Overview

overview

10

Static

static

3

КМSрiсо.exe

windows7-x64

КМSрiсо.exe

windows10-2004-x64

10

Resubmissions

23-06-2024 14:21

240623-rpelzstfpc 10

23-06-2024 14:17

240623-rlz4hsxekp 10

23-06-2024 14:14

240623-rj5k8atekh 3

Analysis

  • max time kernel
    148s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-06-2024 14:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    КМSрiсо.exe

  • Size

    9.3MB

  • MD5

    9a82eec3b97942751c99fe42a8699cdf

  • SHA1

    62fa4445db34eac1e333af921454357704496261

  • SHA256

    ea8b966254f89ce69425210fec17037d47b68f5ebb5e6b40c408f28d3900bd0b

  • SHA512

    ad3b16ca24d29e1f9be6cdae9744cdd065a8f4545468aeaa99509b5c08a28b16d7c846978b71f60fe54d17b770af24529ba261133f02155048b45b7e0a79c246

  • SSDEEP

    196608:hbCPcnPEu6Bqimbj+P6EDTvLhe8dYoANmvP2WNChdb+WRTBl:hWrmb0vTvLnhmWkK+TBl

Score
10/10
cryptbotdiscoveryevasionexecutionpersistencespywarestealerthemidatrojanupx

Malware Config

Extracted

Family

cryptbot

C2

xokecn54.top

morekt05.top

Signatures

  • CryptBot

    A C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
    evasion
  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 9 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 10 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 22 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Control Panel 3 IoCs
    evasion
  • Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 16 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\КМSрiсо.exe
    "C:\Users\Admin\AppData\Local\Temp\КМSрiсо.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Program Files (x86)\folder1\Setup.exe
      "C:\Program Files (x86)\folder1\Setup.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Checks processor information in registry
      • Suspicious behavior: EnumeratesProcesses
      PID:3124
    • C:\Program Files (x86)\folder1\KMSpico.exe
      "C:\Program Files (x86)\folder1\KMSpico.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:536
      • C:\Users\Admin\AppData\Local\Temp\is-ER5EA.tmp\KMSpico.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-ER5EA.tmp\KMSpico.tmp" /SL5="$9005C,2952592,69120,C:\Program Files (x86)\folder1\KMSpico.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Modifies Internet Explorer Phishing Filter
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1868
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4612
          • C:\Windows\system32\sc.exe
            sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
            5⤵
            • Launches sc.exe
            PID:2512
        • C:\Windows\system32\cmd.exe
          "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1960
          • C:\Windows\system32\schtasks.exe
            SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:3724
        • C:\Program Files\KMSpico\UninsHs.exe
          "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Program Files (x86)\folder1\KMSpico.exe
          4⤵
          • Executes dropped EXE
          PID:3068
        • C:\Program Files\KMSpico\KMSELDI.exe
          "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup
          4⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Drops file in Windows directory
          • Modifies Control Panel
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1616
        • C:\Program Files\KMSpico\AutoPico.exe
          "C:\Program Files\KMSpico\AutoPico.exe" /silent
          4⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Modifies Control Panel
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1984
    • C:\Program Files (x86)\folder1\Setup1.exe
      "C:\Program Files (x86)\folder1\Setup1.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Drops startup file
      • Executes dropped EXE
      • Checks whether UAC is enabled
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of WriteProcessMemory
      PID:1216
      • C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe
        "C:\Users\Admin\AppData\Roaming\Intel Rapid\IntelRapid.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: AddClipboardFormatListener
        PID:2572
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=3744,i,3724086843943218842,1026644135694712596,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
    1⤵
      PID:4892
    • C:\Windows\SECOH-QAD.exe
      C:\Windows\SECOH-QAD.exe C:\Windows\system32\SppExtComObj.exe -Embedding
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4100
      • C:\Windows\system32\SppExtComObj.exe
        C:\Windows\system32\SppExtComObj.exe -Embedding
        2⤵
        • Loads dropped DLL
        • Modifies data under HKEY_USERS
        • Suspicious use of WriteProcessMemory
        PID:1132
        • C:\Windows\System32\SLUI.exe
          "C:\Windows\System32\SLUI.exe" RuleId=eeba1977-569e-4571-b639-7623d8bfecc0;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;NotificationInterval=1440;Trigger=TimerEvent
          3⤵
            PID:2520
          • C:\Windows\System32\SLUI.exe
            "C:\Windows\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=2de67392-b7a7-462a-b1ca-108dd189f588;Trigger=TimerEvent
            3⤵
              PID:3284
        • C:\Program Files\KMSpico\KMSELDI.exe
          "C:\Program Files\KMSpico\KMSELDI.exe"
          1⤵
          • Event Triggered Execution: Image File Execution Options Injection
          • Executes dropped EXE
          • Modifies Control Panel
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3228
        • C:\Windows\system32\AUDIODG.EXE
          C:\Windows\system32\AUDIODG.EXE 0x150 0x2f4
          1⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:2952

