Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
KMSpico.exe

Overview

General Information

Sample name:KMSpico.exe
Analysis ID:1632207
MD5:d70ab01c774cb1b93c518ce62bec27cf
SHA1:23e3e816d95ca8527f3ab26a4ce7bd42e4fa5b3a
SHA256:81e4808bcd2b11a4fd3b23668882628bcbdce55c62009daa4b97b15e421e6d13
Tags:exeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer
Score:86
Range:0 - 100
Confidence:100%

Signatures

Antivirus detection for URL or domain
Attempt to bypass Chrome Application-Bound Encryption
Found malware configuration
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected AntiVM3
Yara detected LummaC Stealer
.NET source code contains potential unpacker
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Disables the Smart Screen filter
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Sample uses string decryption to hide its real strings
Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
Sigma detected: Silenttrinity Stager Msbuild Activity
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected Costura Assembly Loader
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a program with higher privileges
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality to read the clipboard data
Contains functionality to record screenshots
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables debug privileges
Extensive use of GetProcAddress (often used to hide API calls)
Found decision node followed by non-executed suspicious APIs
Found dropped PE file which has not been started or loaded
Found evasive API chain (date check)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries disk information (often used to detect virtual machines)
Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Browser Started with Remote Debugging
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • KMSpico.exe (PID: 7256 cmdline: "C:\Users\user\Desktop\KMSpico.exe" MD5: D70AB01C774CB1B93C518CE62BEC27CF)
    • KMSpico.tmp (PID: 7272 cmdline: "C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmp" /SL5="$1043A,33390065,844800,C:\Users\user\Desktop\KMSpico.exe" MD5: E4C43138CCB8240276872FD1AEC369BE)
      • KMSpico.exe (PID: 8100 cmdline: "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" MD5: A02164371A50C5FF9FA2870EF6E8CFA3)
        • KMSpico.tmp (PID: 4756 cmdline: "C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp" /SL5="$804D8,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" MD5: 1778C1F66FF205875A6435A33229AB3C)
          • cmd.exe (PID: 1212 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • conhost.exe (PID: 5096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • sc.exe (PID: 7688 cmdline: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)
          • cmd.exe (PID: 1400 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)
            • conhost.exe (PID: 576 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
            • schtasks.exe (PID: 5628 cmdline: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)
          • UninsHs.exe (PID: 1208 cmdline: "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe MD5: 245824502AEFE21B01E42F61955AA7F4)
          • KMSELDI.exe (PID: 7928 cmdline: "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup MD5: F0280DE3880EF581BF14F9CC72EC1C16)
      • core.exe (PID: 8112 cmdline: "C:\Users\user\AppData\Roaming\MyApp\core.exe" MD5: 439A40D01995AB73701DDF4BA440BE40)
        • MSBuild.exe (PID: 8008 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)
          • chrome.exe (PID: 3332 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223 MD5: E81F54E6C1129887AEA47E7D092680BF)
            • chrome.exe (PID: 4904 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2352,i,6786114277741485719,16467073181160997757,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1920 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)
  • svchost.exe (PID: 7348 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7508 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7516 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • SgrmBroker.exe (PID: 7608 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)
  • sppsvc.exe (PID: 7664 cmdline: C:\Windows\system32\sppsvc.exe MD5: 320823F03672CEB82CC3A169989ABD12)
  • svchost.exe (PID: 7704 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7752 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • MpCmdRun.exe (PID: 4712 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)
      • conhost.exe (PID: 5400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • AutoPico.exe (PID: 7324 cmdline: "C:\Program Files\KMSpico\AutoPico.exe" /silent MD5: CFE1C391464C446099A5EB33276F6D57)
    • WerFault.exe (PID: 1724 cmdline: C:\Windows\system32\WerFault.exe -u -p 7324 -s 1624 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • svchost.exe (PID: 2248 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • WerFault.exe (PID: 1332 cmdline: C:\Windows\system32\WerFault.exe -pss -s 208 -p 7324 -ip 7324 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)
  • svchost.exe (PID: 2284 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • svchost.exe (PID: 7492 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["agriework.life", "explorebieology.run", "moderzysics.top", "seedsxouts.shop", "codxefusion.top", "farfinable.top", "techspherxe.top"], "Build id": "AEeq9Q--for"}

Yara Signatures

PCAP (Network Traffic)

SourceRuleDescriptionAuthorStrings
sslproxydump.pcapJoeSecurity_LummaCStealer_2Yara detected LummaC StealerJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_LummaCStealer_4Yara detected LummaC StealerJoe Security
      0000000A.00000002.1792883577.00000000074F0000.00000004.08000000.00040000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
        0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
          00000016.00000002.2423235909.00000000007FB000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            0000000A.00000002.1785751625.0000000005801000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
              Click to see the 4 entries

              Unpacked PEs

              SourceRuleDescriptionAuthorStrings
              10.2.core.exe.74f0000.11.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                22.2.MSBuild.exe.5a0000.0.unpackJoeSecurity_LummaCStealer_4Yara detected LummaC StealerJoe Security
                  10.2.core.exe.589bf64.1.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                    10.2.core.exe.589bf64.1.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security
                      10.2.core.exe.74f0000.11.raw.unpackJoeSecurity_CosturaAssemblyLoaderYara detected Costura Assembly LoaderJoe Security

                        Sigma Signatures

                        System Summary

                        barindex
                        Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
                        Source: Process startedAuthor: Nasreddine Bencherchali (Nextron Systems): Data: Command: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, CommandLine: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, CommandLine|base64offset|contains: H!", Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1400, ParentProcessName: cmd.exe, ProcessCommandLine: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, ProcessId: 5628, ProcessName: schtasks.exe
                        Sigma detected: Silenttrinity Stager Msbuild Activity
                        Source: Network ConnectionAuthor: Kiran kumar s, oscd.community: Data: DestinationIp: 149.154.167.99, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 8008, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49719
                        Sigma detected: Browser Started with Remote Debugging
                        Source: Process startedAuthor: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 8008, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223, ProcessId: 3332, ProcessName: chrome.exe
                        Sigma detected: New Service Creation Using Sc.EXE
                        Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", CommandLine: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 1212, ParentProcessName: cmd.exe, ProcessCommandLine: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", ProcessId: 7688, ProcessName: sc.exe
                        Sigma detected: Windows Processes Suspicious Parent Directory
                        Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 7348, ProcessName: svchost.exe

                        Suricata Signatures

                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-03-07T20:54:49.555787+010020283713Unknown Traffic192.168.2.449719149.154.167.99443TCP
                        2025-03-07T20:54:52.344044+010020283713Unknown Traffic192.168.2.449721104.21.48.1443TCP
                        2025-03-07T20:54:54.615721+010020283713Unknown Traffic192.168.2.449723104.21.48.1443TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-03-07T20:54:52.814158+010020546531A Network Trojan was detected192.168.2.449721104.21.48.1443TCP
                        2025-03-07T20:54:55.395667+010020546531A Network Trojan was detected192.168.2.449723104.21.48.1443TCP
                        TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                        2025-03-07T20:54:52.814158+010020498361A Network Trojan was detected192.168.2.449721104.21.48.1443TCP

