDB-WJ9W3-YJ8YR-WFG99"
  2⤵
  PID:412
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path OfficeSoftwareProtectionProduct where (Name LIKE 'Office%%' And PartialProductKey is Not NULL) get Name, Description /FORMAT:List
  2⤵
  PID:4724
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where (Name LIKE 'Office%%' And PartialProductKey is Not NULL) get Name, Description /FORMAT:List
  2⤵
  PID:2000
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\System32\taskkill.exe
    taskkill.exe /t /f /IM SppExtComObj.Exe
    3⤵
    - Kills process with taskkill
    PID:3428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
  2⤵
  PID:3176
- - C:\Windows\System32\reg.exe
    reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
    3⤵
    PID:3772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
  2⤵
  PID:1740
- - C:\Windows\System32\reg.exe
    reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
    3⤵
    PID:3304
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Windows\System32\SECOPatcher.dll" /F /Q
  2⤵
  PID:3152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\Windows\System32\SECOPatcher.dll" /reset
  2⤵
  PID:3936
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\System32\SECOPatcher.dll" /reset
    3⤵
    - Modifies file permissions
    PID:3384
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c mklink "C:\Windows\System32\SECOPatcher.dll" "C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files\bin\driver\x64WDV\SECOPatcher.dll"
  2⤵
  - Drops file in System32 directory
  PID:2600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\Windows\System32\SECOPatcher.dll" /findsid *S-1-5-32-545
  2⤵
  PID:5084
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\System32\SECOPatcher.dll" /findsid *S-1-5-32-545
    3⤵
    - Modifies file permissions
    PID:2340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c icacls "C:\Windows\System32\SECOPatcher.dll" /grant *S-1-5-32-545:RX
  2⤵
  PID:1392
- - C:\Windows\System32\icacls.exe
    icacls "C:\Windows\System32\SECOPatcher.dll" /grant *S-1-5-32-545:RX
    3⤵
    - Modifies file permissions
    PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger" /t REG_SZ /d "rundll32.exe SECOPatcher.dll,PatcherMain"
  2⤵
  PID:4572
- - C:\Windows\System32\reg.exe
    reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger" /t REG_SZ /d "rundll32.exe SECOPatcher.dll,PatcherMain"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    PID:1984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  PID:1424
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3960
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
  2⤵
  PID:4032
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS dir=in action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4712
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  PID:1180
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4964
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
  2⤵
  PID:2216
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall add rule name=0pen_Port_KMS2 dir=out action=allow protocol=TCP localport=1688
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:3232
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
  2⤵
  PID:2044
- - C:\Windows\system32\sc.exe
    sc.exe create KMSEmulator binpath= temp.exe type= own start= auto
    3⤵
    - Launches sc.exe
    PID:1352
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe start KMSEmulator
  2⤵
  PID:1436
- - C:\Windows\system32\sc.exe
    sc.exe start KMSEmulator
    3⤵
    - Launches sc.exe
    PID:1852
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path OfficeSoftwareProtectionService get Version, KeyManagementServiceMachine, KeyManagementServicePort /value /FORMAT:List
  2⤵
  PID:2280
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService get Version, KeyManagementServiceMachine, KeyManagementServicePort /value /FORMAT:List
  2⤵
  PID:1944
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where (Name LIKE 'Office%%' And PartialProductKey is Not NULL) get Name, Description, ID, PartialProductKey, LicenseStatus, KeyManagementServiceMachine, KeyManagementServicePort, VLRenewalInterval, GracePeriodRemaining, KeyManagementServicePort, KeyManagementServiceProductKeyID /FORMAT:List
  2⤵
  PID:2964
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where version='10.0.22000.493' call ClearKeyManagementServiceMachine
  2⤵
  PID:1900
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where version='10.0.22000.493' call ClearKeyManagementServicePort
  2⤵
  PID:3716
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where version='10.0.22000.493' call SetKeyManagementServiceMachine MachineName="10.3.0.20"
  2⤵
  PID:4820
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where version='10.0.22000.493' call SetKeyManagementServicePort 1688
  2⤵
  PID:1880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where version='10.0.22000.493' call SetVLActivationTypeEnabled 2
  2⤵
  PID:3540
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call ClearKeyManagementServiceMachine
  2⤵
  PID:2080
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call ClearKeyManagementServicePort
  2⤵
  PID:3116
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call SetKeyManagementServiceMachine MachineName="10.3.0.20"
  2⤵
  PID:2648
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call SetKeyManagementServicePort 1688
  2⤵
  PID:1964
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='85dd8b5f-eaa4-4af3-a628-cce9e77c9a03' call Activate
  2⤵
  PID:1744
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' call ClearKeyManagementServiceMachine
  2⤵
  PID:944
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' call ClearKeyManagementServicePort
  2⤵
  PID:2184
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' call SetKeyManagementServiceMachine MachineName="10.3.0.20"
  2⤵
  PID:3180
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' call SetKeyManagementServicePort 1688
  2⤵
  PID:2992
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where ID='d450596f-894d-49e0-966a-fd39ed4c4c64' call Activate
  2⤵
  PID:1292
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /d 10.3.0.20 /t REG_SZ /reg:32
  2⤵
  PID:2260
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /d 10.3.0.20 /t REG_SZ /reg:32
    3⤵
    PID:1912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /d 1688 /t REG_SZ /reg:32
  2⤵
  PID:392
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /d 1688 /t REG_SZ /reg:32
    3⤵
    PID:1908
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /d 10.3.0.20 /t REG_SZ /reg:64
  2⤵
  PID:1768
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServiceName /d 10.3.0.20 /t REG_SZ /reg:64
    3⤵
    PID:1096
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe add "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /d 1688 /t REG_SZ /reg:64
  2⤵
  PID:3764
- - C:\Windows\System32\reg.exe
    reg.exe add "HKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /f /v KeyManagementServicePort /d 1688 /t REG_SZ /reg:64
    3⤵
    PID:2008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe stop KMSEmulator
  2⤵
  PID:3184
- - C:\Windows\system32\sc.exe
    sc.exe stop KMSEmulator
    3⤵
    - Launches sc.exe
    PID:1428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c sc.exe delete KMSEmulator
  2⤵
  PID:5060
- - C:\Windows\system32\sc.exe
    sc.exe delete KMSEmulator
    3⤵
    - Launches sc.exe
    PID:4752
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill.exe /t /f /IM SppExtComObj.Exe
  2⤵
  PID:2104
- - C:\Windows\System32\taskkill.exe
    taskkill.exe /t /f /IM SppExtComObj.Exe
    3⤵
    - Kills process with taskkill
    PID:4564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
  2⤵
  PID:2088
- - C:\Windows\System32\reg.exe
    reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f /v "Debugger"
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3368
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
  2⤵
  PID:2608
- - C:\Windows\System32\reg.exe
    reg.exe delete "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.Exe" /f
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Indicator Removal: Clear Persistence
    PID:2144
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c del "C:\Windows\System32\SECOPatcher.dll" /F /Q
  2⤵
  PID:1064
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
  2⤵
  PID:5016
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
  2⤵
  PID:1916
- - C:\Windows\system32\netsh.exe
    Netsh.exe Advfirewall Firewall delete rule name=0pen_Port_KMS2 protocol=TCP
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1576
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService get Version /value /FORMAT:List
  2⤵
  PID:5084
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where Version='10.0.22000.493' call InstallProductKey ProductKey="2TDPW-NDQ7G-FMG99-DXQ7M-TX3T2"
  2⤵
  PID:432
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path OfficeSoftwareProtectionService get Version /value /FORMAT:List
  2⤵
  PID:2716
- C:\Windows\System32\slui.exe
  "C:\Windows\System32\slui.exe" 0x2a 0xC004E016
  2⤵
  PID:2676
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where (Name LIKE 'Office%%') get Name, Description, ID, PartialProductKey, LicenseStatus, KeyManagementServiceMachine, KeyManagementServicePort, VLRenewalInterval, GracePeriodRemaining, KeyManagementServicePort, KeyManagementServiceProductKeyID /FORMAT:List
  2⤵
  PID:2128
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path OfficeSoftwareProtectionProduct where (Name LIKE 'Office%%') get Name, Description, ID, PartialProductKey, LicenseStatus, KeyManagementServiceMachine, KeyManagementServicePort, VLRenewalInterval, GracePeriodRemaining, KeyManagementServicePort, KeyManagementServiceProductKeyID /FORMAT:List
  2⤵
  PID:2568
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingProduct where (Name LIKE 'Office%%') get Name, Description, ID, PartialProductKey, LicenseStatus, KeyManagementServiceMachine, KeyManagementServicePort, VLRenewalInterval, GracePeriodRemaining, KeyManagementServicePort, KeyManagementServiceProductKeyID /FORMAT:List
  2⤵
  PID:324
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService get Version /value /FORMAT:List
  2⤵
  PID:4048
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where Version='10.0.22000.493' call InstallProductKey ProductKey="NMMKJ-6RK4F-KMJVX-8D9MJ-6MWKP"
  2⤵
  PID:2452
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" path SoftwareLicensingService where Version='10.0.22000.493' call InstallProductKey ProductKey="XQNVK-8JYDB-WJ9W3-YJ8YR-WFG99"
  2⤵
  PID:2664