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        System Services

        1
        T1569

        Service Execution

        1
        T1569.002

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Persistence

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Image File Execution Options Injection

        1
        T1546.012

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Privilege Escalation

        Create or Modify System Process

        1
        T1543

        Windows Service

        1
        T1543.003

        Event Triggered Execution

        1
        T1546

        Image File Execution Options Injection

        1
        T1546.012

        Scheduled Task/Job

        1
        T1053

        Scheduled Task

        1
        T1053.005

        Defense Evasion

        Virtualization/Sandbox Evasion

        1
        T1497

        Modify Registry

        1
        T1112

        Credential Access

        Unsecured Credentials

        2
        T1552

        Credentials In Files

        2
        T1552.001

        Discovery

        Query Registry

        6
        T1012

        Virtualization/Sandbox Evasion

        1
        T1497

        System Information Discovery

        5
        T1082

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\folder1\KMSpico.exe
          Filesize

          3.1MB

          MD5

          a02164371a50c5ff9fa2870ef6e8cfa3

          SHA1

          060614723f8375ecaad8b249ff07e3be082d7f25

          SHA256

          64c731adbe1b96cb5765203b1e215093dcf268d020b299445884a4ae62ed2d3a

          SHA512

          6c6903f3a3092fd3d63c373189f2c06e12de032ee4fd6b80a15f58eaeb2079f3ae8a8bcdac85a358b1f9070b192b1c8260f9aa127d009b5afce475f966e91326

          Download Submit
        • C:\Program Files (x86)\folder1\Setup.exe
          Filesize

          2.6MB

          MD5

          eb2960160f8d4ba6fbda91efc9ff91bc

          SHA1

          80e599ff8e0e43a30a9edab0eafda30d1bc78f8a

          SHA256

          e1aa011c4654ad6d4e7aa8752325c3a0a6254439bd26b47bb854aaaf512d1ad6

          SHA512

          9849d4e692308b9ef364926db3d0848a2992e60750da2cd74bc5691ad0c1a76417a85744a9bda8a43d8064643a0e060685d809d9f199ca2751edfc80c902468f

          Download Submit
        • C:\Program Files (x86)\folder1\Setup1.exe
          Filesize

          3.4MB

          MD5

          150be50312a4f6c64f292c5ddc2367ae

          SHA1

          c3e19926be108631b2497e6c03796fd30df6d557

          SHA256

          8534e712f977ab6f7caee080f4281fdaf08337f209e92d1dae23bbff80fe6c41

          SHA512

          2bfaece5af3a6a3fc78da6c9dabae95c5d7a8bc222f3a84531dc4619e671fb7f0ee09a3973cc2d720ed6e16ea38ae67f5937f0cc74b4278576b54c10a4658ee1

          Download Submit
        • C:\Program Files\KMSpico\AutoPico.exe
          Filesize

          728KB

          MD5

          cfe1c391464c446099a5eb33276f6d57

          SHA1

          9999bfcded2c953e025eabaa66b4971dab122c24

          SHA256

          4a714d98ce40f5f3577c306a66cb4a6b1ff3fd01047c7f4581f8558f0bcdf5fa

          SHA512

          4119a1722202bbc33339747ea02fd35b327890d55bb472cd1e2146ca446d8ba6fddb1e8cf8bbfaeb08aec8ed2a9d5c0fa71b73510d409ffacd3908fa72bb53b4