                        Joe Sandbox Signatures

                        Click to jump to signature section

                        Show All Signature Results

                        AV Detection

                        barindex
                        Antivirus detection for URL or domain
                        Source: agriework.lifeAvira URL Cloud: Label: malware
                        Source: farfinable.topAvira URL Cloud: Label: malware
                        Source: https://agriework.life/apiAvira URL Cloud: Label: malware
                        Found malware configuration
                        Source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpMalware Configuration Extractor: LummaC {"C2 url": ["agriework.life", "explorebieology.run", "moderzysics.top", "seedsxouts.shop", "codxefusion.top", "farfinable.top", "techspherxe.top"], "Build id": "AEeq9Q--for"}
                        Multi AV Scanner detection for dropped file
                        Source: C:\Program Files\KMSpico\AutoPico.exe (copy)ReversingLabs: Detection: 75%
                        Source: C:\Program Files\KMSpico\KMSELDI.exe (copy)ReversingLabs: Detection: 71%
                        Source: C:\Program Files\KMSpico\Service_KMS.exe (copy)ReversingLabs: Detection: 76%
                        Source: C:\Program Files\KMSpico\is-E64V7.tmpReversingLabs: Detection: 71%
                        Source: C:\Program Files\KMSpico\is-HC31N.tmpReversingLabs: Detection: 75%
                        Source: C:\Program Files\KMSpico\is-QBUB1.tmpReversingLabs: Detection: 76%
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe (copy)ReversingLabs: Detection: 73%
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\is-1H3AB.tmpReversingLabs: Detection: 73%
                        Multi AV Scanner detection for submitted file
                        Source: KMSpico.exeVirustotal: Detection: 30%Perma Link
                        Source: KMSpico.exeReversingLabs: Detection: 21%
                        Sample uses string decryption to hide its real strings
                        Source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpString decryptor: agriework.life
                        Source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpString decryptor: explorebieology.run
                        Source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpString decryptor: moderzysics.top
                        Source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpString decryptor: seedsxouts.shop
                        Source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpString decryptor: codxefusion.top
                        Source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpString decryptor: farfinable.top
                        Source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmpString decryptor: techspherxe.top
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BC281 CryptUnprotectData,22_2_005BC281
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BC281 CryptUnprotectData,22_2_005BC281
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: -----BEGIN PUBLIC KEY-----memstr_364536a5-2
                        Source: KMSpico.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpicoJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\certJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\AccessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ExcelJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\GrooveJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPathJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNoteJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OutlookJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPointJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlusJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PublisherJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasicsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\StandardJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\VisioJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\WordJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\AccessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ExcelJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPathJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\LyncJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNoteJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OutlookJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPointJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlusJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PublisherJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\StandardJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\WordJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\AccessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ExcelJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\MondoJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNoteJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OutlookJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPointJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlusJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PublisherJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusinessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\StandardJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\WordJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\CoreJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EducationJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseSJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\ProfessionalJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessNJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\EmbeddedJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\ProfessionalJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreNJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguageJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseNJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalNJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMCJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguageJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustryJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMCJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenterJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandardJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driverJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\iconsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scriptsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\soundsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\unins000.datJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-8OFR2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-HC31N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-9V6LA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-2EIIF.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-E64V7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-QBUB1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-ACNAA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-SFUS1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-KQ1UT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-F0C0D.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-MUB89.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-8KGGS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-HE023.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-EGVND.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-QOVU5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-02ID6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-LFDQI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-CAQ8M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-SEH7L.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-N77RL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-12JU1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-3GV12.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-VJ84H.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-4VLR4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-MG369.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-5VQ19.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-MDOOI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-O8OU9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-RJ2H1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-HL5U2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-I00BG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-7BRBS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-SOT02.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-DDI06.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-OP392.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-UOAUM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-D1FP3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-N684C.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-J0B10.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-SQF5E.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-6GO5S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-KKIRC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-49473.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-FUV2T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-N11K7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-0239V.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-HVSJ2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-KJNDQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-C6JLP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-ITN8T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-U010M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-OLGGU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-QK00D.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-NHV4T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-52RFN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-HQKB0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-3FGDO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-JG3UO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-ONH3S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-SAKEP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-49KRL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-40DB5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-JK04T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-VJ031.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-44HBP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-E77IS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-GETUJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-U8Q2E.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-PSC3U.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-CF9IM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-IIL0M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-V7ERR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-F0RDS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-A8QRB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-NP2UT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-4SAHU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-AFJNA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-8DPHI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-J0MH0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-GFERF.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-MVLI1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-AR0E4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-NADIO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-MP937.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-0DRJO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-PECTO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-2GJ3T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-JL87T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-BQ8M8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-5Q516.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-V6T86.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-I1ISA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-L6LN8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-ESTD7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-TJB7B.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-5RT75.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-75VOH.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-4EVAJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-AG3D5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-TAV37.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-7CLVQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-JKEM1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-K6H9C.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-N59V8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-RI7MS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-E4G0A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-KJ3FM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-J4UTU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-IJIBE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-5LEE5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-029NU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-QO4M4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-56FF9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-SU1OA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-0MITQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-6UTIG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-9E2O4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-NRKBI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-D7B12.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-H5THQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-T07VO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-SD98L.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-J8P5F.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-4E06R.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-HC13S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-TK24A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-KCTIP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-CGUOA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-DH469.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-I857A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-TDFKN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-8J610.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-0O9CM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-0J3EC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-7ERR1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-EICFK.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-9SP0S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-GUUA8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-QC1PG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-L186V.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-UMPGI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-0ADVO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-FRI7S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-104TP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-6MTDH.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-KI77H.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-UTD1S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-T2PUO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-52HDG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-RV1ED.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-V1V78.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-7J08N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-L1AA8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-98SL4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-QQ0RP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-D08EC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-4BJ1G.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-5V7GD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-GVJ77.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-CCGMF.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-V9QL1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-S6591.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-C7UL9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-B5QRP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-9L2AI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-1OJRN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-0EGLN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-5T2D1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-88BBR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-LVHP7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-58PSA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-J9ID0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-6J56M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-BE46A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-DJC0P.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-N9RID.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-BSRCO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-VISRO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-37NUT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-BHA81.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-R93JS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-9E068.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-MBBME.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-AISCJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-2DBLN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-GSB6J.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-O7GB3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-JONIS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-277G4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-87PHG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-0Q84K.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-4OV1K.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-53V4O.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-9CBFN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-6GCEQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-EN9JH.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-U8SPD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-02BU1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-NOBPD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-K3NNE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-LCQNR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-ITMD6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-DU7O4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-569G1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-AIHDP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-4HT1T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-P0J2N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-O7KK2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-5K5D0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-EBEKV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-BEFKV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-36QEA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-CFLB7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-UDSJ3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-LUCEK.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-4BTTG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-44827.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-A70T1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-AE3JD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-F7PKD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-7GQFN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-F747I.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-5ROB2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-RGLPO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-83DLG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-3E3RE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-87L1C.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-RBU8A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-J9KP9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-UTNLC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-AF963.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-6KOER.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-0I34R.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-G0O65.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-9H7CT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-GFPG1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-JEQ5T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-JN4IG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-6A3DL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-4RS2N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-58NE8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-JN8J5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-1QG41.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\is-JFMHJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-HK2JJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-JK2KT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-55TFP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-LKGRD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-9LRFN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-UO9OG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-CQMKM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-4DQIU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-PA80B.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-G6JIL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-MIVQG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-SU0UT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\is-HS278.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-MEQC5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-PUKCU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-NO4Q3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-LT6A5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-S831N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-Q64RO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-1EGJ7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-9G0IR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-80343.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-9MKQN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-9EED2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-IHRF1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-BF6O3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-U6P1J.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-4OTUC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-SMDGG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-51MMC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-T4LC3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-A8AHR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-S47CV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-S5UBO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-FSQPV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-LJ16A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-J21U7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-AFHOV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-NA5F0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-6R6EF.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-55C1V.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-AVJIO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-TUQIU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-RRCH2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-CHOQ0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-H1R1S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-GM6HG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-9098S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-BPDC1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-GEQ32.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-CVQQE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-UVC4K.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-0EF1Q.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-83372.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-SJC1H.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-IQK73.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-1LH95.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-8RFIL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-TTFUG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-61670.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-U93JN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-Q64UJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-0LRD4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-JT2F4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-LTVNB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\is-5ORNJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-6E0D5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-HTQU6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-GONDM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-RS4UE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-U9C2A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-OG96V.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-142KJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-9RG7R.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-RE4KB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-HJ4G7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-2ODDN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-4AHSI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-DV7F1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-IONKK.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-J45US.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-EF8PC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\is-DF724.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-G5N31.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-65AHQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-G14F1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-CS91B.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-TSMU4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-33NK8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-JDB28.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-N544E.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-T70SL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-SSLNV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-DFVBQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-S6U76.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-RAA9D.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-1F7IM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-OI6OE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-TKA9B.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-ERA33.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-3PNU6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-JTF8S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-IL6EK.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-9TESG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-BO7O6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-1JLHT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-2VPUP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-TVKSB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-VJS2F.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-3SAS9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-VQJ5J.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-N5RTD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-2JC2O.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-3MR4N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-AN5IQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-SFTEE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-BSF2Q.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-I1IS0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-1M7Q4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-AD2I4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-1MAGC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-T656R.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-G4HJC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-5CPVA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-BSVT7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-RQHU0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-C0PQ8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-9SE0M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-PLQV2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-N7BE8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-EQKEG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-71QL0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-TKVFM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-62SOB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-1QGJT.tmpJump to behavior
                        Source: C:\Program Files\KMSpico\KMSELDI.exeDirectory created: C:\Program Files\KMSpico\logs\KMSELDI.log
                        Source: C:\Program Files\KMSpico\AutoPico.exeDirectory created: C:\Program Files\KMSpico\logs\AutoPico.log
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\Setup Log 2025-03-07 #001.txtJump to behavior
                        Source: unknownHTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49719 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49721 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49723 version: TLS 1.2
                        Source: KMSpico.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                        Source: Binary string: \??\C:\Windows\dll\System.pdb source: AutoPico.exe, 00000015.00000002.1843773332.000000001A736000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: AutoPico.exe, 00000015.00000002.1843773332.000000001A736000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: core.exe, 0000000A.00000002.1785751625.000000000599B000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.0000000005A13000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1793293890.0000000007C40000.00000004.08000000.00040000.00000000.sdmp
                        Source: Binary string: c:\divert-master\install\WDDK\i386\WinDivert.pdb source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmp
                        Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: core.exe, 0000000A.00000002.1785751625.000000000599B000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.0000000005A13000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1793293890.0000000007C40000.00000004.08000000.00040000.00000000.sdmp
                        Source: Binary string: pC:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000015.00000002.1835822285.0000000000EF4000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdbH source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmp
                        Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbp source: AutoPico.exe, 00000015.00000002.1835922426.0000000000F90000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: \??\C:\Program Files\KMSpico\AutoPico.PDBo: source: AutoPico.exe, 00000015.00000002.1843773332.000000001A744000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: protobuf-net.pdbSHA256}Lq source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmp
                        Source: Binary string: indoC:\Windows\System.pdb source: AutoPico.exe, 00000015.00000002.1835822285.0000000000EF4000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: AutoPico.PDB source: AutoPico.exe, 00000015.00000002.1835822285.0000000000EF4000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: protobuf-net.pdb source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmp
                        Source: Binary string: c:\Users\dblock\Source\CodePlex\resourcelib\trunk\Source\ResourceLib\obj\Release\Vestris.ResourceLib.pdb source: KMSpico.tmp, 0000000C.00000002.2428044215.000000000688F000.00000004.00001000.00020000.00000000.sdmp
                        Source: Binary string: m.pdb source: KMSELDI.exe, 00000014.00000002.2447174010.000000001DEDA000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000015.00000002.1835822285.0000000000EF4000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdb source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmp
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00452A60 FindFirstFileA,GetLastError,12_2_00452A60
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0047531C FindFirstFileA,FindNextFileA,FindClose,12_2_0047531C
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,12_2_00464158
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004985E4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,12_2_004985E4
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00462750 FindFirstFileA,FindNextFileA,FindClose,12_2_00462750
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,12_2_00463CDC
                        Source: C:\Program Files\KMSpico\UninsHs.exeCode function: 15_2_00401C98 FindFirstFileA,MessageBoxA,RtlZeroMemory,7696D0A0,15_2_00401C98
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then jmp 07C15610h10_2_07C15551
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 4x nop then jmp 07C15610h10_2_07C15558
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov eax, ebx22_2_005C5800
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then cmp dword ptr [edi+esi*8], 5F115B3Dh22_2_005EF1C0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax]22_2_005EC2C8
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+6Eh]22_2_005BC281
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov word ptr [eax], cx22_2_005BC281
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+2D625574h]22_2_005C3B00
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then add edi, 02h22_2_005BB470
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx+50h]22_2_005E5ED0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then cmp dword ptr [edx+ebx*8], 744E5843h22_2_005EA050
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edi, byte ptr [ecx+esi]22_2_005A2800
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx eax, byte ptr [esp+edi-1D950A4Ch]22_2_005AC880
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov dword ptr [esp+08h], esi22_2_005EE8B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edi, word ptr [ecx]22_2_005EE8B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx esi, byte ptr [esp+eax+17A26B3Eh]22_2_005D1960
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx eax, di22_2_005D1960
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx eax, byte ptr [esp+edx+565E2674h]22_2_005B090F
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then jmp ecx22_2_005D39DE
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx-5F5D8690h]22_2_005D11F8
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov dword ptr [esp+3Ch], 00000800h22_2_005D11F8
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov ebx, dword ptr [edi+04h]22_2_005D59A0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [esi], cl22_2_005C4259
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edi, byte ptr [esp+eax]22_2_005E7A69
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax-0000009Ah]22_2_005EB21F
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [eax], cl22_2_005BFA04
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov ecx, ebx22_2_005A7A30
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]22_2_005AA2B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx ecx, word ptr [edi+esi*4]22_2_005AA2B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then cmp dword ptr [edi+edx*8], esi22_2_005EE2B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov word ptr [eax], dx22_2_005C4B40
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov ecx, dword ptr [00600F40h]22_2_005EC31D
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edi, byte ptr [esp+eax]22_2_005E7B8F
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx]22_2_005E7B8F
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [esi], cl22_2_005DA382
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movsx ecx, byte ptr [esi+eax]22_2_005BB3A0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [esi], cl22_2_005D9BA3
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+ecx-52h]22_2_005ECBA0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-27D1E72Ah]22_2_005EBC57
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [esi], cl22_2_005D947F
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax+6Eh]22_2_005BC281
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov word ptr [eax], cx22_2_005BC281
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then add ebp, dword ptr [esp+0Ch]22_2_005D7410
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax]22_2_005E6C30
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [esi], cl22_2_005D9428
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax]22_2_005EB4D6
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [esi], cl22_2_005D9491
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then cmp dword ptr [esi+edx*8], 9F1F8F53h22_2_005EA490
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [esp+eax-000000B2h]22_2_005AF480
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [ebx], al22_2_005D8482
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h22_2_005C94B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax-19B6A066h]22_2_005C1D50
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx edx, byte ptr [eax+edi]22_2_005EAD40
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [esi], cl22_2_005D9572
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax-23806A32h]22_2_005CED61
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [edx], al22_2_005B1505
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov byte ptr [edx], al22_2_005B1505
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov esi, eax22_2_005AB5E0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx ebp, byte ptr [esp+ecx+02h]22_2_005CB610
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx ecx, byte ptr [esp+eax-0Eh]22_2_005C3EEB
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then mov edx, dword ptr [005F8F2Ch]22_2_005B2EB2
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx esi, byte ptr [esp+ecx-69FBEFB4h]22_2_005ECF71
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 4x nop then movzx ebx, byte ptr [edx]22_2_005E27D0