C:\Windows\system32\rundll32.exe
rundll32.exe SECOPatcher.dll,PatcherMain C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
- Loads dropped DLL
PID:640
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:1264
- - C:\Windows\System32\SLUI.exe
    "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
    3⤵
    PID:4228
- - C:\Windows\System32\SLUI.exe
    "C:\Windows\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;Trigger=TimerEvent
    3⤵
    PID:4184

C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files\bin\KMSSS.exe
"C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files\bin\KMSSS.exe" -Port 1688 -PWin RandomKMSPID -PO14 RandomKMSPID -PO15 RandomKMSPID -PO16 RandomKMSPID -AI 43200 -RI 43200 KillProcessOnPort -Log -IP
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2916

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E0
1⤵
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files\bin\KMSSS.log

Filesize
665B

MD5
b75e02f1629f277621d8a5ef8e42761e

SHA1
292595bbf69cf90dcdc1539e96ecf7e45e4c5319

SHA256
2c466d74b5db173200221abb27c69e1b0c493b9fb12299942c700b2e4c00acb4

SHA512
8e745fd3a08668cc17347cbc3a6e6e58d7dd09c4c1c9c4d4b531e914c75a9d767beb43951ee8791be99f05e89ab630cef679eaa0ec7f1db8cfe26b63cb191d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files\bin\KMSSS.log

Filesize
1KB

MD5
484010fd81dd59a962a649a4c3035026

SHA1
7517ab153fdcf700c513326e04f45c580c24c32b

SHA256
d2332da7b844c57e1ff577f207795964a2f60871f3dc73d416828073dde3daa7

SHA512
9ebf599268528bd4c73dbe193479a00d55654d6a16852490cf6e75890d4c19dadd224e2a7a1970d31eae11923fba2ba6350d9e1f7cc55d3448e06150cd3350cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files\bin\KMSSS.log

Filesize
1KB

MD5
51461c74694c21e404fdee0b530a0d0b

SHA1
069da93c32d28484d39965046ae39c9ea75aba4b

SHA256
4c273a3e2badb1976ec8e69c480ffd2f332adc8a133c47cbb28efc67ecb1c732

SHA512
3348137270268069bfff63f51910283764d065ef83036614c1439aaa98a746ab80f63a2e3c71f2311835d05b2a1aa205ed5ee7ea65f740cbab1d90eee887219a

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files\bin\KMSSS.log

Filesize
2KB

MD5
6f658a456a1b2531b09021d63a3d7644

SHA1
60488187481c8e888de349af14e4c011e3b08963

SHA256
17c0cf80f8c53b92ec2c51f3734e55f0f2a190a7e0e15ca1cfb3479185bc85af

SHA512
601cdd3e064cac7b5e2a7427ce142f6e6f14373c24d9b825e6f7a5467238018f33ffeb854d004adb8a60ff7e24375a55b97658a067f69327a112af120eda6b31