          Download Submit
        • C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll
          Filesize

          5.2MB

          MD5

          1397b23f30681f97049df61f94f54d05

          SHA1

          5cb1ce6966e3d6d8b8c398cbd537c814312f194d

          SHA256

          fa76151a783250014ac8fa55d4c833100a623fcad1d6e2ddadcde259f5709609

          SHA512

          7d001b5942dad8ce1a83831b5a87f2fa6a1571bc133ce3c1ebe9988a43a7fcefc5cdb7870a6e692ef89fb815cfcff0e9c4b41f24ba0716c6808f190ea3c53535

          Download Submit
        • C:\Program Files\KMSpico\KMSELDI.exe
          Filesize

          921KB

          MD5

          f0280de3880ef581bf14f9cc72ec1c16

          SHA1

          43d348e164c35f9e02370f6f66186fbfb15ae2a3

          SHA256

          50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc

          SHA512

          ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6

          Download Submit
        • C:\Program Files\KMSpico\UninsHs.exe
          Filesize

          29KB

          MD5

          245824502aefe21b01e42f61955aa7f4

          SHA1

          a58682a8aae6302f1c934709c5aa1f6c86b2be99

          SHA256

          0a265b4bb8acceafaffb001632fa7e4c3f8ac39a71eda37f253e15bc1b8db90d

          SHA512

          204b39e31f22ba99cf09c5c8458fc94ea21b47aacc4abd305f71ba20a35d36bfc0ff53b95180542911c9c6f259db897dee76090d953f7ee18a8079caefda7981

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms
          Filesize

          10KB

          MD5

          6ba22dbe6a7804b7d2e6f2a416d5235e

          SHA1

          5e5eb958d16a18f5be2437b8ee0397edcf3e850c

          SHA256

          7f13c766991b4f23618844f83cb659cf7b3d5321da8925a82ea5357d8f7364d7

          SHA512

          341fc408e00b97d81a1d0b1aa75520f238ed24f4a3b68006b7967c75ea80cb089b5722e081a3668a083dd7e016e4af94a004f39221eb9093d9bce174a1570904

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms
          Filesize

          11KB

          MD5

          f24231ee95d34878b9e88d2647a61861

          SHA1

          3ce6bb335d12db05fa604fbd13cea6616ebdaadd

          SHA256

          37a1eeb50f69f20a4bf0bafb63b13308d51dbdc8f992832ffa64b87ffed84e2e

          SHA512

          e4ee5f4feaaa7a730be00754416f98fef52803d6343a642102d9c020ff8ea4452320c0d18b1e4872589e410b795c295b82d7f422f8892a06a1181c063fb3e1f0

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms
          Filesize

          9KB

          MD5

          a08a813759a501db6500133ededcd0fe

          SHA1

          399c186e5c00cba369aaeece635f9ad319f30b01

          SHA256

          3aecba9f064a51d12785341fec10f7ac57ec156019dd71711ca1a8e0d844470e

          SHA512

          8f96292c2bf483f55d08a55bc94eb2afa2fdbc2db60de68369becdb4eecd117dc4f4d86876b98d56ba4c1dcdc5ba4c9e99d24e8cd770d52b8bf1ffd77805d890

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-bridge-office.xrm-ms
          Filesize

          3KB

          MD5

          33c1695d278f5917f28067d27b4868ee

          SHA1

          55137aa9a24d6a622f05315dfbb65fb1a0c74e03

          SHA256

          65bccc008f5b44d2dbd880c0c33afcfff27c07dd24dc0cc7dda2b3bfa7e9ae74

          SHA512

          84389ef315ff2f9d86062470ea6033dcb409a3061b898ab677987aa881e2f6d4be1dacc4fad0c606dde6a301f04dfa2f1ff54af86e3a3767ab9bcf6ac368e2f2