                        Networking

                        barindex
                        Suricata IDS alerts for network traffic
                        Source: Network trafficSuricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49721 -> 104.21.48.1:443
                        Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49721 -> 104.21.48.1:443
                        Source: Network trafficSuricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49723 -> 104.21.48.1:443
                        C2 URLs / IPs found in malware configuration
                        Source: Malware configuration extractorURLs: agriework.life
                        Source: Malware configuration extractorURLs: explorebieology.run
                        Source: Malware configuration extractorURLs: moderzysics.top
                        Source: Malware configuration extractorURLs: seedsxouts.shop
                        Source: Malware configuration extractorURLs: codxefusion.top
                        Source: Malware configuration extractorURLs: farfinable.top
                        Source: Malware configuration extractorURLs: techspherxe.top
                        Source: Joe Sandbox ViewIP Address: 104.21.48.1 104.21.48.1
                        Source: Joe Sandbox ViewIP Address: 104.21.48.1 104.21.48.1
                        Source: Joe Sandbox ViewIP Address: 149.154.167.99 149.154.167.99
                        Source: Joe Sandbox ViewIP Address: 149.154.167.99 149.154.167.99
                        Source: Joe Sandbox ViewASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
                        Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
                        Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49721 -> 104.21.48.1:443
                        Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49719 -> 149.154.167.99:443
                        Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49723 -> 104.21.48.1:443
                        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
                        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
                        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
                        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
                        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
                        Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
                        Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
                        Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
                        Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
                        Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
                        Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
                        Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
                        Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.254
                        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
                        Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
                        Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.27
                        Source: unknownTCP traffic detected without corresponding DNS query: 52.113.196.254
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C5B70 recv,22_2_005C5B70
                        Source: global trafficHTTP traffic detected: GET /hyukonyas HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
                        Source: global trafficHTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJahywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4BSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                        Source: global trafficHTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                        Source: global trafficHTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJahywEInP7MAQiFoM0BCL7VzgEIgNbOAQjI3M4BCIrgzgEIruTOAQiL5c4BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                        Source: global trafficHTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                        Source: global trafficHTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: */*X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEI0qDKAQig4coBCJahywEInP7MAQiFoM0BSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56*.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27*.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
                        Source: global trafficDNS traffic detected: DNS query: c.pki.goog
                        Source: global trafficDNS traffic detected: DNS query: t.me
                        Source: global trafficDNS traffic detected: DNS query: 10.74.0.0.in-addr.arpa
                        Source: global trafficDNS traffic detected: DNS query: agriework.life
                        Source: global trafficDNS traffic detected: DNS query: www.google.com
                        Source: global trafficDNS traffic detected: DNS query: apis.google.com
                        Source: global trafficDNS traffic detected: DNS query: play.google.com
                        Source: unknownHTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: agriework.life
                        Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenDate: Fri, 07 Mar 2025 19:54:52 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeX-Frame-Options: SAMEORIGINReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=13qo4%2F2%2BbaTZszN6UXddFFCdU35wQvHRq6cmyWq0FT0LsgFVSApWDUobUEvFho1DQuNe5UIilXdiwK0j%2BqD%2Fy4vRraQ8iEdVfIdtzZuSh5ab3QteKBo7ZW5SFf6fU52ToQ%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 91cca5aed94b2421-IAD
                        Source: core.exe, 0000000A.00000000.1520505451.000000000130F000.00000002.00000001.01000000.0000000D.sdmp, core.exe, 0000000A.00000002.1751981175.000000000130F000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: ftp://.mode
                        Source: svchost.exe, 0000001B.00000002.2429698786.000001F218249000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://Passport.NET/tbpose
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://bugreports.qt.io/
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://bugreports.qt.io/Microsoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogicRocket_q_recei
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://ccsca2021.ocsp-certum.com05
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctnca.crl0k
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F217293000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.ver)
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0
                        Source: svchost.exe, 0000001B.00000002.2425190256.000001F217224000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2429042451.000001F217B7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811437835.000001F217B54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811512009.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811689256.000001F217B0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
                        Source: svchost.exe, 0000001B.00000002.2428156646.000001F217B13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdpuu86i
                        Source: svchost.exe, 0000001B.00000003.1811342570.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811437835.000001F217B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdty
                        Source: svchost.exe, 0000001B.00000002.2425190256.000001F217224000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2429042451.000001F217B7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811437835.000001F217B54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811512009.000001F217B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
                        Source: svchost.exe, 0000001B.00000002.2428156646.000001F217B13000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd/12yv
                        Source: svchost.exe, 0000001B.00000002.2428294929.000001F217B37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd/oas
                        Source: svchost.exe, 0000001B.00000003.1811342570.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811437835.000001F217B54000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd=
                        Source: svchost.exe, 0000001B.00000003.1778374759.000001F217B52000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://docs.oasis-open.org/wss/2004/XX/oasis-2004XX-wss-saml-token-profile-1.0#SAMLAssertionID
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37018000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvYjFkQUFWdmlaXy12MHFU
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37018000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome/acosgr5ufcefr7w7nv4v6k4ebdda_117.0.5938.132/117.0.5
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37018000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaa5khuklrahrby256zitbxd5wq_1.0.2512.1/n
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37018000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/acaxuysrwzdnwqutaimsxybnjbrq_2023.9.25.0/
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37018000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adhioj45hzjkfunn7ccrbqyyhu3q_20230916.567
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37018000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/adqyi2uk2bd7epzsrzisajjiqe_9.48.0/gcmjkmg
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD3704D000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/dix4vjifjljmfobl3a7lhcpvw4_414/lmelglejhe
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37091000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2437576505.000000001C312000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: http://fontawesome.iohttp://fontawesome.io/license/Webfont
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001B01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://forums.myd
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001B01000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://forums.mydigitallife.info/forums/51-KMS-tools
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_Error
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://ocsp.digicert.com0I
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://ocsp.digicert.com0P
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://ocsp.thawte.com0
                        Source: svchost.exe, 0000001B.00000002.2426709500.000001F2172B2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://passport.net/tb
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://qt-project.org/xml/features/report-start-end-entity
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://qt-project.org/xml/features/report-whitespace-only-CharData
                        Source: chrome.exe, 0000001C.00000002.2441269309.000001E5C3D87000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: http://redirector.gvt1.com/edgedl/chromewebstore/L2Nocm9tZV9leHRlbnNpb24vYmxvYnMvNzI0QUFXNV9zT2RvdUw
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ccsca2021.cer0
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctnca.cer09
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctnca2.cer09
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://repository.certum.pl/ctsca2021.cer0A
                        Source: svchost.exe, 0000001B.00000003.1811689256.000001F217B0E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.mi
                        Source: svchost.exe, 0000001B.00000002.2427454600.000001F217313000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.microsoft.c
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
                        Source: svchost.exe, 0000001B.00000002.2428294929.000001F217B37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
                        Source: svchost.exe, 0000001B.00000002.2425190256.000001F217224000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policy
                        Source: svchost.exe, 0000001B.00000002.2428294929.000001F217B37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2004/09/policyt
                        Source: svchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
                        Source: svchost.exe, 0000001B.00000002.2428294929.000001F217B37000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scnect
                        Source: svchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/scom
                        Source: svchost.exe, 0000001B.00000002.2428294929.000001F217B37000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
                        Source: svchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
                        Source: core.exe, 0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2429037018.00000000033D1000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com01
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com02
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://subca.ocsp-certum.com05
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://trolltech.com/xml/features/report-start-end-entity
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://trolltech.com/xml/features/report-whitespace-only-CharData
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
                        Source: svchost.exe, 00000003.00000002.1377405484.00000297D5613000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.bingmapsportal.com
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.carterandcone.coml
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: http://www.certum.pl/CPS0
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2437576505.000000001C312000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: http://www.devcomponents.com
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2437576505.000000001C312000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: http://www.devcomponents.com/dotnetbar/order.html
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2437576505.000000001C312000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: http://www.devcomponents.comAmailto:support
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2437576505.000000001C312000.00000002.00000001.01000000.0000001F.sdmpString found in binary or memory: http://www.devcomponents.comKSystem.Windows.Forms.ContextMenuStrip
                        Source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.fonts.com
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
                        Source: KMSpico.tmp, KMSpico.tmp, 0000000C.00000002.2420505019.0000000000401000.00000020.00000001.01000000.0000000A.sdmpString found in binary or memory: http://www.innosetup.com/
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
                        Source: KMSpico.exe, KMSpico.exe, 00000009.00000002.2420493718.0000000000401000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
                        Source: KMSpico.exe, 00000009.00000002.2420493718.0000000000401000.00000020.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.openssl.org/support/faq.html
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.phreedom.org/md5)
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.phreedom.org/md5)08:27
                        Source: KMSpico.exe, 00000009.00000003.1479031039.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000009.00000003.1489660631.0000000001F58000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, KMSpico.tmp, 0000000C.00000002.2420505019.0000000000401000.00000020.00000001.01000000.0000000A.sdmpString found in binary or memory: http://www.remobjects.com/ps
                        Source: KMSpico.exe, 00000009.00000003.1479031039.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000009.00000003.1489660631.0000000001F58000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2420505019.0000000000401000.00000020.00000001.01000000.0000000A.sdmpString found in binary or memory: http://www.remobjects.com/psU
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sajatypeworks.com
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.sakkal.com
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.tiro.com
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.typography.netD
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.urwpp.deDPlease
                        Source: KMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.zhongyicts.com.cn
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://xml.org/sax/features/namespace-prefixes
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://xml.org/sax/features/namespaces
                        Source: core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: http://xml.org/sax/features/namespaceshttp://xml.org/sax/features/namespace-prefixeshttp://trolltech
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/InlineSignup.aspx?iww=1&id=80502
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/Wizard/Password/Change?id=80601
                        Source: svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
                        Source: svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80600ssuer
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80601
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80603
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80604
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/inlinesignup.aspx?iww=1&id=80605
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://account.live.com/msangcwam
                        Source: chrome.exe, 0000001C.00000002.2459591072.0000619400730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com
                        Source: chrome.exe, 0000001C.00000002.2459591072.0000619400730000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://accounts.google.com:443
                        Source: chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://apis.google.com
                        Source: chrome.exe, 0000001C.00000002.2447605453.000001E5C65A7000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
                        Source: core.exe, 0000000A.00000002.1751981175.000000000130F000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://bugreports.qt-project.org.
                        Source: core.exe, 0000000A.00000000.1520505451.000000000130F000.00000002.00000001.01000000.0000000D.sdmp, core.exe, 0000000A.00000002.1751981175.000000000130F000.00000002.00000001.01000000.0000000D.sdmpString found in binary or memory: https://bugreports.qt-project.org.The
                        Source: chrome.exe, 0000001C.00000002.2462565743.0000619400E24000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000002.2467021735.000061940187C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chrome.google.com/webstore?hl=en
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
                        Source: chrome.exe, 0000001C.00000002.2441269309.000001E5C3D87000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod
                        Source: chrome.exe, 0000001C.00000002.2465100035.00006194013AC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1
                        Source: chrome.exe, 0000001C.00000002.2465100035.00006194013AC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/gws/cdt1Cross-Origin-Opener-Policy:
                        Source: chrome.exe, 0000001C.00000002.2465100035.00006194013AC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://csp.withgoogle.com/csp/report-to/gws/cdt1
                        Source: svchost.exe, 00000003.00000002.1377611554.00000297D5659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
                        Source: svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377760032.00000297D5670000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1375469554.00000297D5641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377541627.00000297D5642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1375180791.00000297D565A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1373477349.00000297D566E000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
                        Source: svchost.exe, 00000003.00000002.1377760032.00000297D5670000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1373477349.00000297D566E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
                        Source: svchost.exe, 00000003.00000003.1374124657.00000297D5667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377733971.00000297D5668000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
                        Source: svchost.exe, 00000003.00000002.1377795516.00000297D5677000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1373003184.00000297D5675000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
                        Source: svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1375180791.00000297D565A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377485618.00000297D562B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
                        Source: svchost.exe, 00000003.00000003.1374124657.00000297D5667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377733971.00000297D5668000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377485618.00000297D562B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
                        Source: svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377485618.00000297D562B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
                        Source: svchost.exe, 00000003.00000003.1375469554.00000297D5641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377541627.00000297D5642000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
                        Source: svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2K
                        Source: svchost.exe, 00000003.00000003.1375566197.00000297D5631000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
                        Source: svchost.exe, 00000003.00000002.1377541627.00000297D5642000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
                        Source: svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
                        Source: svchost.exe, 00000003.00000003.1375469554.00000297D5641000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377541627.00000297D5642000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
                        Source: svchost.exe, 00000003.00000003.1374124657.00000297D5667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377733971.00000297D5668000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377485618.00000297D562B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
                        Source: chrome.exe, 0000001C.00000003.1851843607.0000619401680000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://fonts.google.com/icons?selected=Material
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD370C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37056000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/Prod.C:
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD370C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD370A3000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1204028372.000001AD370F4000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1204028372.000001AD370E8000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1204028372.000001AD37107000.00000004.00000800.00020000.00000000.sdmp, svchost.exe, 00000002.00000003.1204028372.000001AD370C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2.C:
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD370C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://g.live.com/odclientsettings/ProdV2?OneDriveUpdate=f359a5df14f97b6802371976c96
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gemini.google.com/glic/intro?20
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://gemini.google.com/glic2
                        Source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-net
                        Source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-netJ
                        Source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://github.com/mgravell/protobuf-neti
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://goto.google.com/sme-bugs2e
                        Source: KMSpico.exe, 00000000.00000000.1179537100.0000000000B71000.00000020.00000001.01000000.00000003.sdmpString found in binary or memory: https://jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupU
                        Source: chrome.exe, 0000001C.00000002.2462219317.0000619400D7C000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1882403211.00006194017A8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://keep.google.com/u/0/?usp=chrome_actions#NEWNOTE
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ApproveSession.srfe
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80502
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80600
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExists.srf?uiflavor=4&id=80601
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/IfExistsiflavoamp;
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ListSessions.srf
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageApprover.srfe.com
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ManageLoginKeys.srf
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2426709500.000001F2172BC000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2426958808.000001F2172CB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/RST2.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/didtou.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getrealminfo.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/getuserrealm.srf
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsec
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceAssociate.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceDisassociate.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceQuery.srf
                        Source: svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/DeviceUpdate.srf$
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/EnumerateDevices.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetAppData.srfrfrf6085fid=cpsrf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/GetUserKeyData.srf
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineClientAuth.srf
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80600
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80601
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80603
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineConnect.srf?id=80604
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777289727.000001F217B6B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srf
                        Source: svchost.exe, 0000001B.00000003.1776614553.000001F217B2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineDesktop.srfm
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80502
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80600
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80601Issuer
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80603
                        Source: svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80604
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80605
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80606
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80607
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777145366.000001F217B57000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlineLogin.srf?id=80608
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776792767.000001F217B5A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp
                        Source: svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/ResolveUser.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/SHA1Auth.srf%
                        Source: svchost.exe, 0000001B.00000003.1776755196.000001F217B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceaddcredential.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/devicechangecredential.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/ppsecure/deviceremovecredential.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/resetpw.srf.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/retention.srfce
                        Source: svchost.exe, 0000001B.00000002.2427183809.000001F2172F1000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.live.com:443/RST2.srf
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srf
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/MSARST2.srff
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceAssociate.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf
                        Source: svchost.exe, 0000001B.00000003.1776755196.000001F217B10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceDisassociate.srf:CLSID
                        Source: svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsuer
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/DeviceUpdate.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/EnumerateDevices.srf
                        Source: svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/ResolveUser.srfsuer
                        Source: svchost.exe, 0000001B.00000003.1776755196.000001F217B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srf