Download Submit
C:\Users\Admin\AppData\Local\Temp\KMSAuto_Files\bin\KMSSS.log

Filesize
3KB

MD5
cf28260cd2444d66b4bad20eae5076c8

SHA1
f166294a7dba349d33e0bc853c24e9d8a6734034

SHA256
c799a2d02efbe0df1dc49f353422af6bebdf9db55dc7ba11ec38d083e22bd900

SHA512
7633f97dc9ffc2785f93482618604631ab7996c78a767c9b0b715c519d58deb27e17fbc041a14a7d326b8f197bcf6588efd0664a021204492859088558167e70

Download Submit
C:\Users\Admin\AppData\Local\Temp\conv.exe

Filesize
446KB

MD5
366d7dbb0cdf9684d0df559d33d9bc64

SHA1
e1a23c7590c4a6e32d63c32c3a958ba544b59a57

SHA256
f1f441fe3f598808f1c7572056420eeea06d3d46aa92747edea944335de5f450

SHA512
d8cb880578b9382539e452eccfd70ba789a02e89f6485284d475265524c2e410204d8435f2025213b43c9d2bfad698a318ae2e6907ed7fca0230e24b15411366

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2019VL_KMS_Client_AE-ppd.xrm-ms

Filesize
25KB

MD5
6256d4aa826faa59e89ea93160fc82da

SHA1
136fac36f645d9517b593dd43ab5a1e520c92eb5

SHA256
1bea83f266637f8e61149f968007be67a63fe72736ec1833abd20d18a5639e5f

SHA512
b1587b7bb3de848938251c90149ac29147b6c82860367d1f6c28d01dc49befe97170dfbe1d7f44bd8629086b055948094979a0bef9a71726578b3f69b5116d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2019VL_KMS_Client_AE-ul-oob.xrm-ms

Filesize
11KB

MD5
2f513f2a1287be2713ed9e454a84da81

SHA1
6e14be77b50216c36da1a9c225f43c0194bee2c5

SHA256
c7cdb5d53c090cc658428938d7ab488d24169e9899eccac0c8698969fd03291d

SHA512
d2824cdb19400adc36cd793fc9050c12a613ad4012a45a29bd10879b894358ca8e067b6f26642e7238e23016155e424e2c3da22fb60ee6cf2d9712062bc8e5b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2019VL_KMS_Client_AE-ul.xrm-ms

Filesize
9KB

MD5
0aa3e8d4461bff6bd9c4a58c56c6710b

SHA1
86012782ef07b57feda62409174c72bd29f048c9

SHA256
ddde6b5700fbfc6c0f6810a614a572e75d1f4b21823c40874708f9c35e10c603

SHA512
4c8c791b954212fe366a8d863e18128b744a7cce79a30626e8a48858c56780443ff3e363fb3c503d90fc13f0d48193d9f6152318fcb375468bd788b89f46fcaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2019VL_MAK_AE-pl.xrm-ms

Filesize
10KB

MD5
e6ad1f20b5ccbb26dda712c27fadc320

SHA1
10ab9491bc584c260dc1c1bdf9a2b73f4291720e

SHA256
089c15baaf7fe17d8d25f63c5f93a0a529b5dd694e400c8f85c0e1efc88a3987

SHA512
a87e91475ea62f592267745498ff0542e2ffdd4a10ee81ccebb809877de0f8c9ead97d109ee90d229923e5b32b3a0a3f6773bb1ba162e218fa02575b76ef57c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2019VL_MAK_AE-ppd.xrm-ms

Filesize
25KB

MD5
528fb51d1fd1e61e367b87ab168086e2

SHA1
1ffa96042f2d81fbd0f092acc6128be8f55198cd

SHA256
60d8b24dd1452732864482d633816ed49fc55b8551d20c9f94c75feb3e2b2698

SHA512
18e4a574a03c3f81fce8a3c8804638730257c8b85ecf7c2893276235fd86bdc5c5102fcdd14b77d0b976fac5047b43136597fc5769cf775f4b1c899e2980101c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2019VL_MAK_AE-ul-oob.xrm-ms

Filesize
11KB

MD5
6b3d4137a7c9568b1f7277307c174f04

SHA1
a27fdf723efd9a8338c4223a95192b1999fc4e13

SHA256
1aeaeda84916086fd8dd81faadae1fcf06bffe377190a290f90c40f82f6b272a

SHA512
f279250c889ae7d9fb334fddd36c29733b838b6a9cf4a3dd2c65ffdbde6b2b5d856f2b78c235599decb9eac57fe39651d3543dc31aa586813e1714bdc9e9b2a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2019VL_MAK_AE-ul-phn.xrm-ms

Filesize
19KB

MD5
305bbe8ffacc7cf7594ee18d1580b73c

SHA1
4df0461658c3ad11a49a66353f82afb0245b9e26

SHA256
27b1998b9b70b57dc9aef7aaf607c5e38f8f7c5d3794a9c3773e8e79eea8da08

SHA512
44f4800a5264c8ce791e24f385dc4f7dd09732768766593cc84c4ab808d4e843c549e56834d8b5eb217cccd5c57f26f70335c5ed3439c1510e5533d7e4e4eef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2021VL_KMS_Client_AE-ppd.xrm-ms

Filesize
25KB

MD5
90ce5b578bc792f1aaf58425ea6092a1

SHA1
df6a35029bfdc51918d9d92fce9c4ad938581347

SHA256
99c1e2d3e2bae4a67a41760f6d76451dc7434be27ec246028344f1b3872b960f

SHA512
b24290b3bd8c401e8475a12782be27587846a02ee978b24a8a3053e9a0c86a8b1a8a450a109a98ef74b1812c3489e5bcc5e432212008c25bec908cc7514f6aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2021VL_KMS_Client_AE-ul-oob.xrm-ms

Filesize
11KB

MD5
4e8fc98d44e3a29a4f491501f68f78d1

SHA1
7f4200719572bcc3fe4fecde743e97d732d69548

SHA256
ca0067c54c96fc4d50a535fb492d551507af0515755d4486c8d3fda4f170584c

SHA512
3f24fc57a0c55c579518683931d8e3df86e4f50f615bed43c6208910dac402b12f770d34ccf409a4deb1639450bf5fbc2f1ef92ea317b294916b05c202b27445

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2021VL_KMS_Client_AE-ul.xrm-ms