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms
          Filesize

          3KB

          MD5

          c8a546ad00a2f81bd39f23ac1d70b24a

          SHA1

          cfbb628b1c014d0264536d908f6557dd6a01f4a9

          SHA256

          f050e6022511f0f16661f82809ba65ab8d912bd9971d3747f6b58f2042a4a921

          SHA512

          5b5cab22e808835a37fc1f1e17718baca95c03f1659022d51deca23685503cd4313fbf1363385e3f5c404c9958f6b6bd6b4b0efa7c1548113dd46f13f9ba33b0

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-root.xrm-ms
          Filesize

          3KB

          MD5

          aee8dc4536129edc9c1df17cb288e3e9

          SHA1

          13c872ac505add867c944da550e96bc69c8a4165

          SHA256

          6e058fd0c8a4c2aafac6502de3ea739340917c6e75e6ec26ee60298c01baa826

          SHA512

          a27811053173d30b56ce85837017305cc2d58a673498e4ef7e562e23147a22ed416e0e4dae9d062064bec77b3cf89e46302807cb2f0022189b88fcc8e31f0124

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-stil.xrm-ms
          Filesize

          3KB

          MD5

          072b400f6cbb1123397d1c452740da04

          SHA1

          5f5615f5840252f4998c1c07ea717dfd7da970cc

          SHA256

          afe8c45943567e747425f87e43f774c783c07392888078693188882bde1339e3

          SHA512

          e7b8481e37f5ecc775b1e0e946c22051ff7c2b320c7deecd2fe6ae33b69abb230782ca397e5d799d8863026eee62f331000f7bf5b6f4f5b6614195c78dd2142f

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul-oob.xrm-ms
          Filesize

          4KB

          MD5

          582e03b41356083d04ce6191f560092a

          SHA1

          607b41ac3d642b91655e0af54556f441682acacf

          SHA256

          d40dbfddc97849f246a397e59187a3f97f70fa1687d578b3dacb92044fd51bea

          SHA512

          c28f7d286369d8d4f9a9f79ed67912d2390030013ac4e3b549176cff8378ab0c34db37f2bf6712b5d9eb9b06cb7fe72203e85340889e38b85623e1dbb7d33887

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\client-issuance-ul.xrm-ms
          Filesize

          4KB

          MD5

          90642c5fd30ae5a2a34d4c217b4cab7f

          SHA1

          b89cf6d9033a7bb52b4eb9e98c97b8978d91af43

          SHA256

          08e15263cdd59b78c18c21777fd67579d14e65dfac15531312bed2c9c5497c0d

          SHA512

          8ceadd13adafe4a582d64481dd357c9906e5a082629e4ebf576a9cb84c30b8bc9bd17f28b186594aae164415e4c42ffe78dcf83048a1f8377b97a4c24fa422dd

          Download Submit
        • C:\Program Files\KMSpico\cert\kmscert2016\pkeyconfig-office.xrm-ms
          Filesize

          576KB

          MD5

          6a46a4977e1b2780b9907de0530f5ee7

          SHA1

          22b19e90035112dd43d6c6dc100ebbbd2b57676c

          SHA256

          90ba4e3c11f7a8260ae8fb93a73ab5af5fcfbb45b9fb2b15800c38485d3384f4

          SHA512

          34a54f48dda9d1422c2949b4add88ec03f77f4f7c6b83386e395c1764cf9eedb5c75ed04119fbf6f53ee3670abefec60af1fbff49f54ba4854e4354f44ea1c6c

          Download Submit
        • C:\Program Files\KMSpico\logs\AutoPico.log
          Filesize

          5KB

          MD5

          f9aaa8d9f6802de0fb3424306a22def1

          SHA1

          32aae85016f847ccc9ac62880f88875c174820ef

          SHA256

          4fc9b019ba6f7fb8207c06fda197ddd22763c5e76505aeeeca6f2351cc19a423

          SHA512

          12225472a889c9295abf4026c29503b2c70c1cf5214ad6cdff2e698cbc51839ddf8999848debca78a0c103926e7d3ef3f33442bdfc12eba57e78bb17ebc4a82b