                        Source: svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/devicechangecredential.srf
                        Source: svchost.exe, 0000001B.00000003.1776755196.000001F217B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srf
                        Source: svchost.exe, 0000001B.00000003.1776755196.000001F217B10000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfRE
                        Source: chrome.exe, 0000001C.00000002.2460579220.0000619400A04000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/chat/
                        Source: chrome.exe, 0000001C.00000002.2467021735.000061940187C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/chat/download?usp=chrome_default
                        Source: chrome.exe, 0000001C.00000002.2467021735.000061940187C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://mail.google.com/chat/download?usp=chrome_defaultfault
                        Source: chrome.exe, 0000001C.00000002.2461851598.0000619400C90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacy
                        Source: chrome.exe, 0000001C.00000002.2461851598.0000619400C90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhone
                        Source: chrome.exe, 0000001C.00000003.1832676656.00006190004C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/shielded-email?utm_source=chrome2B
                        Source: chrome.exe, 0000001C.00000002.2461851598.0000619400C90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePW
                        Source: chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ogads-pa.googleapis.com
                        Source: chrome.exe, 0000001C.00000002.2462950747.0000619400F68000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ogs.google.com
                        Source: chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
                        Source: chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://ogs.google.com/widget/callout?eom=1
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD370C2000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Installers/23.194.0917.0001/amd64/OneDriveSetup.exe
                        Source: svchost.exe, 00000002.00000003.1204028372.000001AD37056000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://oneclient.sfx.ms/Win/Prod/21.220.1024.0005/OneDriveSetup.exe.C:
                        Source: chrome.exe, 0000001C.00000002.2464523317.00006194012C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
                        Source: chrome.exe, 0000001C.00000002.2464523317.00006194012C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
                        Source: chrome.exe, 0000001C.00000002.2464523317.00006194012C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049402&target=OPTIMIZATION_TARGET_GEO
                        Source: chrome.exe, 0000001C.00000002.2464523317.00006194012C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695051229&target=OPTIMIZATION_TARGET_PAG
                        Source: chrome.exe, 0000001C.00000002.2467618064.0000619401984000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1739894676&target=OPTIMIZATION_TARGET_CLI
                        Source: chrome.exe, 0000001C.00000002.2464523317.00006194012C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
                        Source: chrome.exe, 0000001C.00000002.2464523317.00006194012C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=4&target=OPTIMIZATION_TARGET_PAGE_TOPICS_
                        Source: chrome.exe, 0000001C.00000002.2441269309.000001E5C3D87000.00000004.10000000.00040000.00000000.sdmp, chrome.exe, 0000001C.00000002.2447605453.000001E5C65A7000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/log?format=json&hasfast=true
                        Source: chrome.exe, 0000001C.00000002.2441269309.000001E5C3D87000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/log?format=json&hasfast=true(
                        Source: chrome.exe, 0000001C.00000002.2447605453.000001E5C65A7000.00000004.10000000.00040000.00000000.sdmpString found in binary or memory: https://play.google.com/log?format=json&hasfast=truesyncdata.v1.AsyncDataService/GetAsyncData
                        Source: chrome.exe, 0000001C.00000002.2455661507.0000619400094000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyA2KlwBX3mkFo30om9LU
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://shieldedids-pa.googleapis.comb
                        Source: svchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B2C000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://signup.live.com/signup.aspx
                        Source: chrome.exe, 0000001C.00000002.2462219317.0000619400D7C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://sites.google.com/u/0/create?usp=chrome_actions
                        Source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/11564914/23354;
                        Source: core.exe, 0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/14436606/23354
                        Source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://stackoverflow.com/q/2152978/23354
                        Source: MSBuild.exe, 00000016.00000002.2420262984.000000000056A000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://t.me/hyukonyX
                        Source: svchost.exe, 00000003.00000003.1375469554.00000297D5641000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
                        Source: svchost.exe, 00000003.00000003.1375223996.00000297D564A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
                        Source: svchost.exe, 00000003.00000003.1375364704.00000297D5649000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377541627.00000297D5642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1375223996.00000297D564A000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
                        Source: svchost.exe, 00000003.00000002.1377485618.00000297D562B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
                        Source: svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
                        Source: svchost.exe, 00000003.00000002.1377611554.00000297D5659000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
                        Source: KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://www.certum.pl/CPS0
                        Source: chrome.exe, 0000001C.00000002.2441269309.000001E5C3D87000.00000004.10000000.00040000.00000000.sdmp, chrome.exe, 0000001C.00000002.2456301006.0000619400128000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/
                        Source: chrome.exe, 0000001C.00000002.2467021735.000061940187C000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/async/newtab_promos
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
                        Source: chrome.exe, 0000001C.00000002.2461851598.0000619400C90000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/chrome/tips/
                        Source: chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/search
                        Source: chrome.exe, 0000001C.00000003.1832676656.00006190004C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager
                        Source: chrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
                        Source: chrome.exe, 0000001C.00000003.1832676656.00006190004C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/shieldedids.managerForcedOn_PlusAddressAndroidOpenGmsCoreManagementP
                        Source: chrome.exe, 0000001C.00000003.1832676656.00006190004C8000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/auth/shieldedids.managerPlusAddressOfferCreationIfPasswordFieldIsNotVisib
                        Source: chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.WcyoQrvsWY0.2019.O/rt=j/m=q_dnp
                        Source: chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.L8bgMGq1rcI.L.W.O/m=qmd
                        Source: KMSpico.exe, 00000000.00000003.1185152035.000000007F1BB000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000000.00000003.1182879766.0000000003680000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000001.00000000.1186718304.0000000000311000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.innosetup.com/
                        Source: KMSpico.exe, 00000000.00000003.1185152035.000000007F1BB000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000000.00000003.1182879766.0000000003680000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000001.00000000.1186718304.0000000000311000.00000020.00000001.01000000.00000004.sdmpString found in binary or memory: https://www.remobjects.com/ps
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49708 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49721
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49736 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49736
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49735
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49709 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49671 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49749 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49721 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49709
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49708
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49749
                        Source: unknownNetwork traffic detected: HTTP traffic on port 49735 -> 443
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
                        Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
                        Source: unknownHTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49719 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49721 version: TLS 1.2
                        Source: unknownHTTPS traffic detected: 104.21.48.1:443 -> 192.168.2.4:49723 version: TLS 1.2
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E05C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,22_2_005E05C0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E05C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowRect,GlobalUnlock,CloseClipboard,22_2_005E05C0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E11ED GetDC,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetCurrentObject,GetObjectW,DeleteObject,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,SelectObject,DeleteDC,ReleaseDC,DeleteObject,22_2_005E11ED
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\is-3PNU6.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\is-JTF8S.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\OpenVPN.cer (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\certELDI.pfx (copy)Jump to dropped file
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C39C0 CreateDesktopW,22_2_005C39C0
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB1E8B NtAllocateVirtualMemory,10_2_03AB1E8B
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB1EDE NtFreeVirtualMemory,10_2_03AB1EDE
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB1F1C NtProtectVirtualMemory,10_2_03AB1F1C
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C16E50 NtProtectVirtualMemory,10_2_07C16E50
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C1A8C0 NtResumeThread,10_2_07C1A8C0
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C16E48 NtProtectVirtualMemory,10_2_07C16E48
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C1A8B9 NtResumeThread,10_2_07C1A8B9
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0042F520 NtdllDefWindowProc_A,12_2_0042F520
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00423B84 NtdllDefWindowProc_A,12_2_00423B84
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004125D8 NtdllDefWindowProc_A,12_2_004125D8
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00478E54 NtdllDefWindowProc_A,12_2_00478E54
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00457594 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,12_2_00457594
                        Source: C:\Program Files\KMSpico\UninsHs.exeCode function: 15_2_00401000 BeginPaint,GetStockObject,SelectObject,Rectangle,MoveToEx,LineTo,MoveToEx,LineTo,CreatePen,SelectObject,DeleteObject,MoveToEx,LineTo,MoveToEx,LineTo,SelectObject,DeleteObject,LoadBitmapA,SelectObject,ExitProcess,DeleteDC,DeleteObject,wsprintfA,SelectObject,SetBkColor,DrawTextA,SelectObject,SetBkColor,DrawTextA,LoadIconA,DrawIcon,LoadIconA,DrawIcon,LoadIconA,DrawIcon,GetSysColor,SetBkColor,DrawTextA,DrawTextA,DrawTextA,GetSysColor,SetBkColor,DrawTextA,GetSysColor,SetBkColor,DrawTextA,SelectObject,CreateFontA,CreateWindowExA,SendMessageA,CreateWindowExA,SendMessageA,CreateWindowExA,SendMessageA,CreateFontA,CreateWindowExA,SendMessageA,SetFocus,CreateWindowExA,SendMessageA,SetFocus,CreateWindowExA,SendMessageA,SetFocus,SetTimer,SendMessageA,GetClientRect,ShowWindow,ShowWindow,ShowWindow,ShowWindow,InvalidateRect,lstrcpy,wsprintfA,lstrcpy,ShowWindow,ShowWindow,ShowWindow,wsprintfA,WinExec,ShowWindow,wsprintfA,GetStartupInfoA,InvalidateRect,CloseHandle,EnableWindow,SetWindowTextA,InvalidateRect,ShowWindow,WinExec,InvalidateRect,SendMessageA,SetFocus,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,EnableWindow,GetClientRect,InvalidateRect,DeleteObject,DeleteObject,KillTimer,PostQuitMessage,NtdllDefWindowProc_A,15_2_00401000
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0042E934: CreateFileA,DeviceIoControl,GetLastError,CloseHandle,SetLastError,12_2_0042E934
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,9_2_00409448
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,12_2_004555E4
                        Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Windows\system32\is-PDNCG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Windows\system32\is-GL5NT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile deleted: C:\Windows\System32\Vestris.ResourceLib.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_0040840C9_2_0040840C
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB048110_2_03AB0481
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB000010_2_03AB0000
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A320C010_2_06A320C0
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A3F2A010_2_06A3F2A0
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A31A7710_2_06A31A77
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A3222510_2_06A32225
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A320AF10_2_06A320AF
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A3B3E910_2_06A3B3E9
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A3B3F810_2_06A3B3F8
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A3B98810_2_06A3B988
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C0F96010_2_07C0F960
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C0E37810_2_07C0E378
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07BF000610_2_07BF0006
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07BF004010_2_07BF0040
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C139D810_2_07C139D8
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C139C810_2_07C139C8
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004707F812_2_004707F8
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00480DD312_2_00480DD3
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004673A412_2_004673A4
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0043035C12_2_0043035C
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0048E36012_2_0048E360
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004444C812_2_004444C8
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004345C412_2_004345C4
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00444A7012_2_00444A70
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00430EE812_2_00430EE8
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00486FAC12_2_00486FAC
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0045F0C412_2_0045F0C4
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0044516812_2_00445168
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0045B17412_2_0045B174
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004352C812_2_004352C8
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0046942012_2_00469420
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0044557412_2_00445574
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004519BC12_2_004519BC
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0043DD5012_2_0043DD50
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00487F0C12_2_00487F0C
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D67249320_2_00007FFC3D672493
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D674E8F20_2_00007FFC3D674E8F
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D68077020_2_00007FFC3D680770
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D68076020_2_00007FFC3D680760
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D6C890820_2_00007FFC3D6C8908
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D67534D20_2_00007FFC3D67534D
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D670FF820_2_00007FFC3D670FF8
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D670FD120_2_00007FFC3D670FD1
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D68078820_2_00007FFC3D680788
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D68076820_2_00007FFC3D680768
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D68074020_2_00007FFC3D680740
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D67F11020_2_00007FFC3D67F110
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D671AF020_2_00007FFC3D671AF0
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D83062920_2_00007FFC3D830629
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D973A1F20_2_00007FFC3D973A1F
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D988CB520_2_00007FFC3D988CB5
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D9824EC20_2_00007FFC3D9824EC
                        Source: C:\Program Files\KMSpico\KMSELDI.exeCode function: 20_2_00007FFC3D9777BC20_2_00007FFC3D9777BC
                        Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 21_2_00007FFC3D69159821_2_00007FFC3D691598
                        Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 21_2_00007FFC3D69AD7E21_2_00007FFC3D69AD7E
                        Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 21_2_00007FFC3D69BA4021_2_00007FFC3D69BA40
                        Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 21_2_00007FFC3D69A2D221_2_00007FFC3D69A2D2
                        Source: C:\Program Files\KMSpico\AutoPico.exeCode function: 21_2_00007FFC3D6992F621_2_00007FFC3D6992F6
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C580022_2_005C5800
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BE0A322_2_005BE0A3
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EF1C022_2_005EF1C0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BC28122_2_005BC281
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E9AA022_2_005E9AA0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C5B7022_2_005C5B70
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005ABB9022_2_005ABB90
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BB47022_2_005BB470
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BE4EE22_2_005BE4EE
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005AED5022_2_005AED50
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C652022_2_005C6520
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EBDCB22_2_005EBDCB
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E5ED022_2_005E5ED0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EA05022_2_005EA050
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A104022_2_005A1040
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005ED84022_2_005ED840
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005CA01022_2_005CA010
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005CB03022_2_005CB030
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D502022_2_005D5020
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C20CA22_2_005C20CA
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005ED8C022_2_005ED8C0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BE0F322_2_005BE0F3
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C00E722_2_005C00E7
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005CE0E022_2_005CE0E0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005CE89022_2_005CE890
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005AC88022_2_005AC880
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EE8B022_2_005EE8B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D196022_2_005D1960
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C010022_2_005C0100
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005B812022_2_005B8120
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D11F822_2_005D11F8
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D098022_2_005D0980
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D118022_2_005D1180
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005CA9B022_2_005CA9B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C425922_2_005C4259
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E527022_2_005E5270
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E320A22_2_005E320A
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C623022_2_005C6230
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005B72CB22_2_005B72CB
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A8AF022_2_005A8AF0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E02F022_2_005E02F0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D32ED22_2_005D32ED
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005AA2B022_2_005AA2B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EE2B022_2_005EE2B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C4B4022_2_005C4B40
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A2B3022_2_005A2B30
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E5B3022_2_005E5B30
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005B33D222_2_005B33D2
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E7B8F22_2_005E7B8F
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005DA38222_2_005DA382
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D9BA322_2_005D9BA3
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BC28122_2_005BC281
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C7C3022_2_005C7C30
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E6C3022_2_005E6C30
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D942822_2_005D9428
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EB4D622_2_005EB4D6
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C54D022_2_005C54D0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E54D022_2_005E54D0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D4CC722_2_005D4CC7
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A94E022_2_005A94E0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D949122_2_005D9491
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EA49022_2_005EA490
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005AF48022_2_005AF480
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C94B022_2_005C94B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EDCB022_2_005EDCB0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005AC55022_2_005AC550
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C1D5022_2_005C1D50
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D0D4022_2_005D0D40
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005ED57022_2_005ED570
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D957222_2_005D9572
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A356022_2_005A3560
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005CED6122_2_005CED61
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005B3D0022_2_005B3D00
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005B150522_2_005B1505
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EED3022_2_005EED30
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005DB52D22_2_005DB52D
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005C25C022_2_005C25C0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005ACDF022_2_005ACDF0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005DDDF022_2_005DDDF0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005AB5E022_2_005AB5E0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D7DE122_2_005D7DE1
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D058922_2_005D0589
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005B0DB022_2_005B0DB0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D7E5422_2_005D7E54
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D364922_2_005D3649
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BDE7C22_2_005BDE7C
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A7E1022_2_005A7E10
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D2E3822_2_005D2E38
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E76D022_2_005E76D0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005DA6E022_2_005DA6E0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E3EAD22_2_005E3EAD
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E475922_2_005E4759
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D3F5022_2_005D3F50
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005DBF5022_2_005DBF50
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005E6F5022_2_005E6F50
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005BDE7C22_2_005BDE7C
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A8F6022_2_005A8F60
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005EC70C22_2_005EC70C
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A3F0022_2_005A3F00
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D772022_2_005D7720
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D1FC022_2_005D1FC0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005DFFF022_2_005DFFF0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A47E222_2_005A47E2
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005A6FE622_2_005A6FE6
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005ED7B022_2_005ED7B0
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: 22_2_005D1FA022_2_005D1FA0
                        Source: Joe Sandbox ViewDropped File: C:\Program Files\KMSpico\AutoPico.exe (copy) 4A714D98CE40F5F3577C306A66CB4A6B1FF3FD01047C7F4581F8558F0BCDF5FA
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 005BB460 appears 112 times
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeCode function: String function: 005AB2D0 appears 51 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00408C0C appears 45 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00406AC4 appears 43 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 0040595C appears 117 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00457F1C appears 77 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00403400 appears 60 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00445DD4 appears 45 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00457D10 appears 105 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 004344DC appears 32 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 004078F4 appears 43 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00403494 appears 83 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00403684 appears 226 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 00453344 appears 98 times
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: String function: 004460A4 appears 59 times
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 208 -p 7324 -ip 7324
                        Source: KMSpico.tmp.0.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                        Source: is-5DNJH.tmp.1.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                        Source: KMSpico.tmp.9.drStatic PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
                        Source: KMSpico.tmp.9.drStatic PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
                        Source: KMSpico.tmp.9.drStatic PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped
                        Source: KMSpico.exeStatic PE information: Number of sections : 11 > 10
                        Source: is-5DNJH.tmp.1.drStatic PE information: Number of sections : 11 > 10
                        Source: KMSpico.tmp.0.drStatic PE information: Number of sections : 11 > 10
                        Source: KMSpico.exe, 00000000.00000000.1179686095.0000000000C29000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFileName vs KMSpico.exe
                        Source: KMSpico.exe, 00000000.00000003.1182879766.00000000039C3000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs KMSpico.exe
                        Source: KMSpico.exe, 00000000.00000003.1185152035.000000007F4DF000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFileName vs KMSpico.exe
                        Source: KMSpico.exe, 00000009.00000003.1479031039.00000000021E0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs KMSpico.exe
                        Source: KMSpico.exe, 00000009.00000003.1489660631.0000000001F58000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenameshfolder.dll~/ vs KMSpico.exe