Filesize
9KB

MD5
dc08e5808ae9fdffc79df9c5bfc9914c

SHA1
fb83e83d0703dd80da79e1206a480b53fa99cbaf

SHA256
bfe08054697c3703e27b6ab8a78ec0e453228d2aee3f551caabfa2ddf497794a

SHA512
0118a3cbbea4a2b3d2bac32f60450934fdc5c308f428b924eeafb8e1ca5583458430150e230ca5f971aae9ec0433758b1734bda792794515e3fd09d6c0799c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2021VL_MAK_AE-pl.xrm-ms

Filesize
10KB

MD5
9eac2b30934ef4e76240f30b959df472

SHA1
a9d182a1c6075fb4d95170717ba3a33e60c3a645

SHA256
c83fcc37de81332959d4a075a6340b3997f625875c209fa49f4dadb90c2b4392

SHA512
4569510aa9bbee53f97ce5c93e6244b3b6b9a18837b257542bda8a6f9d1f5528c7b2d36dff8def47ce3e97ea410642c2ee3a61fcb238b3c9904b090b1a9ebb95

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2021VL_MAK_AE-ppd.xrm-ms

Filesize
25KB

MD5
9e7ac00da8e3a75be4cf72010a34a859

SHA1
fb9a015d73d80a1bbfa9a451f8a9473056787042

SHA256
888832141c738d9cbc6844cd1b803927190fe4c78277ed339634dbc81860d3c3

SHA512
fcc1ad59a642a591ed55f5526ba140d6e20fb1d1e096f1320f88b689f357443ec37d82762d3501bd4bfaffe9c8224795f82636f67211adac45d91a4fa7122a5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2021VL_MAK_AE-ul-oob.xrm-ms

Filesize
11KB

MD5
ca0dbfcf02c439214b1c49243f38fbfe

SHA1
040ecb53ebfcf8d4009c25f3fbbc1f614a98c8af

SHA256
d1d353fd60021e35623457dce138d213f842501097e8e1b5e476acdde15084ca

SHA512
7ae1da78c20b7adee6f1ea8692edec5195cbacde1ece1ede8cfa1eed9ce385ed66c5ecf13e36fdd0d393a27bfccc25a8dbd694819aa7adda590d0675286edc8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Access2021VL_MAK_AE-ul-phn.xrm-ms

Filesize
19KB

MD5
7a9f023a6985da925df2ada7f917d1dc

SHA1
25c2b402f0cfa9b28355e535f0e1927172cdda9a

SHA256
36b7049b6750fb584d5a9ea9076a6e84873e7fc892dc237470a57e429d8e522d

SHA512
bad98df46391572cacd8af7cb9b14d360c3d089e12fc031ddf16b9912980e63c6593f837a3a214a34e9852ba5fff50bf6ed00710e850ef25d2589390a2a45cbf

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\AccessVL_KMS_Client-ppd.xrm-ms

Filesize
7KB

MD5
ea81f375dbf4359cb587dd1d1b9888d9

SHA1
bcddb315420f21a2cd7663d4f93423dfeec28808

SHA256
da3514705c933f1e7de4d60270516dae35527cdf62193a788aa382f9f7b3f54b

SHA512
fdd2c415a2e10a6b61375878ec0ecb07d91acadf949127034227516e34f1728d8d6efe55019c7ced9b1e38afcb77ba6e2e214381e9d3ce06d62734534c3ba764

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\AccessVL_KMS_Client-ul-oob.xrm-ms

Filesize
11KB

MD5
52fa7a2ff7358691f89a02812296b47f

SHA1
a68ddc4c3b756694fae6b3154b3b6e3930f62337

SHA256
5eedc8c935c0331e5dd724b7408bc6b22510d8d49ac811f2a975386837e41d9f

SHA512
bf227eafe7c913bc77ca209d339c56d3907d1fe4f5ac3a36e838e18948a91f229b31812aca35eed4802defe68101ca2bbf5d47b8ce8af51c48d7e25ae9ecff33

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\AccessVL_KMS_Client-ul.xrm-ms

Filesize
9KB

MD5
85d68c704c262d9a186139ac3cde9f70

SHA1
6a695b43b8a0d41149c86739829f19a8a3de2c16

SHA256
a401cd4ec1a3c02dc175797af4ee41427245dbe62f0a83586724926317c39642

SHA512
032a94a1a3615ef88c305733e4788573f44c8696670cd19cdbd2f2e9e60db9b90e4fbd6705a852b207aa8a2cb73258f408d383fe028d0893bcd497b613737cab

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\AccessVL_MAK-pl.xrm-ms

Filesize
10KB

MD5
bdad8bea53ecd5b489df5ce146e38698

SHA1
a676380d1b16daf07f5488bef89ef48a38664037

SHA256
e43d09a2d2b844a2072f246c947500d0fea4a0e29174874f6640812beb0631ac

SHA512
15e9375714b1dc50eecfc54ff2ebb2a7a5f903abdba34f5a7d9f008f10dea03e43b5478f3d1ce79c8c00c5833570214827d8839f31933910ffd463eda8fabfd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\AccessVL_MAK-ppd.xrm-ms

Filesize
7KB

MD5
8273bef1489eeebb5287558efa91b315

SHA1
cd6b6621bcc9fd8bbf474ec7893f516729485e86

SHA256
adf3b2b33ff9cfdb142cd5779879354b8fb35f96109fd38bfd0ca94e5dbc38db

SHA512
cb84605d6134ebbf3b0161e345a7fca15d4a2731acae31d71699bbe1619a07ba3120214d8b378b69166f821da9a2bcbfc12d65412ebaf8c5fb9f0b53fd918ff6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\AccessVL_MAK-ul-oob.xrm-ms

Filesize
11KB

MD5
e5faad80fbf96c2024726c0e184fa8af

SHA1
5163d31b691c6ca49b9b7c7ea9dfa2c088c38cc0

SHA256
1c18c58f27a3ad746f61d2e6c84736a9e8dc8243487add527d2ffb17efaa380d

SHA512
763737cd40c546e65ea326afbea4ea9d484b4ec3e6c2aa958c692b136db4f2d3cf5e0cbfee5668b5e5c3a2a827fad20e974a52bac11ec227630c7762857ffcc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\AccessVL_MAK-ul-phn.xrm-ms