          Download Submit
        • C:\Program Files\KMSpico\logs\AutoPico.log
          Filesize

          3B

          MD5

          ecaa88f7fa0bf610a5a26cf545dcd3aa

          SHA1

          57218c316b6921e2cd61027a2387edc31a2d9471

          SHA256

          f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

          SHA512

          37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

          Download Submit
        • C:\Program Files\KMSpico\logs\KMSELDI.log
          Filesize

          4KB

          MD5

          0857e080055c0828d17aa8a6ec5ee381

          SHA1

          13b633e0c25e844ea410dea69a54233a2333d89c

          SHA256

          9fb4319c6fbb546f7a2fb9f0c02f9043760fc1cb37b70d841973eb542a899d13

          SHA512

          3d26b52075491740143ede873abca5e92db7b23d8669f87e49ae035d6e9d7076210524e29779e63578eef7d7be2adc4554872583758453fa8cfd6253f67f257a

          Download Submit
        • C:\Program Files\KMSpico\logs\KMSELDI.log
          Filesize

          18KB

          MD5

          912d011fa8510ecf1c29db2e866722ad

          SHA1

          98f1dd8082c34fdf2b2a87ba4fe2571cbdbe154c

          SHA256

          813b6879c802a245b6d6495b4a3bcbcf5b6ad9099c88d8fe7fddb34304a3ee20

          SHA512

          d765f447b5231c90d9d81bb8d82f48eb4de8a80b80e76e63c819c109b25c956d8fb9526fde5bab9028afd6fc02c406bcd139aa3156558363ad3b771d369b2fef

          Download Submit
        • C:\Program Files\KMSpico\logs\KMSELDI.log
          Filesize

          928B

          MD5

          11bf33e1d24b9d230caad1751d09a963

          SHA1

          100a0b6b5ea3eb8f90f60958e7b4fa0c8b131e85

          SHA256

          742eab4bbaf721f0ab64fdc16a65459c911d19b02f54e3765474f6b38ea6be29

          SHA512

          828e7f6c1e371c41cc60aa5a656fdcf9eea7844bb674ec55237ad24eaa4bef781ec611712b4da8201755a0928403a3ca1ce8127ff62818afae8da3493a93cbf9

          Download Submit
        • C:\Program Files\KMSpico\logs\KMSELDI.log
          Filesize

          4KB

          MD5

          43c016a6d6324e521677eaaf178cb5f2

          SHA1

          89fbf4ef29c1109fa5602b1393e6510974428700

          SHA256

          6dc9dd89ed1a75709a2ce476d5117093f0678f9739c9f667880a30ce5f89bc38

          SHA512

          3c06c5becf4c7fc59c187a815621a3a685239a3a7460c46366aff9384ba932d323db9d9b478e4fbcece29770024d0b61fade308eb86ee697c38d517045861cbd

          Download Submit
        • C:\Program Files\KMSpico\scripts\Install_Service.cmd
          Filesize

          213B

          MD5

          9107cd31951f2cf90e0892740b9087c9

          SHA1

          efac5c2e59ddef2f0a7782ad1dea8f6b25a07395

          SHA256

          11578521b14c17fbbb070c13887161586d57196f4d408c41a0f02ed07ee32f2c

          SHA512

          f6b66dcbbb8aa55793b63f20fc3718038d7c35f94570cf487b6e8393f67be6bd004dd64f3b8fc8345b7e02e2e8ec2d48ceed2494d9f1282ca020dbbaa621f457

          Download Submit
        • C:\Program Files\KMSpico\scripts\Install_Task.cmd
          Filesize

          220B

          MD5

          ade709ca6a00370a4a6fea2425f948c1

          SHA1

          5919c95ef78bd4ab200f8071b98970ff9541a24a

          SHA256

          5b067073b968361fe489017d173040655f21890605d39cdb012a030dd75b52a8

          SHA512

          860f9f12bc4995fae7c74481c2b24a346e763e32a782b3826c0f0772ad90be48377faefd883c9a28b221f8476fd203782932fee859b079fb7d4b1b152cce7b53