                        Source: KMSpico.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, ITaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask'
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, TaskFolder.csTask registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, Task.csTask registration methods: 'RegisterChanges', 'CreateTask'
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, TaskService.csTask registration methods: 'CreateFromToken'
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, TaskSecurity.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, TaskSecurity.csSecurity API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, TaskFolder.csSecurity API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, TaskPrincipal.csSecurity API names: System.Security.Principal.WindowsIdentity.GetCurrent()
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, Task.csSecurity API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, User.csSecurity API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
                        Source: core.exe, 0000000A.00000000.1520505451.000000000158B000.00000002.00000001.01000000.0000000D.sdmpBinary or memory string: nna.nosciencehu.comtadaoka.osaka.jphayakawa.yamanashi.jpdnsalias.orgedu.saedu.sbedu.rsedu.sclib.id.usogori.fukuoka.jpnotogawa.shiga.jpedu.sdrepbody.aeroid.auedu.ruk12.nj.usloyalist.museumedu.rwedu.sgxyzmoka.tochigi.jpdynathome.netkimino.wakayama.jpedu.slnissanveterinaire.kmkokubunji.tokyo.jpedu.snos.hordaland.notm.kmartsandcrafts.museumis-a-musician.com*.kitakyushu.jpiitate.fukushima.jpedu.stav.iturayasu.chiba.jpedu.svflorida.museumninjaedu.synemuro.hokkaido.jpedu.tjs
                        Source: classification engineClassification label: mal86.phis.troj.spyw.evad.winEXE@63/803@10/8
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,9_2_00409448
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,12_2_004555E4
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00455E0C GetModuleHandleA,GetProcAddress,GetDiskFreeSpaceExA,GetDiskFreeSpaceA,12_2_00455E0C
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB0B91 CreateToolhelp32Snapshot,Thread32First,Wow64SuspendThread,CloseHandle,CloseHandle,10_2_03AB0B91
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0046E13C GetVersion,CoCreateInstance,12_2_0046E13C
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00409C34 FindResourceA,SizeofResource,LoadResource,LockResource,9_2_00409C34
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpicoJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyAppJump to behavior
                        Source: C:\Program Files\KMSpico\AutoPico.exeMutant created: NULL
                        Source: C:\Windows\System32\conhost.exeMutant created: \BaseNamedObjects\Local\SM0:5400:120:WilError_03
                        Source: C:\Windows\System32\WerFault.exeMutant created: \BaseNamedObjects\Local\WERReportingForProcess7324
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5096:120:WilError_03
                        Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:576:120:WilError_03
                        Source: C:\Users\user\Desktop\KMSpico.exeFile created: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmpJump to behavior
                        Source: C:\Users\user\Desktop\KMSpico.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                        Source: C:\Users\user\Desktop\KMSpico.exeKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpKey opened: HKEY_CURRENT_USER\Software\Borland\Delphi\LocalesJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile read: C:\Users\user\Desktop\desktop.iniJump to behavior
                        Source: C:\Users\user\Desktop\KMSpico.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganizationJump to behavior
                        Source: chrome.exe, 0000001C.00000002.2462565743.0000619400E24000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000002.2466987581.0000619401860000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT COUNT(DISTINCT CAST((event_timestamp / 1000000 / 60 / 10) AS int)) FROM metrics WHERE metrics.metric_hash = 'AD411B741D0DA012' AND metrics.metric_value > 0;
                        Source: chrome.exe, 0000001C.00000002.2466987581.0000619401860000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: SELECT COUNT(DISTINCT CAST((event_timestamp / 1000000 / 60 / 10) AS int)) FROM metrics WHERE metrics.metric_hash = 'B4CFE8741404B691' AND metrics.metric_value > 0;
                        Source: KMSpico.exeVirustotal: Detection: 30%
                        Source: KMSpico.exeReversingLabs: Detection: 21%
                        Source: KMSpico.exeString found in binary or memory: need to be updated. /RESTARTAPPLICATIONS Instructs Setup to restart applications. /NORESTARTAPPLICATIONS Prevents Setup from restarting applications. /LOADINF="filename" Instructs Setup to load the settings from the specified file after having checked t
                        Source: C:\Users\user\Desktop\KMSpico.exeFile read: C:\Users\user\Desktop\KMSpico.exeJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeEvasive API call chain: GetCommandLine,DecisionNodes,ExitProcessgraph_15-632
                        Source: unknownProcess created: C:\Users\user\Desktop\KMSpico.exe "C:\Users\user\Desktop\KMSpico.exe"
                        Source: C:\Users\user\Desktop\KMSpico.exeProcess created: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmp "C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmp" /SL5="$1043A,33390065,844800,C:\Users\user\Desktop\KMSpico.exe"
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                        Source: unknownProcess created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
                        Source: unknownProcess created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe"
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\core.exe "C:\Users\user\AppData\Roaming\MyApp\core.exe"
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeProcess created: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp "C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp" /SL5="$804D8,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe"
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess created: C:\Program Files\KMSpico\UninsHs.exe "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess created: C:\Program Files\KMSpico\KMSELDI.exe "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup
                        Source: unknownProcess created: C:\Program Files\KMSpico\AutoPico.exe "C:\Program Files\KMSpico\AutoPico.exe" /silent
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 208 -p 7324 -ip 7324
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7324 -s 1624
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2352,i,6786114277741485719,16467073181160997757,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1920 /prefetch:3
                        Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                        Source: C:\Users\user\Desktop\KMSpico.exeProcess created: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmp "C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmp" /SL5="$1043A,33390065,844800,C:\Users\user\Desktop\KMSpico.exe" Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\core.exe "C:\Users\user\AppData\Roaming\MyApp\core.exe"Jump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenableJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeProcess created: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp "C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp" /SL5="$804D8,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" Jump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess created: C:\Program Files\KMSpico\UninsHs.exe "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess created: C:\Program Files\KMSpico\KMSELDI.exe "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backupJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /FJump to behavior
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 208 -p 7324 -ip 7324
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7324 -s 1624
                        Source: C:\Windows\System32\WerFault.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2352,i,6786114277741485719,16467073181160997757,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=1920 /prefetch:3
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
                        Source: C:\Users\user\Desktop\KMSpico.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\Desktop\KMSpico.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: mpr.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: winhttp.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: wtsapi32.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: winsta.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: shfolder.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: rstrtmgr.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: textshaping.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: textinputframework.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: coreuicomponents.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: coremessaging.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: dwmapi.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: explorerframe.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: sfc.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: sfc_os.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: propsys.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: edputil.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: urlmon.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: iertutil.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: srvcli.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: netutils.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: windows.staterepositoryps.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: appresolver.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: bcp47langs.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: slc.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: sppc.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: onecorecommonproxystub.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpSection loaded: apphelp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: qmgr.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: bitsperf.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: firewallapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: esent.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: fwbase.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: bitsigd.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: upnp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ssdpapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wsmauto.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: miutils.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wsmsvc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dsrole.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: pcwum.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wkscli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: webio.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: execmodelclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: coremessaging.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: twinapi.appcore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: resourcepolicyclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: samcli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: samlib.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: es.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: bitsproxy.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mpr.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: moshost.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mapsbtsvc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mosstorage.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ztrace_maps.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: bcp47langs.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mapconfiguration.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: aphostservice.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: networkhelper.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: userdataplatformhelperutil.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: syncutil.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mccspal.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: vaultcli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dmcfgutils.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wintypes.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dmcmnutils.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dmxmlhelputils.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: inproclogger.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: flightsettings.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: windows.networking.connectivity.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: msv1_0.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntlmshared.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptdll.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: synccontroller.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: pimstore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: aphostclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: accountaccessor.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: dsclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: systemeventsbrokerclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: userdatalanguageutil.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: mccsengineshared.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: pimstore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cemapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: userdatatypehelperutil.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: phoneutil.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: execmodelproxy.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: rmclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: storsvc.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: fltlib.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: bcd.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wer.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: cabinet.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: appxdeploymentclient.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: storageusage.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Windows\System32\svchost.exeSection loaded: propsys.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: iphlpapi.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: mpr.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: d3d9.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: dwmapi.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: mscoree.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: cryptsp.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: rsaenh.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: cryptbase.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: amsi.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: msasn1.dllJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeSection loaded: gpapi.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: apphelp.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: mpr.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: version.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: kernel.appcore.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: textinputframework.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: coreuicomponents.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: coremessaging.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: ntmarta.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: coremessaging.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: wintypes.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: windows.storage.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: wldp.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: profapi.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: shfolder.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: rstrtmgr.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: ncrypt.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: ntasn1.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: textshaping.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: riched20.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: usp10.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: msls31.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: sspicli.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: explorerframe.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: sfc.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: sfc_os.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: propsys.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: linkinfo.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: ntshrui.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: srvcli.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpSection loaded: cscapi.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Windows\System32\cmd.exeSection loaded: cmdext.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: apphelp.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: acgenral.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: uxtheme.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: winmm.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: samcli.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: msacm32.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: version.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: userenv.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: dwmapi.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: urlmon.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: mpr.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: sspicli.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: winmmbase.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: winmmbase.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: iertutil.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: srvcli.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: netutils.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: aclayers.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: sfc.dllJump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeSection loaded: sfc_os.dllJump to behavior
                        Source: C:\Windows\System32\schtasks.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\System32\schtasks.exeSection loaded: taskschd.dll
                        Source: C:\Windows\System32\schtasks.exeSection loaded: sspicli.dll
                        Source: C:\Windows\System32\schtasks.exeSection loaded: xmllite.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: mscoree.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: apphelp.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: kernel.appcore.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: version.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: uxtheme.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: windows.storage.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wldp.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: profapi.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: cryptsp.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: rsaenh.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: cryptbase.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: dwmapi.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: windowscodecs.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: dwrite.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: riched20.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: usp10.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: msls31.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: textshaping.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wbemcomn.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: mswsock.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: iphlpapi.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: napinsp.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: pnrpnsp.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wshbth.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: nlaapi.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: dnsapi.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: winrnr.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: rasadhlp.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: textinputframework.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: coreuicomponents.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: coremessaging.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: ntmarta.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: coremessaging.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wintypes.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wintypes.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: wintypes.dll
                        Source: C:\Program Files\KMSpico\KMSELDI.exeSection loaded: sxs.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: mscoree.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: apphelp.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: kernel.appcore.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: version.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: vcruntime140_clr0400.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: ucrtbase_clr0400.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: windows.storage.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: wldp.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: wbemcomn.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: mswsock.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: profapi.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: cryptsp.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: rsaenh.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: cryptbase.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: iphlpapi.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: dnsapi.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: winnsi.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: amsi.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: userenv.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: rasadhlp.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: fwpuclnt.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: napinsp.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: pnrpnsp.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: wshbth.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: nlaapi.dll
                        Source: C:\Program Files\KMSpico\AutoPico.exeSection loaded: winrnr.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: wldp.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: winhttp.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: webio.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: mswsock.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: winnsi.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: sspicli.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: schannel.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: msasn1.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: gpapi.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: dpapi.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: uxtheme.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: wbemcomn.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: amsi.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: userenv.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: profapi.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: version.dll
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wersvc.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: windowsperformancerecordercontrol.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: weretw.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: xmllite.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: faultrep.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: dbghelp.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: dbgcore.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wer.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wlidsvc.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptsp.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: clipc.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: dpapi.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: rsaenh.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptbase.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: windows.storage.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msxml6.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msasn1.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: winhttp.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: netprofm.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: iphlpapi.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: policymanager.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msvcp110_win.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: gamestreamingext.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: msauserext.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: tbs.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptngc.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: npmproxy.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: ondemandconnroutehelper.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc6.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: dhcpcsvc.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: webio.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: mswsock.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: winnsi.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: dnsapi.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: rasadhlp.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: fwpuclnt.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: schannel.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: mskeyprotect.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: gpapi.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: cryptnet.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: ncryptsslp.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: elscore.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: elstrans.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: ngcsvc.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: authz.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: ncrypt.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: sspicli.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: netutils.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: powrprof.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntmarta.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: ntasn1.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: umpdc.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: usermgrcli.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: wtsapi32.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: winsta.dll
                        Source: C:\Windows\System32\svchost.exeSection loaded: tbs.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: mpclient.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: secur32.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: sspicli.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: version.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: msasn1.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: kernel.appcore.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: userenv.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: gpapi.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: wbemcomn.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: amsi.dll
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeSection loaded: profapi.dll
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}\InProcServer32Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOwnerJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpWindow found: window name: TWizardFormJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: I accept the agreement
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpAutomated click: Next >
                        Source: C:\Program Files\KMSpico\KMSELDI.exeAutomated click: Continue
                        Source: Window RecorderWindow detected: More than 3 window changes detected