Filesize
19KB

MD5
861753974b49cbfc773ca3d9945a141e

SHA1
7015131e45de7d138f0f16eb020e8d6ac1591965

SHA256
444da0f2ed2607d2e973d558b5e99da0837eda0ad16301fd2032530f24202060

SHA512
25e761561f2173cade274c9dd9cb952949e8bc1cddc8cb598db6a3d90f9b32ab9d47a105a2c921fb8a7439e2c9ca2d805255bf48378f60e1ca551ef454e09d02

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2019VL_KMS_Client_AE-ppd.xrm-ms

Filesize
25KB

MD5
0e3ae5e7adf7a4d35b705cfe6d6208d0

SHA1
d24948e7de9eca0dc420869df011a13c1b7d1991

SHA256
33d37e1611aaf2136be291f81e0627d5560b6a0ae98725d93d3abfcc587917c9

SHA512
dd3ecabcfd24e3d20135c23da82d1452da716a4af29c031c908ef7f5a3d0ecea12222632e7c88f284cbb2cc48b5bf1da6016157141a53f6ddb4ff534b5dc34f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2019VL_KMS_Client_AE-ul-oob.xrm-ms

Filesize
11KB

MD5
a18089d933a51ec99025856b179f120a

SHA1
7e8bdef2541e432d83ac7069b31bef2151729831

SHA256
ea603cba7bb883c6e5d196d3d711179afac7685d8639e4cd7f8d307bd301d7d2

SHA512
65bae491cdbfbe329575b9c69573c76244fe69909eb22ba8f01dea0dea522569c6ae2a193d021e52c259f1bb8a4c2ba177ce813ab1d7e30e850a70fd6a94b5df

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2019VL_KMS_Client_AE-ul.xrm-ms

Filesize
9KB

MD5
c05417e3bf104b661d0cb0fdbd8e5eb4

SHA1
e61db23b5cbb060d76ed133cab8e46db6bd3926d

SHA256
dc2a73abe0bbc1ccb1b75529817d106163183663b32672ba3bb410ef8761f0be

SHA512
3e1e70f88e014f8177f9f673e0bcc371a7b6fdea99c4909c0a8f8fcd9a170d06442d0a691bf85a172715d2aa125261d1d2e1d8e9bd391d878038bd8012531497

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2019VL_MAK_AE-pl.xrm-ms

Filesize
10KB

MD5
dc2d8c2ef7c93a771d2c514ed91867c2

SHA1
6b8b5050e9581361a47edcab8f40da40bc6ebda4

SHA256
754128552354b2a81749be11bbaf9199f8bcb6e775e2f3f8ef1dba29f24baa7c

SHA512
b7c44017140bfdbe040d11036cc89867c656ae26beb7d2a6017cee1e8c3e5c5fde19687631adfbce1df2eaad0dc7fe365d3fca573bd50280d8f3c911f54baa54

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2019VL_MAK_AE-ppd.xrm-ms

Filesize
25KB

MD5
cf1f91e8e13bfc03258559705aa2bf76

SHA1
a82ee2adfae6fbbcb439b1e4de097440621a1497

SHA256
7d3d71cf2c4d47e18b03cfbc754ebc040eeb880e25caabf54d0393b162bcad70

SHA512
dd05420690275709af4ca92ee4f0caec87008c042cd2a33bcd31b44413cd7a328ca362efac688092d576bb7eaf640a1b9349cf28978b0b39a8082dcdaef3f251

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2019VL_MAK_AE-ul-oob.xrm-ms

Filesize
11KB

MD5
a452f7eb7e7d3bc9ae219cfa83f3808c

SHA1
a98260f2414d77424bca139dc9e356bb8e071138

SHA256
d3b3796ef30cecd437e19ae9a2f5de6d692ce1d67d6889c580605f497ae90c42

SHA512
d144085cb70ed409c81b8e1318508855301973c10eb8ae27eb704810559e6fd356aa764f1c9eacff4513e96ce1dd25dacea8992706ab2c7d00a634cdeef7aedb

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2019VL_MAK_AE-ul-phn.xrm-ms

Filesize
19KB

MD5
c454e758b66c176a325276bdf5c48ce0

SHA1
75ec522a5836a2aa68b4fbeddb027dfabcc3e614

SHA256
e45ceeb8614a466a4c6eb3b563b135dd3a0ad225a60552f7d6be32c67432c67b

SHA512
c74b0e694f3e0cdf676ab130cda2a38d077f05e60456831ceaf4bc4a3171a21d002317f90262942730f6d4b3ed8c4a988e0a838583ddbca8ffc3df84cdaa66f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2021VL_KMS_Client_AE-ppd.xrm-ms

Filesize
25KB

MD5
4e13adb5f5f6330137bbc9c9670c65e3

SHA1
1c73454ad0912c571eb7f91ae2a39aa10ebdc532

SHA256
8a1b326585e8b700e72cd6d6ac07789bb97aaeefa8fb640d656838a297c739b8

SHA512
e8509dcdd0095a82f9089d25769f9d4691869d4333cd49445095cda7a5e7d49559c8b364ff37f079cef01079259dae8e468ff2b5f2bfc71552b9270951d65458

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2021VL_KMS_Client_AE-ul-oob.xrm-ms

Filesize
11KB

MD5
f621f3132fd86e17d09e9f415bd3f93c

SHA1
035e47841656b39e393949631da98da682dc1908

SHA256
14b38a45108ac1697da29ceece72cb2b0abecc81422aa112c4438a11587eeb5e

SHA512
61a94a491ae1114d29ab10e8f7b587982486b1ba1f7c9ccdbdda6f56eb627af01e34bd179c7a6d714fc7b74cc9d4370980c6e6650a9d9c938be292ae7bafdd61

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2021VL_KMS_Client_AE-ul.xrm-ms

Filesize
9KB

MD5
3cc2cde49a86b47226530261ab6f6e94

SHA1
a45ca2f285115e0c308e76fa4ae4c84f086597d4

SHA256
ed315e9ebf245efe09aa7cf202339f6312783e980c43d23b8a87e374b71fa913

SHA512
5cf6a81dd28ff17c2fcaed4c08464204ba24038e55cb1917632ad59074a15be2cee685ec9feb7cdfa0a3042e427e293ee71cf22660ce353ab9b4dcef852bc723