          Download Submit
        • C:\Program Files\KMSpico\sounds\affirmative.mp3
          Filesize

          4KB

          MD5

          249dca86cbb375d84b52ed4eb5cefdc6

          SHA1

          244c2ce65343dcfa613c26c94fa8255c7e6789fe

          SHA256

          e7fc9406c360d22ed281fb415a2eec396b6a7d0c733c828b2a8c106a30753de5

          SHA512

          84cb0128518618b3142276e7f84f0fdf42b4e662699d822b96957f7ee31630d55eb432148c7f204bd3be46efedc2eea5ea703f3795ffd9edb7181a1e748fb947

          Download Submit
        • C:\Program Files\KMSpico\sounds\begin.mp3
          Filesize

          9KB

          MD5

          f33f2a16a46920b5c8227ffd558060b2

          SHA1

          a8f7192d34d585a981b5a2ea92b04a21a17b67a8

          SHA256

          443d23bd2705246cd64ff39d61b999ab74be6d60db1703d6782bb0d36a20eef3

          SHA512

          9cf3f48adfae4c7ff8bf60f313939c956b331373bd262f5b4a25fbb04d79b86abc5d73204d5c21a8e6f8f3fd51e503016a1f930e1dc2ea6696c3c7e056af7361

          Download Submit
        • C:\Program Files\KMSpico\sounds\complete.mp3
          Filesize

          5KB

          MD5

          0d0e8e30d6007cf99f3951424e1d88e6

          SHA1

          56a6a3a39a5c9210e97a27190464cd25014db68c

          SHA256

          4d73c58c680396759508b34b169d1fd9c6aa292141c7c58634842a92d68d3c7b

          SHA512

          8c2ad7488e52af3aabcbbfddefe0e82c594401e279b07f5f4096b695e6f365e932085a8b4b01c91b3e29cba0fa3b0f160537d4962daed70a74854b55e67f8541

          Download Submit
        • C:\Program Files\KMSpico\sounds\diagnostic.mp3
          Filesize

          13KB

          MD5

          06c9a7d36b9b6390faa90ca9c0650bee

          SHA1

          a27a0fdc48c678a9bd34b379d4f4e2c0e9776a9c

          SHA256

          2445c403447490dd7227617f7e8017da429ad65985fe013c6662906af15da4b0

          SHA512

          00aec80c11219c86f52c1984f8f40f992e24b6aeda1a953b20891ecd8976cdd767aa78c066924ee5c732e10149449dadc4dc7425e5ba3be9c8ca0fc150498bc9

          Download Submit
        • C:\Program Files\KMSpico\sounds\inputok.mp3
          Filesize

          2KB

          MD5

          28a23b81aefec1336a1046671dc5af30

          SHA1

          5c89b9b708d26cd44af9635fce8c0abd1fb71433

          SHA256

          0131a883e4b66e77becc17594a386bcd69e04f1e5185e4ae8a554fc3a39bb81a

          SHA512

          bc300f57b91a13ec31c9722c87004ea560fee7c6bedb12703281827163734819edaf3a22e322dd7f39c192ac0c319b34171a36dd9190985be33d106fa19a30bb

          Download Submit
        • C:\Program Files\KMSpico\sounds\processing.mp3
          Filesize

          6KB

          MD5

          fa3dfa3bd735d73281f10a91d593d52a

          SHA1

          4e859fc874b61d09f0c63714385cb73843fb07e7

          SHA256

          9390c99249423929fb82c2aad89e19249e493e4845d0c8babc99e1b594643f34

          SHA512

          bb3908c9458e1494a83a33532e6e165a05acacfe44820cda5c82d70e3662e7b9571c7020d9720a694f8b91e41284779b5df09d300193a46e70656d449310aa4f

          Download Submit
        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\KMSELDI.exe.log
          Filesize

          2KB

          MD5

          e266f25216f4826820e8525161f370f6

          SHA1

          d66237df98d220919ec0c50b375f9820dda183e1

          SHA256

          6b4b34bb1d0be3455fc808e752bdf21f9a0496521fcb1c0838134fc7728bd86a

          SHA512

          26dabb589a8d6222529e41b2a357aad6f4d73e5b50b29cf34bf2baae52c10b4fd4256b31e417351d56d395794e54d3f48993c77f2609db4e75923cb118603da3