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dllJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpicoJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\certJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\AccessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ExcelJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\GrooveJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPathJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNoteJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OutlookJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPointJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlusJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PublisherJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasicsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\StandardJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\VisioJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\WordJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\AccessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ExcelJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPathJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\LyncJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNoteJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OutlookJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPointJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlusJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PublisherJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\StandardJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\WordJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\AccessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ExcelJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\MondoJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNoteJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OutlookJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPointJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlusJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PublisherJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusinessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\StandardJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioProJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStdJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\WordJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\CoreJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EducationJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseSJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\ProfessionalJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessNJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\EmbeddedJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\ProfessionalJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreNJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguageJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseNJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalNJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMCJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguageJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustryJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EnterpriseJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMCJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenterJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandardJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driverJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\iconsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scriptsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\soundsJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\unins000.datJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-8OFR2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-HC31N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-9V6LA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-2EIIF.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-E64V7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-QBUB1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\is-ACNAA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-SFUS1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-KQ1UT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-F0C0D.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-MUB89.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-8KGGS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-HE023.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-EGVND.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-QOVU5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-02ID6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-LFDQI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-CAQ8M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-SEH7L.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-N77RL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-12JU1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-3GV12.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-VJ84H.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-4VLR4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-MG369.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-5VQ19.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-MDOOI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-O8OU9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-RJ2H1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-HL5U2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-I00BG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-7BRBS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-SOT02.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-DDI06.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-OP392.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-UOAUM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-D1FP3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-N684C.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-J0B10.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-SQF5E.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-6GO5S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-KKIRC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-49473.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-FUV2T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-N11K7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-0239V.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-HVSJ2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-KJNDQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-C6JLP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-ITN8T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-U010M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-OLGGU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-QK00D.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-NHV4T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-52RFN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-HQKB0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-3FGDO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-JG3UO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-ONH3S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-SAKEP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-49KRL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-40DB5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-JK04T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-VJ031.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-44HBP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-E77IS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-GETUJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-U8Q2E.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-PSC3U.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-CF9IM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-IIL0M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-V7ERR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-F0RDS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-A8QRB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-NP2UT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-4SAHU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-AFJNA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-8DPHI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-J0MH0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-GFERF.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-MVLI1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-AR0E4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-NADIO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-MP937.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-0DRJO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-PECTO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-2GJ3T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-JL87T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-BQ8M8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-5Q516.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-V6T86.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-I1ISA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-L6LN8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-ESTD7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-TJB7B.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-5RT75.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-75VOH.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-4EVAJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-AG3D5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-TAV37.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-7CLVQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-JKEM1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-K6H9C.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-N59V8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-RI7MS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-E4G0A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-KJ3FM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-J4UTU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-IJIBE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-5LEE5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-029NU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-QO4M4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-56FF9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-SU1OA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-0MITQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-6UTIG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-9E2O4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-NRKBI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-D7B12.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-H5THQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-T07VO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-SD98L.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-J8P5F.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-4E06R.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-HC13S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-TK24A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-KCTIP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-CGUOA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-DH469.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-I857A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-TDFKN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-8J610.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-0O9CM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-0J3EC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-7ERR1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-EICFK.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-9SP0S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-GUUA8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-QC1PG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-L186V.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-UMPGI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-0ADVO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-FRI7S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\is-104TP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-6MTDH.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-KI77H.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-UTD1S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-T2PUO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-52HDG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-RV1ED.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-V1V78.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-7J08N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-L1AA8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-98SL4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-QQ0RP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-D08EC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-4BJ1G.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-5V7GD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-GVJ77.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-CCGMF.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-V9QL1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-S6591.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-C7UL9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-B5QRP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-9L2AI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-1OJRN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-0EGLN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-5T2D1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-88BBR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-LVHP7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-58PSA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-J9ID0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-6J56M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-BE46A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-DJC0P.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-N9RID.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-BSRCO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-VISRO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-37NUT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-BHA81.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-R93JS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-9E068.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-MBBME.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-AISCJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-2DBLN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-GSB6J.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-O7GB3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-JONIS.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-277G4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-87PHG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-0Q84K.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-4OV1K.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-53V4O.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-9CBFN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-6GCEQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-EN9JH.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-U8SPD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\is-02BU1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-NOBPD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-K3NNE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-LCQNR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-ITMD6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-DU7O4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-569G1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-AIHDP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-4HT1T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-P0J2N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-O7KK2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-5K5D0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-EBEKV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-BEFKV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-36QEA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-CFLB7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-UDSJ3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-LUCEK.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-4BTTG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-44827.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-A70T1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-AE3JD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-F7PKD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-7GQFN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-F747I.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-5ROB2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-RGLPO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-83DLG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-3E3RE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-87L1C.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-RBU8A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-J9KP9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-UTNLC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-AF963.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-6KOER.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-0I34R.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-G0O65.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-9H7CT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-GFPG1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-JEQ5T.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-JN4IG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-6A3DL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-4RS2N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-58NE8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-JN8J5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-1QG41.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\is-JFMHJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-HK2JJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-JK2KT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-55TFP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-LKGRD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-9LRFN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-UO9OG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-CQMKM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-4DQIU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-PA80B.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-G6JIL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-MIVQG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-SU0UT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\is-HS278.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-MEQC5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-PUKCU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-NO4Q3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-LT6A5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-S831N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-Q64RO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-1EGJ7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-9G0IR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-80343.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-9MKQN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-9EED2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-IHRF1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-BF6O3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-U6P1J.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-4OTUC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-SMDGG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-51MMC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-T4LC3.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-A8AHR.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-S47CV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-S5UBO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-FSQPV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-LJ16A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-J21U7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-AFHOV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-NA5F0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-6R6EF.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-55C1V.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-AVJIO.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-TUQIU.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-RRCH2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-CHOQ0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-H1R1S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-GM6HG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-9098S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-BPDC1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-GEQ32.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-CVQQE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-UVC4K.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-0EF1Q.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-83372.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-SJC1H.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-IQK73.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-1LH95.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-8RFIL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-TTFUG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-61670.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-U93JN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-Q64UJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-0LRD4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-JT2F4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-LTVNB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\is-5ORNJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-6E0D5.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-HTQU6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-GONDM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-RS4UE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-U9C2A.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-OG96V.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-142KJ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-9RG7R.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-RE4KB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-HJ4G7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-2ODDN.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-4AHSI.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-DV7F1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-IONKK.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-J45US.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-EF8PC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\is-DF724.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-G5N31.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-65AHQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-G14F1.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-CS91B.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-TSMU4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-33NK8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-JDB28.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-N544E.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-T70SL.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-SSLNV.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-DFVBQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-S6U76.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-RAA9D.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-1F7IM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-OI6OE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-TKA9B.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-ERA33.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-3PNU6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-JTF8S.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-IL6EK.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\driver\is-9TESG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-BO7O6.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-1JLHT.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-2VPUP.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\icons\is-TVKSB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-VJS2F.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-3SAS9.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\logs\is-VQJ5J.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-N5RTD.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-2JC2O.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-3MR4N.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-AN5IQ.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-SFTEE.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-BSF2Q.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-I1IS0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-1M7Q4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-AD2I4.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-1MAGC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-T656R.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\scripts\is-G4HJC.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-5CPVA.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-BSVT7.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-RQHU0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-C0PQ8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-9SE0M.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-PLQV2.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-N7BE8.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-EQKEG.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-71QL0.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-TKVFM.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-62SOB.tmpJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDirectory created: C:\Program Files\KMSpico\sounds\is-1QGJT.tmpJump to behavior
                        Source: C:\Program Files\KMSpico\KMSELDI.exeDirectory created: C:\Program Files\KMSpico\logs\KMSELDI.log
                        Source: C:\Program Files\KMSpico\AutoPico.exeDirectory created: C:\Program Files\KMSpico\logs\AutoPico.log
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpRegistry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1Jump to behavior
                        Source: KMSpico.exeStatic file information: File size 34357573 > 1048576
                        Source: KMSpico.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
                        Source: Binary string: \??\C:\Windows\dll\System.pdb source: AutoPico.exe, 00000015.00000002.1843773332.000000001A736000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Windows\System.pdbpdbtem.pdb source: AutoPico.exe, 00000015.00000002.1843773332.000000001A736000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: core.exe, 0000000A.00000002.1785751625.000000000599B000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.0000000005A13000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1793293890.0000000007C40000.00000004.08000000.00040000.00000000.sdmp
                        Source: Binary string: c:\divert-master\install\WDDK\i386\WinDivert.pdb source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmp
                        Source: Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: core.exe, 0000000A.00000002.1785751625.000000000599B000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.0000000005A13000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1793293890.0000000007C40000.00000004.08000000.00040000.00000000.sdmp
                        Source: Binary string: pC:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000015.00000002.1835822285.0000000000EF4000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdbH source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmp
                        Source: Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbp source: AutoPico.exe, 00000015.00000002.1835922426.0000000000F90000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: \??\C:\Program Files\KMSpico\AutoPico.PDBo: source: AutoPico.exe, 00000015.00000002.1843773332.000000001A744000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: protobuf-net.pdbSHA256}Lq source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmp
                        Source: Binary string: indoC:\Windows\System.pdb source: AutoPico.exe, 00000015.00000002.1835822285.0000000000EF4000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: AutoPico.PDB source: AutoPico.exe, 00000015.00000002.1835822285.0000000000EF4000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: protobuf-net.pdb source: core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmp
                        Source: Binary string: c:\Users\dblock\Source\CodePlex\resourcelib\trunk\Source\ResourceLib\obj\Release\Vestris.ResourceLib.pdb source: KMSpico.tmp, 0000000C.00000002.2428044215.000000000688F000.00000004.00001000.00020000.00000000.sdmp
                        Source: Binary string: m.pdb source: KMSELDI.exe, 00000014.00000002.2447174010.000000001DEDA000.00000004.00000020.00020000.00000000.sdmp
                        Source: Binary string: C:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000015.00000002.1835822285.0000000000EF4000.00000004.00000010.00020000.00000000.sdmp
                        Source: Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdb source: KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmp