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2021VL_MAK_AE-pl.xrm-ms

Filesize
10KB

MD5
9070d4d60297888f8760a0425e1b0922

SHA1
0ae840966b1f6c0464efb1e1ba24b9de0210c6cd

SHA256
87572b28d09ff71ee938769a5d307bd9246b21cb23420eea120e4ae6cfec98b5

SHA512
b81bff4685c06aa46544ec8add6cbc51f8e277f7037248b9dbd5d8fa8bac97d26af7f2a87c8ca46c415c2cc76f3e031ecc63db00f25893290ca811c84fac0675

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2021VL_MAK_AE-ppd.xrm-ms

Filesize
25KB

MD5
99aafbeab1ac81dd79c0bbb1f499762d

SHA1
1191551cd568c52d1e5f9286c5972985e17fae7d

SHA256
6af5041e6fb5ef516ee427d1ae9238748884b01500ec052f1046cb40102175a7

SHA512
43b7994f09f3a2851a1d8886e201caf0f09f72117524f9f4e01face823615f20f977cdf3bd32033a0afc7ff8a89ffa5b86cf723feeb9249193d56f796b32df88

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2021VL_MAK_AE-ul-oob.xrm-ms

Filesize
11KB

MD5
0cd33e14470eda6832f5bc09bdc0893e

SHA1
1691b070b4c0bead31ff69aea88ee218cb351f3b

SHA256
d099612d06e3bb765c9014d6241d57bbd9231acf32d4ae375ee632d8f7f12f57

SHA512
12445e7e5aabeaec1f616e55f6658aae63aec4721e9daa857f0bf716835a1b931e98c75f5542256eb062e086a4a38111030316c15b35bd2b5364cfac81125cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\Excel2021VL_MAK_AE-ul-phn.xrm-ms

Filesize
19KB

MD5
09eebdfbb9734fac2218f9f425f8299a

SHA1
e3151341edeefdd85ec216afd6e881d88c91b36d

SHA256
08f4e238ea7cae425ed5b88eeaa69b7ead479addcc5148e3f4617b8749297c67

SHA512
647bce6ea728e538f01f16566260fad64000d21c434f6c7b7061526cd5d5bafdcb212c21181798ed641767df29fd0727e79c3c209130ee6ea7da40374ce95dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\ExcelVL_KMS_Client-ppd.xrm-ms

Filesize
7KB

MD5
12fbc86709c6a0947e6145bfa149b79e

SHA1
82cdc5a039c6f0ab029e3129f2c27511b0f1d6ea

SHA256
8702617c66b834c0429f849b667f2d41e9b403aa45bde5b2140917dc235cb5c7

SHA512
862a09c54820ff3bf32380cb0c2a25f36cb6b81a712185d03801f725f0ce103f78a29ae024b229fdb4308e4cbae51a9f12972e94166d5f5d480b8bf138842366

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\ExcelVL_KMS_Client-ul-oob.xrm-ms

Filesize
11KB

MD5
ce090939c1291ed9878a9160383f49f2

SHA1
c7c1791fd0de2f861dd59c0d381e0318adfe17b0

SHA256
2092d920113ec7870b31d5f6eb2feeca6268e4bbc8df84ebda718603adb17ed0

SHA512
b593936f225d3e8132f22e3bd3029bf55471ec3ddd31883fc6f6da47eca671909c03518e5145d645466111f6b1f75666faa2e727b6f3353e69c116c368b37e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\ExcelVL_KMS_Client-ul.xrm-ms

Filesize
9KB

MD5
41ca79009d4ff127ecc9320936f36f14

SHA1
4178dff39e1d8b7a4af9990cf398e1a2dd73dba2

SHA256
317312a54e084dcfce13e02c45b980e59aebafc0c1ad2fe6738ff670f22e9d73

SHA512
a513f6ddb27f7eb53c9d684eb5b0a5610a25f30f8525b6d98ad8f6135f94eddbaa64a2138f1c3dd87912eaff0cacdfe72d5c95eb977e9fac8a28611f29d05290

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\ExcelVL_MAK-pl.xrm-ms

Filesize
10KB

MD5
7d498376a9fb4c441c8ddf08ff9f02b6

SHA1
a773f89c2c8ebe794d5c6f44edf0cf6e94b52a0e

SHA256
bfcdb92d7072ec99bcd61c13517cab8b1f5c8ed552e9e12514b661d3a24f6aa5

SHA512
d717242f69a4b0fc8727ed6b176ddb502f6f0377ad9f482b1c2ff81286708aae00ef05925f9cefba10c7cfb581ec5c3263c1f279a2dfa4a52e1219bdbed08ee4

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\ExcelVL_MAK-ppd.xrm-ms

Filesize
7KB

MD5
40d73acfb19b6b8b784f73910dc73aca

SHA1
cedce2f15e7290c14e99bb19663fec17490026e8

SHA256
d1958cf687180b6684cf142d5fff34630590503bde399272bbeb494ef67ec1a7

SHA512
a35944025b72dba1159b02ca4c0621485a432f652e12d65b1b057fe30bd17ef5fdc60effcd3ab8ed007287f7a493cb125a4cbd1a0486a7ce7cad858432dd503d

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\ExcelVL_MAK-ul-oob.xrm-ms

Filesize
11KB

MD5
feb88ebd1234f66091d65fe26e7c07cb

SHA1
6d8fe810e026c70d84a9b65432df811fbb569f27

SHA256
524d52c206d402b15411bff2ddb5c64c77de875c7e5ecf02fd78777c998b0b90

SHA512
46cde813e138b09bb28ca9287c1aa8f8ab77d5f4c3576320f30a559c2a0220223a9b01992de103486b11bb2f9296a592dc1b3f4bbe58bbdeb3bc4d7ed838a0c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\ExcelVL_MAK-ul-phn.xrm-ms