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\SUqajVemCvQp\RQQsUenNaTKHl.zip
          Filesize

          49KB

          MD5

          c578bc8bd4e7e931d6358ad72eaba81d

          SHA1

          eb92be27f8ba4f60a8cb4ad71b70b87bdcdfa3fe

          SHA256

          bd69e8910691ba913d0d10996552a0118ce7d388d7f87771bc06c9283c414241

          SHA512

          bd6caa3b85abdff8055715e8b35a23f40b301ba851b7ef164ac7847e439b4b32f7cb1a38303047e619554e9ec3fd2d30e14820c3d70f9ba79a1bacc2eadb7b0d

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\SUqajVemCvQp\_Files\_Information.txt
          Filesize

          7KB

          MD5

          3c6d48c47acaffa371fd97e1b24ba929

          SHA1

          e20874a4cd1c998935902e6228c2a566e6d12d3d

          SHA256

          4ca91d5e0e2ac85f2c24242697e0d2b61b2be3a7c0d577d5d14b19fb471a6b05

          SHA512

          f787219ac19503e62434e4033825a41fc6ac4124e2baf5a12bc5f0201a3b2aacad14362e9af24bb9b05e72d2d1612f57b2abbddc47a292a4356fb2b8b0a908ff

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\SUqajVemCvQp\_Files\_Screen_Desktop.jpeg
          Filesize

          55KB

          MD5

          9c0b607ef8bf33bf75107bab80355129

          SHA1

          0c8866171e3d6123a170e5e147eae53b50040e4e

          SHA256

          48f70ad45655319dc9f2a616602027eb7a67a7560cad73329480ade2e5d92002

          SHA512

          57f082ac7c88180063a40a7398206c123e6ed7c8b9aceb46efcfda75031810c1e982e81621c1ba4864ec23edce90254da5ca14aa92006603fce8b76011a330e8

          Download Submit
        • C:\Users\Admin\AppData\Local\Temp\is-ER5EA.tmp\KMSpico.tmp
          Filesize

          703KB

          MD5

          1778c1f66ff205875a6435a33229ab3c

          SHA1

          5b6189159b16c6f85feed66834af3e06c0277a19

          SHA256

          95c06acac4fe4598840e5556f9613d43aa1039c52dac64536f59e45a70f79da6

          SHA512

          8844de1296ce707e3c5c71823f5118f8f2e50287ace3a2ee1ec0b69df0ec48ebcf5b755db669d2cd869d345fb06a9c07b36e98eda8c32a9b26b8fe22bdc105a0

          Download Submit
        • C:\Windows\SECOH-QAD.dll
          Filesize

          3KB

          MD5

          6d7fdbf9ceac51a76750fd38cf801f30

          SHA1

          6ef8310627537b1d24409574bc3c398cd97c474c

          SHA256

          0398221231cff97e1fdc03d357ac4610afb8f3cdde4c90a9ec4d7823b405699e

          SHA512

          b48d7eb268f8b46ff6a4782070bf6f2109ccc43166b8c64beb73348533b98f69aab5630386f4b5966b6e706f906b599fec5ff885d3e4572ed24acb6c6691fec8

          Download Submit
        • C:\Windows\SECOH-QAD.exe
          Filesize

          4KB

          MD5

          38de5b216c33833af710e88f7f64fc98

          SHA1

          66c72019eafa41bbf3e708cc3824c7c4447bdab6

          SHA256

          9896a6fcb9bb5ac1ec5297b4a65be3f647589adf7c37b45f3f7466decd6a4a7f

          SHA512

          99b9a9d5970eb10a903bde703c638f7dc639eb4894dfd84d8d94ce1326087c09fa415ef5bc0db7fd0248827045de24b78a680f301a59395215e50051056d1490

          Download Submit
        • C:\Windows\System32\Vestris.ResourceLib.dll
          Filesize