                        Data Obfuscation

                        barindex
                        .NET source code contains potential unpacker
                        Source: 10.2.core.exe.6cd0000.8.raw.unpack, TransactionDictionary.cs.Net Code: MapRemoteDictionary System.AppDomain.Load(byte[])
                        Source: 10.2.core.exe.55d64c8.6.raw.unpack, TypeModel.cs.Net Code: TryDeserializeList
                        Source: 10.2.core.exe.55d64c8.6.raw.unpack, ListDecorator.cs.Net Code: Read
                        Source: 10.2.core.exe.55d64c8.6.raw.unpack, TypeSerializer.cs.Net Code: CreateInstance
                        Source: 10.2.core.exe.55d64c8.6.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateInstance
                        Source: 10.2.core.exe.55d64c8.6.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateIfNull
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, ReflectionHelper.cs.Net Code: InvokeMethod
                        Source: 10.2.core.exe.5a13790.2.raw.unpack, XmlSerializationHelper.cs.Net Code: ReadObjectProperties
                        Source: 10.2.core.exe.55864a8.4.raw.unpack, TypeModel.cs.Net Code: TryDeserializeList
                        Source: 10.2.core.exe.55864a8.4.raw.unpack, ListDecorator.cs.Net Code: Read
                        Source: 10.2.core.exe.55864a8.4.raw.unpack, TypeSerializer.cs.Net Code: CreateInstance
                        Source: 10.2.core.exe.55864a8.4.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateInstance
                        Source: 10.2.core.exe.55864a8.4.raw.unpack, TypeSerializer.cs.Net Code: EmitCreateIfNull
                        Yara detected Costura Assembly Loader
                        Source: Yara matchFile source: 10.2.core.exe.74f0000.11.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.core.exe.589bf64.1.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.core.exe.589bf64.1.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 10.2.core.exe.74f0000.11.raw.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000A.00000002.1792883577.00000000074F0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.1785751625.0000000005801000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: core.exe PID: 8112, type: MEMORYSTR
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,12_2_004502C0
                        Source: KMSpico.exeStatic PE information: section name: .didata
                        Source: KMSpico.tmp.0.drStatic PE information: section name: .didata
                        Source: is-5DNJH.tmp.1.drStatic PE information: section name: .didata
                        Source: is-AKF7M.tmp.1.drStatic PE information: section name: .qtmetad
                        Source: is-AKF7M.tmp.1.drStatic PE information: section name: _RDATA
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_004065C8 push 00406605h; ret 9_2_004065FD
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_004040B5 push eax; ret 9_2_004040F1
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00408104 push ecx; mov dword ptr [esp], eax9_2_00408109
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00404185 push 00404391h; ret 9_2_00404389
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00404206 push 00404391h; ret 9_2_00404389
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_0040C218 push eax; ret 9_2_0040C219
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_004042E8 push 00404391h; ret 9_2_00404389
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00404283 push 00404391h; ret 9_2_00404389
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00408F38 push 00408F6Bh; ret 9_2_00408F63
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB30F3 push 2F672291h; retf 10_2_03AB313A
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A30461 push es; ret 10_2_06A30470
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_06A311DF push es; ret 10_2_06A311E0
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_07C13688 push ebx; iretd 10_2_07C136DA
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00484364 push 00484472h; ret 12_2_0048446A
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0040994C push 00409989h; ret 12_2_00409981
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004062B4 push ecx; mov dword ptr [esp], eax12_2_004062B5
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004104E0 push ecx; mov dword ptr [esp], edx12_2_004104E5
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00412928 push 0041298Bh; ret 12_2_00412983
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0049AD30 pushad ; retf 12_2_0049AD3F
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0040CE38 push ecx; mov dword ptr [esp], edx12_2_0040CE3A
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004951EC push ecx; mov dword ptr [esp], ecx12_2_004951F1
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004592D0 push 00459314h; ret 12_2_0045930C
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0040F398 push ecx; mov dword ptr [esp], edx12_2_0040F39A
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00443440 push ecx; mov dword ptr [esp], ecx12_2_00443444
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0040546D push eax; ret 12_2_004054A9
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0040553D push 00405749h; ret 12_2_00405741
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004055BE push 00405749h; ret 12_2_00405741
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0040563B push 00405749h; ret 12_2_00405741
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004056A0 push 00405749h; ret 12_2_00405741
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004517F8 push 0045182Bh; ret 12_2_00451823
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004519BC push ecx; mov dword ptr [esp], eax12_2_004519C1
                        Source: 10.2.core.exe.6eb0000.9.raw.unpack, k3UpbcYXuQR9G2ObtJk.csHigh entropy of concatenated method names: 'Iy5YuXF2NC', 'VdDYRwuhWm', 'GAuYIjpn55', 'Y0eYHRj7fi', 'NmbY137gUg', 'TdxYOuI6YV', 'pYxYqtZeba', 'gWmYrbDU5n', 'sCDYLoEy16', 'tITYN5RhoL'
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Windows\System32\is-PDNCG.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\Vestris.ResourceLib.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\is-5DNJH.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\KMSELDI.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\UninsHs.exe (copy)Jump to dropped file
                        Source: C:\Users\user\Desktop\KMSpico.exeFile created: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-ACNAA.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\is-N1R5V.tmp\_isetup\_shfoldr.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\tap-windows-9.21.0.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-HC31N.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\is-AKF7M.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Windows\system32\Vestris.ResourceLib.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeFile created: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-E64V7.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-9V6LA.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\unins000.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-8OFR2.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\driver\is-IL6EK.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\unins000.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-QBUB1.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\is-N1R5V.tmp\_isetup\_setup64.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\is-2EIIF.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\data\is-1H3AB.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\is-2DCLQ.tmp\_isetup\_setup64.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\AutoPico.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Roaming\MyApp\core.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Program Files\KMSpico\Service_KMS.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Windows\System32\is-GL5NT.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Windows\system32\Vestris.ResourceLib.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Windows\System32\is-PDNCG.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Windows\System32\is-GL5NT.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\Users\user\AppData\Local\Temp\Setup Log 2025-03-07 #001.txtJump to behavior

                        Boot Survival

                        barindex
                        Uses schtasks.exe or at.exe to add and modify task schedules
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpicoJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\KMSpico.lnkJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\Log KMSpico.lnkJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\AutoPico.lnkJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\KMSpico\Uninstall KMSpico.lnkJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0042285C SendMessageA,ShowWindow,ShowWindow,CallWindowProcA,SendMessageA,ShowWindow,SetWindowPos,GetActiveWindow,IsIconic,SetWindowPos,SetActiveWindow,ShowWindow,12_2_0042285C
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,12_2_00423C0C
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00423C0C IsIconic,PostMessageA,PostMessageA,PostMessageA,SendMessageA,IsWindowEnabled,IsWindowEnabled,IsWindowVisible,GetFocus,SetFocus,SetFocus,IsIconic,GetFocus,SetFocus,12_2_00423C0C
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004241DC IsIconic,SetActiveWindow,SetFocus,12_2_004241DC
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00424194 IsIconic,SetActiveWindow,12_2_00424194
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00418384 IsIconic,GetWindowPlacement,GetWindowRect,GetWindowLongA,GetWindowLongA,ScreenToClient,ScreenToClient,12_2_00418384
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00417598 IsIconic,GetCapture,12_2_00417598
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00417CCE IsIconic,SetWindowPos,12_2_00417CCE
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00417CD0 IsIconic,SetWindowPos,GetWindowPlacement,SetWindowPlacement,12_2_00417CD0
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00483D18 IsIconic,GetWindowLongA,ShowWindow,ShowWindow,12_2_00483D18
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0041F118 GetVersion,SetErrorMode,LoadLibraryA,SetErrorMode,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,12_2_0041F118
                        Source: C:\Users\user\Desktop\KMSpico.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\KMSELDI.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Windows\System32\WerFault.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeProcess information set: NOOPENFILEERRORBOX

                        Malware Analysis System Evasion

                        barindex
                        Yara detected AntiVM3
                        Source: Yara matchFile source: Process Memory Space: core.exe PID: 8112, type: MEMORYSTR
                        Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
                        Source: core.exe, 0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: SBIEDLL.DLL
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory allocated: 42C0000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory allocated: 44D0000 memory reserve | memory write watchJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory allocated: 4310000 memory reserve | memory write watchJump to behavior
                        Source: C:\Program Files\KMSpico\KMSELDI.exeMemory allocated: 1560000 memory reserve | memory write watch
                        Source: C:\Program Files\KMSpico\KMSELDI.exeMemory allocated: 1B3D0000 memory reserve | memory write watch
                        Source: C:\Program Files\KMSpico\AutoPico.exeMemory allocated: 12D0000 memory reserve | memory write watch
                        Source: C:\Program Files\KMSpico\AutoPico.exeMemory allocated: 19B00000 memory reserve | memory write watch
                        Source: C:\Windows\System32\svchost.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}Jump to behavior
                        Source: C:\Program Files\KMSpico\UninsHs.exeDecision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)graph_15-805
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Windows\system32\Vestris.ResourceLib.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Windows\System32\is-PDNCG.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\Vestris.ResourceLib.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\unins000.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\is-9V6LA.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\is-8OFR2.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\driver\is-IL6EK.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MyApp\unins000.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\is-QBUB1.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-N1R5V.tmp\_isetup\_setup64.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Roaming\MyApp\is-5DNJH.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\is-2EIIF.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-2DCLQ.tmp\_isetup\_setup64.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\is-N1R5V.tmp\_isetup\_shfoldr.dllJump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\Service_KMS.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Program Files\KMSpico\driver\tap-windows-9.21.0.exe (copy)Jump to dropped file
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpDropped PE file which has not been started: C:\Windows\System32\is-GL5NT.tmpJump to dropped file
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeEvasive API call chain: GetSystemTime,DecisionNodesgraph_9-5975
                        Source: C:\Program Files\KMSpico\UninsHs.exeAPI coverage: 5.3 %
                        Source: C:\Windows\System32\svchost.exe TID: 7412Thread sleep time: -30000s >= -30000sJump to behavior
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe TID: 8040Thread sleep time: -90000s >= -30000s
                        Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0Jump to behavior
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeWMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                        Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\Windows\System32 FullSizeInformationJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00452A60 FindFirstFileA,GetLastError,12_2_00452A60
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0047531C FindFirstFileA,FindNextFileA,FindClose,12_2_0047531C
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,12_2_00464158
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004985E4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,12_2_004985E4
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00462750 FindFirstFileA,FindNextFileA,FindClose,12_2_00462750
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,12_2_00463CDC
                        Source: C:\Program Files\KMSpico\UninsHs.exeCode function: 15_2_00401C98 FindFirstFileA,MessageBoxA,RtlZeroMemory,7696D0A0,15_2_00401C98
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00409B78 GetSystemInfo,VirtualQuery,VirtualProtect,VirtualProtect,VirtualQuery,9_2_00409B78
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001BDC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Data Exchange Service0
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001BDC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: -Hyper-V Remote Desktop Virtualization Service0
                        Source: svchost.exe, 00000007.00000002.2424881037.000001C82C07F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: svchost.exe, 00000007.00000002.2424692795.000001C82C053000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000g
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001BDC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Shutdown Service0
                        Source: svchost.exe, 00000002.00000002.2431431460.000001AD36E54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000002.00000002.2427038426.000001AD3182B000.00000004.00000020.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2434881207.000000001BD55000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000016.00000002.2423235909.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, MSBuild.exe, 00000016.00000002.2423235909.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425683303.000001F217293000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                        Source: AutoPico.exe, 00000015.00000002.1843773332.000000001A6C0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll&
                        Source: svchost.exe, 00000007.00000002.2424692795.000001C82C053000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000D
                        Source: core.exe, 0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Microsoft|VMWare|Virtual
                        Source: svchost.exe, 00000007.00000002.2425479577.000001C82C102000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: svchost.exe, 0000001B.00000002.2425190256.000001F217224000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW`
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001BDC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: !Hyper-V PowerShell Direct Service0
                        Source: svchost.exe, 00000007.00000002.2424692795.000001C82C053000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: chrome.exe, 0000001C.00000002.2442845778.000001E5C562D000.00000004.00000020.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1876145787.000001E5C5624000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Time4896% Total Run Time4898% Hypervisor Run Time4900% Guest Run Time4902% Idle Time4904Total Interrupts/sec4788Hyper-V Hypervisor4790Logical Processors4792Partitions4794Total Pages4796Virtual Processors4798Monitored Notifications4800Modern Standby Entries4802Platform Idle Transitions4804HypervisorStartupCost4906Hyper-V Hypervisor Root Partition4908Virtual Processors4Q
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicshutdown
                        Source: svchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: NXTVMWare
                        Source: core.exe, 0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware|VIRTUAL|A M I|Xen
                        Source: KMSpico.tmp, 0000000C.00000002.2423118540.00000000006E0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\ou
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001BDC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $Hyper-V Time Synchronization Service0
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicvss
                        Source: svchost.exe, 00000007.00000002.2423617365.000001C82C002000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
                        Source: svchost.exe, 00000007.00000002.2424692795.000001C82C053000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001BDC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Guest Service Interface0
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001BDC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: Hyper-V Heartbeat Service0
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001BDC000.00000004.00000800.00020000.00000000.sdmp, AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: $Hyper-V Volume Shadow Copy Requestor0
                        Source: svchost.exe, 00000007.00000002.2424280532.000001C82C02B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: @\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
                        Source: svchost.exe, 00000007.00000002.2424280532.000001C82C042000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
                        Source: core.exe, 0000000A.00000000.1520883334.00000000017E6000.00000008.00000001.01000000.0000000D.sdmp, core.exe, 0000000A.00000002.1752995544.00000000017FB000.00000008.00000001.01000000.0000000D.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
                        Source: AutoPico.exe, 00000015.00000002.1840347879.0000000001B9C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: vmicheartbeat
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeAPI call chain: ExitProcess graph end nodegraph_9-6772
                        Source: C:\Program Files\KMSpico\UninsHs.exeAPI call chain: ExitProcess graph end nodegraph_15-727
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeAPI call chain: ExitProcess graph end node
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess information queried: ProcessInformationJump to behavior
                        Source: C:\Windows\System32\sppsvc.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Windows\System32\sppsvc.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Windows\System32\sppsvc.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Windows\System32\sppsvc.exeProcess queried: DebugPortJump to behavior
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess queried: DebugPort
                        Source: C:\Program Files\KMSpico\AutoPico.exeProcess queried: DebugPort
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB1DAD LdrLoadDll,10_2_03AB1DAD
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004502C0 GetVersion,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,12_2_004502C0
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB0481 mov edx, dword ptr fs:[00000030h]10_2_03AB0481
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB0A41 mov eax, dword ptr fs:[00000030h]10_2_03AB0A41
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB1091 mov eax, dword ptr fs:[00000030h]10_2_03AB1091
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB1090 mov eax, dword ptr fs:[00000030h]10_2_03AB1090
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB0DF1 mov eax, dword ptr fs:[00000030h]10_2_03AB0DF1
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeCode function: 10_2_03AB1A7F mov eax, dword ptr fs:[00000030h]10_2_03AB1A7F
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess token adjusted: DebugJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess token adjusted: DebugJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory allocated: page read and write | page guardJump to behavior

                        HIPS / PFW / Operating System Protection Evasion

                        barindex
                        Injects a PE file into a foreign processes
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 5A0000 value starts with: 4D5AJump to behavior
                        Writes to foreign memory regions
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 5A0000Jump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 5A1000Jump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 5F1000Jump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 5F4000Jump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 601000Jump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 20F008Jump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_00478898 ShellExecuteEx,GetLastError,MsgWaitForMultipleObjects,GetExitCodeProcess,CloseHandle,12_2_00478898
                        Source: C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmpProcess created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" Jump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeProcess created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"Jump to behavior
                        Source: C:\Windows\System32\cmd.exeProcess created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /FJump to behavior
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 208 -p 7324 -ip 7324
                        Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7324 -s 1624
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0042E09C AllocateAndInitializeSid,GetVersion,GetModuleHandleA,GetProcAddress,CheckTokenMembership,GetCurrentThread,OpenThreadToken,GetLastError,GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,GetTokenInformation,EqualSid,CloseHandle,FreeSid,12_2_0042E09C
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: GetLocaleInfoA,9_2_0040520C
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: GetLocaleInfoA,9_2_00405258
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: GetLocaleInfoA,12_2_00408568
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: GetLocaleInfoA,12_2_004085B4
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                        Source: C:\Windows\System32\svchost.exeQueries volume information: C: VolumeInformationJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformationJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Windows\System32\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Program Files\KMSpico\KMSELDI.exe VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Candaral.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\DUBAI-REGULAR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\DUBAI-MEDIUM.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\DUBAI-LIGHT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\DUBAI-BOLD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\flat_officeFontsPreview.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OFFSYM.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OFFSYMSL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OFFSYMSB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OFFSYMXL.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OFFSYML.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\OFFSYMB.TTF VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
                        Source: C:\Program Files\KMSpico\KMSELDI.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
                        Source: C:\Program Files\KMSpico\AutoPico.exeQueries volume information: C:\Program Files\KMSpico\AutoPico.exe VolumeInformation
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeQueries volume information: C:\ VolumeInformation
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_004585C8 GetTickCount,QueryPerformanceCounter,GetSystemTimeAsFileTime,GetCurrentProcessId,CreateNamedPipeA,GetLastError,CreateFileA,SetNamedPipeHandleState,CreateProcessA,CloseHandle,CloseHandle,12_2_004585C8
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_004026C4 GetSystemTime,9_2_004026C4
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpCode function: 12_2_0045559C GetUserNameA,12_2_0045559C
                        Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exeCode function: 9_2_00405CF4 GetVersionExA,9_2_00405CF4
                        Source: C:\Users\user\AppData\Roaming\MyApp\core.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                        Lowering of HIPS / PFW / Operating System Security Settings