Filesize
19KB

MD5
f0ac6e3f1ef3b09f4c908832b3458f38

SHA1
2fe2ef0a602968f403fe52266662bf8eade8fa01

SHA256
10ed9af7df471cf2e21bbf356bb802481bd766ac5e105b81506782c85174a1c9

SHA512
ca2201379ac2245cb5c8b91b646904c79520b39d690e074fbf3b8c03da499f97c277b8219a7b1221ce7afc69a2938e850d36bb6a3b0e84a87ecc42f01088582c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoR_KMS_Automation-ppd.xrm-ms

Filesize
12KB

MD5
218198a5a8f6375fcbcdc2e1634e5f8a

SHA1
d707e8acddcfd3abae6cedb4916993cb745869a8

SHA256
30b32fbc871105b3d637cba87fd4afb2d0a50a338798264743c6321d3db74531

SHA512
5f5552ae33c31068b14a81b16044b3cc68bdcb1cf2d5fcf3fe51b2172559b3fba87dd20695e3a04bcd9f43444bdf4be691dcbd68c128d829cf01a1e6ccf153fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoR_KMS_Automation-ul-oob.xrm-ms

Filesize
11KB

MD5
10db3614c9f63552727fd7fea6f20190

SHA1
b9b0a5d8452663c5e36be8df845460471a466f21

SHA256
f1914e8027fb0e8053b74ea9ded44f505178155e4eddb386583deb77b15da33c

SHA512
665068700106e5a5cd76e43043050598b44f933e0a0e791510adb11b58fd2eab91c2a78acd392e7610949c52f3d0e581eed1c6038fef35e6adad7828be01d403

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoR_KMS_Automation-ul.xrm-ms

Filesize
9KB

MD5
36f8e02d68dfffd2de15cb48ac02aeb7

SHA1
d6c7e89fb5f27d2b053628eb539ff48e16c13f64

SHA256
b71c1909b06ae72fb7f985790d4336ff9d285f7f737a498be900978e7ad98ab4

SHA512
17d0f27ae7865c2b77641c25c3d517ff6151976b70545ea33d54bb0cc6317339648c277dcbfc581f3dda8a33c9a3f13e3a39842ce657a9aa6c5724fd941348c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoVL_KMS_Client-ppd.xrm-ms

Filesize
12KB

MD5
26598b2ef4300456c9acd369917a80de

SHA1
3bc4edfdc0a93c53067e7d69a1db6d1770e0ce13

SHA256
18fe6b93e597ea9ef46f8f15788b9ba777ffcca253f0a78768bde5260e3e8311

SHA512
11186a50d5b1d04515d158efacb2ef25da251a3eade236f4012dc0d00f347ac7d2794e9ec1b1257961b93b78121d190cca10915700cb8e03339c3900a4883cf3

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoVL_KMS_Client-ul-oob.xrm-ms

Filesize
11KB

MD5
af15e4c30fd30d6d866de676d16ffa96

SHA1
241bc50b16fa7f5c5aedd37c33dd07e73f35b7cf

SHA256
34eca581d72502973190e77650b6617663afea96d89c345d7dd9fef4b294a37f

SHA512
6e278030a6d662b42d77016f82e1d7358889ee254e88db84e27758d1e39468c6f91baae7a56cfe0638456a9ec03a6d7b0258ba303160435cfdec20d83c0bdb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoVL_KMS_Client-ul.xrm-ms

Filesize
9KB

MD5
d62a1eb6ee88c923006e4175041fd3ef

SHA1
a219c175cc87ae2d6db86c221f7a3f6efc996423

SHA256
f24bf29df996a92b8211adc9b4c03a770aa1810d6edb187c76a4315142f6494b

SHA512
4936b34a0e663cb81e7677f7a4f6bff7dc9768fa177956134e6f4398dd889be07e78a61d3567d4c8c6899e868d33e13fb326a973bca83bddfe8d3e1aeb10a0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoVL_MAK-pl.xrm-ms

Filesize
10KB

MD5
1c9db5e0426293b2265c0828eb76367e

SHA1
c8e168a13486b1ca99ccab22e7491c257beddc7f

SHA256
427f4431abf10b90dd8ab64a550af602f61cdf3f3fbc90ad369bec4c5532bb16

SHA512
bed982aed27dac99489b7cb6c40349695e9c2366f7a64a1538eee386fac6018ef44083427a6c332c9b4f20218bd64b994e16b3a6f28ac5350ef5779262f99f4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoVL_MAK-ppd.xrm-ms

Filesize
12KB

MD5
ea0b1cc33d084a3c3ab18b38100fb938

SHA1
511ee19a592cf5b5e0bda28ba5b0ef894275f520

SHA256
b97432076cd55e686758d3d6e11443aa2b0184106b1ce8d4c1fc445fcf9c136c

SHA512
d30c1ea198e41038f63701dffb2a82ff863def91c7b18a15472b27aa9a833560003cedbb6c34658bf9a54493501f6b556c22ab597b881bec5f7086733439f715

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoVL_MAK-ul-oob.xrm-ms

Filesize
11KB

MD5
e73d2b52f571a62bb7e453bf9c03cea6

SHA1
a7cd118d59e35e6abf0fac142ed167cc83bdf06a

SHA256
a2a80b58ece5722ca66b1086f2acfec04ee5ecb58de4322375cf18efb5fab72e

SHA512
5528f93b4f4258ca5fa69780d89b7cd7f8c3a48e388f183623e3f9b31121ab652c902c46a803411cc11a0d61e95cad25f7b61d383c76b0cc6b68430eeb9e2973

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\MondoVL_MAK-ul-phn.xrm-ms

Filesize
19KB

MD5
9110f9ecb8541c58789d56c82ebdbc1d

SHA1
afc7d557055fe002b0fa54ea79627ab20defac4b

SHA256
b03d1a231961a6f6f5e91075645471b9c76c7a29b02d74329f300a468c2f53f2

SHA512
0bcca78c978c84fca9e84fcc042b84c727caa39b3722ed70249c4ed3fe790b86a49cb4169b1efb6da5ad84b35493fdf3a64b0da7f206edbab4c1c61a97a6258a