          88KB

          MD5

          3d733144477cadcf77009ef614413630

          SHA1

          0a530a2524084f1d2a85b419f033e1892174ab31

          SHA256

          392d73617fd0a55218261572ece2f50301e0cfa29b5ed24c3f692130aa406af3

          SHA512

          be6b524d67d69385a02874a2d96d4270335846bece7b528308e136428fd67af66a4216d90da4f288aeefd00a0ba5d5f3b5493824fcb352b919ab25e7ef50b81c

          Download Submit
        • memory/536-27-0x0000000000400000-0x0000000000417000-memory.dmp
          Filesize

          92KB

          Download
        • memory/536-178-0x0000000000400000-0x0000000000417000-memory.dmp
          Filesize

          92KB

          Download
        • memory/536-1434-0x0000000000400000-0x0000000000417000-memory.dmp
          Filesize

          92KB

          Download
        • memory/536-32-0x0000000000401000-0x000000000040B000-memory.dmp
          Filesize

          40KB

          Download
        • memory/1216-50-0x00007FF6EDCB0000-0x00007FF6EE5D4000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/1216-45-0x00007FF6EDCB0000-0x00007FF6EE5D4000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/1216-43-0x00007FF6EDCB0000-0x00007FF6EE5D4000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/1216-44-0x00007FF6EDCB0000-0x00007FF6EE5D4000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/1216-170-0x00007FF6EDCB0000-0x00007FF6EE5D4000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/1616-1264-0x000000001C4A0000-0x000000001C649000-memory.dmp
          Filesize

          1.7MB

          Download
        • memory/1616-1351-0x000000001C4A0000-0x000000001C649000-memory.dmp
          Filesize

          1.7MB

          Download
        • memory/1616-967-0x000000001BF60000-0x000000001C4A0000-memory.dmp
          Filesize

          5.2MB

          Download
        • memory/1616-965-0x0000000000B80000-0x0000000000C6A000-memory.dmp
          Filesize

          936KB

          Download
        • memory/1868-1433-0x0000000000400000-0x00000000004C0000-memory.dmp
          Filesize

          768KB

          Download
        • memory/1868-179-0x0000000000400000-0x00000000004C0000-memory.dmp
          Filesize

          768KB

          Download
        • memory/1868-1262-0x0000000000400000-0x00000000004C0000-memory.dmp
          Filesize

          768KB

          Download
        • memory/1984-1355-0x0000000000FE0000-0x000000000109A000-memory.dmp
          Filesize

          744KB

          Download
        • memory/2572-169-0x00007FF602930000-0x00007FF603254000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/2572-1436-0x00007FF602930000-0x00007FF603254000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/2572-171-0x00007FF602930000-0x00007FF603254000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/2572-1017-0x00007FF602930000-0x00007FF603254000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/2572-172-0x00007FF602930000-0x00007FF603254000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/2572-173-0x00007FF602930000-0x00007FF603254000-memory.dmp
          Filesize

          9.1MB

          Download
        • memory/3068-959-0x0000000000400000-0x0000000000417000-memory.dmp
          Filesize

          92KB

          Download
        • memory/3068-956-0x0000000000400000-0x0000000000417000-memory.dmp
          Filesize

          92KB

          Download
        • memory/3124-1171-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3124-1435-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3124-177-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3124-1169-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3124-33-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3124-41-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3124-40-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3124-34-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3124-31-0x0000000076F14000-0x0000000076F16000-memory.dmp
          Filesize

          8KB

          Download
        • memory/3124-30-0x00000000000A0000-0x000000000077E000-memory.dmp
          Filesize

          6.9MB

          Download
        • memory/3228-1464-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1467-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1461-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1460-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1465-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1453-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1463-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1462-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1457-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1458-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1456-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1455-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1454-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1452-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1451-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1450-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1468-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1459-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1466-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1470-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1471-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1474-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1473-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1472-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1448-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1475-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1446-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1500-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1501-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1504-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1503-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1502-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1516-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1447-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1445-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download
        • memory/3228-1444-0x000000001FED0000-0x000000001FEE0000-memory.dmp
          Filesize

          64KB

          Download