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\OSPP.VBS

Filesize
102KB

MD5
949fe20a90d317e70f13414c56f06b92

SHA1
6f5a901749b4268fd185e616f022fb0f83b8b35c

SHA256
e12538e3879ef390d59c3ebc7f63510f1734edbc79b1dcc03e90ee2930189872

SHA512
cbb7e8271d5493f0fe47bfe44659b9c59eaf967b292cc51e86f199cf9847a0c779d34f12c17c86866c615ca5fa158ceac1c98d32e1cb81aff03e77dba1e9029c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lic16\OneNoteVL_KMS_Client-ppd.xrm-ms

Filesize
7KB

MD5
2d44cb71eafff9ec6ad1c9b251fae707

SHA1
b16cfecc3cae7bde5805f8cdc1f68f58c7beefa3

SHA256
d243f453e6740eea1176797371ed5503501f1fdca820c0804f4212ff12d10ae0

SHA512
9b7b996bae284be947b57d442c896ee3b143e4a23aeaa56b6d15b0ab1021a819282c5f0c97c1eb921301ff582ad16d88bd480994b8c874d26668b4621e1c356f

Download Submit
C:\Users\Admin\AppData\Local\Temp\signtool.exe

Filesize
323KB

MD5
05624e6d27eaef0db0673ae627bd6027

SHA1
b155c76bf59992a8d75d0e3a59dc94f24aff2591

SHA256
962a92821f54a1e706aa989973130fdc1072c7bd8b9e6d11ea1050b46eb9d313

SHA512
233304669aefeec9ad5d19bd2dd5bb19ea35ce31da0b3aabe5ab859259608a58725fac5993637c9635e5912138d3eb477773351f0ee81cc3ce756d713163cf31

Download Submit
\??\c:\users\admin\appdata\local\temp\lic16\proplusvl_kms_client-ppd.xrm-ms

Filesize
10KB

MD5
88a8ece68209ab32fc606fcbd81e824c

SHA1
4e5de27d63f69035c18130c284333f5ef245b450

SHA256
8f303351a27460cde6ff78b57b1f86e592c28f4e77b886f0f74fd63da75a3c7f

SHA512
ae26c5a097f360cf005139564e27b8742dd73ca5beed59e03142b12a175f8e87bd4a8f0082f7aaebe619406454da81f08c1dd4d1ca5838246b96f04af8a449a4

Download Submit
\??\c:\users\admin\appdata\local\temp\lic16\proplusvl_kms_client-ul-oob.xrm-ms

Filesize
11KB

MD5
1c47d950435a91e3ed75dc5beb0140fa

SHA1
5d6b3b3da622b6671cb2385d69ddf7a172ed6d9d

SHA256
d2d53e957da72c70320503a1bea644ddc852e0121f07c6925151e1fd9fc870b8

SHA512
cc107bd708a8f221d77b31072aa5cd5659d29929f9ab66565abc604c661dfd51cd0d169ea415a2af18288e1c22df35529e47993a26ee8bafd49d3da42064f7a3

Download Submit
\??\c:\users\admin\appdata\local\temp\lic16\proplusvl_kms_client-ul.xrm-ms

Filesize
9KB

MD5
e41aa32e0ca479fb5cf923ddd540e2d2

SHA1
b89bd0d7ac43260e18b2378f5bd7867810cdbf22

SHA256
eb29a811e7379f10bd20384f1e47354de569e664594e45132f4a116fb4e93a73

SHA512
eb9ad9afa50d2556d24f518acdfc1c4740f24442dda9789444a7bd3508a2671bc4b8c18e2fd3cd461d881bdb6888c9e1701325b608e03db3407ef81fc83d383e

Download Submit
\??\c:\users\admin\appdata\local\temp\lic16\proplusvl_mak-pl.xrm-ms

Filesize
10KB

MD5
58af770293a4c25d833c971766533775

SHA1
ff39e192aaa786a15f0845676298ce914093b59a

SHA256
940bd40b30b1d6fa14ee9377322515ef2d5efc26ed144d533a6489c92c0022f7

SHA512
9d686097d51316cf3e308ab2eecec677c9d822ff7eb07fdbca779f1d1791f791eb56eebdcb66d271c4f67b2ffca552797ac4703e64414b8e921356df593cd780

Download Submit
\??\c:\users\admin\appdata\local\temp\lic16\proplusvl_mak-ppd.xrm-ms

Filesize
10KB

MD5
e1ba5f60d82af2d090310a3f6ac7b0b0

SHA1
39940f400dc2946e5714ce5266a8af4a9d327c8a

SHA256
5743e5f314ba2a212a11c6c84c629e6d47636d2180ccecfa2960a298499410c4

SHA512
6e5fedda0145c130fbbfe12ca66b027bae07be6b7d7e111ea095848e2ae389a239da819bde8cb34c55cd359285b58bc127f28bb95b350d0535e692b1c22253c8

Download Submit
\??\c:\users\admin\appdata\local\temp\lic16\proplusvl_mak-ul-oob.xrm-ms

Filesize
11KB

MD5
f0348e7be6c1fa26f248eef2593e69c8

SHA1
312980bad67fa679ba6ac1bbfc14f32330f0e6b9

SHA256
024ab58520de13782b3da482247fd8f851f91f67f4fda6cc09bbbc075adf5b64

SHA512
1811abf69192c12d2286c74074a5332023c878b86bf69633b18964ab0df67126582dfdb76070d479b002729f41a810b0d25f9e88c6d62891340efbfb161c1f3e

Download Submit
\??\c:\users\admin\appdata\local\temp\lic16\proplusvl_mak-ul-phn.xrm-ms

Filesize
19KB

MD5
9c89dcda14f7244ff8dc9fd2d6509041

SHA1
8af1547a4c92b71d91bbd6343676b9a8e2d538fe

SHA256
92212a5796ce2de34d49350719bb72596ec8bce5f3508d9b35227794f1209d1a

SHA512
a61b09130930bd52f6af38c877607c907f30e6990bd7164702be98d0912ebbcb4524586389a2a62821c0f2ce4f3fdedc4634614e1e09a194e557ce992fbfc5f6

Download Submit
memory/640-1023-0x0000000066DC0000-0x0000000066DC5000-memory.dmp

Filesize
20KB

Download
memory/1264-1024-0x0000000066DC0000-0x0000000066DC5000-memory.dmp

Filesize
20KB

Download