                        barindex
                        Changes security center settings (notifications, updates, antivirus, firewall)
                        Source: C:\Windows\System32\svchost.exeKey value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cvalJump to behavior
                        Disables the Smart Screen filter
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System EnableSmartScreenJump to behavior
                        Source: C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmpRegistry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer SmartScreenEnabled OffJump to behavior
                        Source: svchost.exe, 00000008.00000002.2426271930.0000014FEB902000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
                        Source: svchost.exe, 00000008.00000002.2426271930.0000014FEB902000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
                        Source: C:\Windows\System32\svchost.exeWMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
                        Source: C:\Program Files\Windows Defender\MpCmdRun.exeWMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

                        Stealing of Sensitive Information

                        barindex
                        Yara detected LummaC Stealer
                        Source: Yara matchFile source: 22.2.MSBuild.exe.5a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: sslproxydump.pcap, type: PCAP
                        Found many strings related to Crypto-Wallets (likely being stolen)
                        Source: MSBuild.exe, 00000016.00000002.2423235909.00000000007FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Wallets/Electrum-LTC
                        Source: MSBuild.exe, 00000016.00000002.2423235909.00000000007FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Wallets/ElectronCash
                        Source: MSBuild.exe, 00000016.00000002.2423235909.00000000007E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Jaxx Liberty
                        Source: MSBuild.exe, 00000016.00000002.2423235909.00000000007FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: window-state.json
                        Source: MSBuild.exe, 00000016.00000002.2423235909.00000000007CC000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: %appdata%\Exodus\exodus.wallet
                        Source: MSBuild.exe, 00000016.00000002.2423235909.00000000007E2000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: ExodusWeb3
                        Source: MSBuild.exe, 00000016.00000002.2423235909.00000000007FB000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: Wallets/Ethereum
                        Source: MSBuild.exe, 00000016.00000002.2423235909.00000000007D7000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
                        Source: core.exe, 0000000A.00000002.1788464655.0000000006EB0000.00000004.08000000.00040000.00000000.sdmpString found in binary or memory: set_UseMachineKeyStore
                        Tries to harvest and steal browser information (history, passwords, etc)
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj
                        Tries to steal Crypto Currency Wallets
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\Ledger Live
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\Binance
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\Electrum\wallets
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeFile opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB
                        Source: Yara matchFile source: 00000016.00000002.2423235909.00000000007FB000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: Process Memory Space: MSBuild.exe PID: 8008, type: MEMORYSTR

                        Remote Access Functionality

                        barindex
                        Attempt to bypass Chrome Application-Bound Encryption
                        Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223
                        Yara detected LummaC Stealer
                        Source: Yara matchFile source: 22.2.MSBuild.exe.5a0000.0.unpack, type: UNPACKEDPE
                        Source: Yara matchFile source: 0000000A.00000002.1785751625.0000000005ADA000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
                        Source: Yara matchFile source: sslproxydump.pcap, type: PCAP

                        Mitre Att&ck Matrix

                        ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                        Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                        Windows Management Instrumentation                        		1
                        DLL Side-Loading                        		1
                        Exploitation for Privilege Escalation                        		21
                        Disable or Modify Tools                        		1
                        OS Credential Dumping                        		1
                        System Time Discovery                        		Remote Services11
                        Archive Collected Data                        		4
                        Ingress Tool Transfer                        		Exfiltration Over Other Network Medium1
                        System Shutdown/Reboot
                        CredentialsDomainsDefault Accounts21
                        Native API                        		1
                        Create Account                        		1
                        DLL Side-Loading                        		1
                        Deobfuscate/Decode Files or Information                        		LSASS Memory1
                        Account Discovery                        		Remote Desktop Protocol1
                        Browser Session Hijacking                        		21
                        Encrypted Channel                        		Exfiltration Over BluetoothNetwork Denial of Service
                        Email AddressesDNS ServerDomain Accounts3
                        Command and Scripting Interpreter                        		2
                        Windows Service                        		1
                        Access Token Manipulation                        		3
                        Obfuscated Files or Information                        		Security Account Manager2
                        File and Directory Discovery                        		SMB/Windows Admin Shares3
                        Data from Local System                        		1
                        Remote Access Software                        		Automated ExfiltrationData Encrypted for Impact
                        Employee NamesVirtual Private ServerLocal Accounts11
                        Scheduled Task/Job                        		11
                        Scheduled Task/Job                        		2
                        Windows Service                        		1
                        Software Packing                        		NTDS47
                        System Information Discovery                        		Distributed Component Object Model1
                        Screen Capture                        		4
                        Non-Application Layer Protocol                        		Traffic DuplicationData Destruction
                        Gather Victim Network InformationServerCloud Accounts1
                        Service Execution                        		1
                        Registry Run Keys / Startup Folder                        		212
                        Process Injection                        		1
                        DLL Side-Loading                        		LSA Secrets251
                        Security Software Discovery                        		SSH2
                        Clipboard Data                        		15
                        Application Layer Protocol                        		Scheduled TransferData Encrypted for Impact
                        Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC Scripts11
                        Scheduled Task/Job                        		1
                        File Deletion                        		Cached Domain Credentials5
                        Virtualization/Sandbox Evasion                        		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                        DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup Items1
                        Registry Run Keys / Startup Folder                        		23
                        Masquerading                        		DCSync2
                        Process Discovery                        		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                        Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job5
                        Virtualization/Sandbox Evasion                        		Proc Filesystem1
                        Application Window Discovery                        		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                        Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                        Access Token Manipulation                        		/etc/passwd and /etc/shadow3
                        System Owner/User Discovery                        		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                        IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron212
                        Process Injection                        		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                        Behavior Graph

                        Hide Legend

                        Legend:

                        • Process
                        • Signature
                        • Created File
                        • DNS/IP Info
                        • Is Dropped
                        • Is Windows Process
                        • Number of created Registry Values
                        • Number of created Files
                        • Visual Basic
                        • Delphi
                        • Java
                        • .Net C# or VB.NET
                        • C, C++ or other language
                        • Is malicious
                        • Internet
                        behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1632207 Sample: KMSpico.exe Startdate: 07/03/2025 Architecture: WINDOWS Score: 86 93 agriework.life 2->93 95 t.me 2->95 97 3 other IPs or domains 2->97 119 Suricata IDS alerts for network traffic 2->119 121 Found malware configuration 2->121 123 Antivirus detection for URL or domain 2->123 125 10 other signatures 2->125 11 KMSpico.exe 2 2->11         started        14 svchost.exe 2->14         started        17 AutoPico.exe 2->17         started        20 9 other processes 2->20 signatures3 process4 dnsIp5 85 C:\Users\user\AppData\Local\...\KMSpico.tmp, PE32 11->85 dropped 22 KMSpico.tmp 24 10 11->22         started        137 Changes security center settings (notifications, updates, antivirus, firewall) 14->137 25 MpCmdRun.exe 14->25         started        89 8.8.8.8 GOOGLEUS United States 17->89 27 WerFault.exe 17->27         started        91 127.0.0.1 unknown unknown 20->91 29 WerFault.exe 20->29         started        file6 signatures7 process8 file9 69 C:\Users\user\AppData\...\unins000.exe (copy), PE32 22->69 dropped 71 C:\Users\user\AppData\...\is-AKF7M.tmp, PE32 22->71 dropped 73 C:\Users\user\AppData\...\is-5DNJH.tmp, PE32 22->73 dropped 75 4 other malicious files 22->75 dropped 31 KMSpico.exe 2 22->31         started        34 core.exe 2 22->34         started        37 conhost.exe 25->37         started        process10 file11 87 C:\Users\user\AppData\Local\...\KMSpico.tmp, PE32 31->87 dropped 39 KMSpico.tmp 22 487 31->39         started        111 Found many strings related to Crypto-Wallets (likely being stolen) 34->111 113 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 34->113 115 Writes to foreign memory regions 34->115 117 Injects a PE file into a foreign processes 34->117 43 MSBuild.exe 34->43         started        signatures12 process13 dnsIp14 77 C:\Windows\...\Vestris.ResourceLib.dll (copy), PE32 39->77 dropped 79 C:\Windows\System32\is-PDNCG.tmp, PE32 39->79 dropped 81 C:\Windows\System32\is-GL5NT.tmp, PE32 39->81 dropped 83 18 other malicious files 39->83 dropped 127 Disables the Smart Screen filter 39->127 46 cmd.exe 1 39->46         started        49 cmd.exe 1 39->49         started        51 UninsHs.exe 39->51         started        53 KMSELDI.exe 39->53         started        107 agriework.life 104.21.48.1, 443, 49721, 49723 CLOUDFLARENETUS United States 43->107 109 t.me 149.154.167.99, 443, 49719 TELEGRAMRU United Kingdom 43->109 129 Attempt to bypass Chrome Application-Bound Encryption 43->129 131 Found many strings related to Crypto-Wallets (likely being stolen) 43->131 133 Tries to harvest and steal browser information (history, passwords, etc) 43->133 135 Tries to steal Crypto Currency Wallets 43->135 55 chrome.exe 43->55         started        file15 signatures16 process17 dnsIp18 139 Uses schtasks.exe or at.exe to add and modify task schedules 46->139 58 conhost.exe 46->58         started        60 sc.exe 46->60         started        62 conhost.exe 49->62         started        64 schtasks.exe 49->64         started        105 192.168.2.4, 138, 443, 49158 unknown unknown 55->105 66 chrome.exe 55->66         started        signatures19 process20 dnsIp21 99 play.google.com 142.250.181.238, 443, 49746, 49749 GOOGLEUS United States 66->99 101 www.google.com 142.250.186.68, 443, 49729, 49732 GOOGLEUS United States 66->101 103 2 other IPs or domains 66->103

                        Screenshots

                        Thumbnails

                        This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                        windows-stand

                        Antivirus, Machine Learning and Genetic Malware Detection

                        Initial Sample

                        SourceDetectionScannerLabelLink
                        KMSpico.exe30%VirustotalBrowse
                        KMSpico.exe21%ReversingLabsWin32.Ransomware.Generic

                        Dropped Files

                        SourceDetectionScannerLabelLink
                        C:\Program Files\KMSpico\AutoPico.exe (copy)75%ReversingLabsByteCode-MSIL.Hacktool.KMSActivator
                        C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll (copy)0%ReversingLabs
                        C:\Program Files\KMSpico\KMSELDI.exe (copy)71%ReversingLabsWin32.Hacktool.KMSActivator
                        C:\Program Files\KMSpico\Service_KMS.exe (copy)76%ReversingLabsWin32.Hacktool.KMSActivator
                        C:\Program Files\KMSpico\UninsHs.exe (copy)0%ReversingLabs
                        C:\Program Files\KMSpico\Vestris.ResourceLib.dll (copy)0%ReversingLabs
                        C:\Program Files\KMSpico\driver\is-IL6EK.tmp0%ReversingLabs
                        C:\Program Files\KMSpico\driver\tap-windows-9.21.0.exe (copy)0%ReversingLabs
                        C:\Program Files\KMSpico\is-2EIIF.tmp0%ReversingLabs
                        C:\Program Files\KMSpico\is-8OFR2.tmp2%ReversingLabs
                        C:\Program Files\KMSpico\is-9V6LA.tmp0%ReversingLabs
                        C:\Program Files\KMSpico\is-ACNAA.tmp0%ReversingLabs
                        C:\Program Files\KMSpico\is-E64V7.tmp71%ReversingLabsWin32.Hacktool.KMSActivator
                        C:\Program Files\KMSpico\is-HC31N.tmp75%ReversingLabsByteCode-MSIL.Hacktool.KMSActivator
                        C:\Program Files\KMSpico\is-QBUB1.tmp76%ReversingLabsWin32.Hacktool.KMSActivator
                        C:\Program Files\KMSpico\unins000.exe (copy)2%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\is-2DCLQ.tmp\_isetup\_setup64.tmp0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp2%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\is-FSBO7.tmp\KMSpico.tmp0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\is-N1R5V.tmp\_isetup\_setup64.tmp0%ReversingLabs
                        C:\Users\user\AppData\Local\Temp\is-N1R5V.tmp\_isetup\_shfoldr.dll0%ReversingLabs
                        C:\Users\user\AppData\Roaming\MyApp\core.exe (copy)8%ReversingLabs
                        C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe (copy)74%ReversingLabsWin32.Hacktool.KMSActivator
                        C:\Users\user\AppData\Roaming\MyApp\data\is-1H3AB.tmp74%ReversingLabsWin32.Hacktool.KMSActivator
                        C:\Users\user\AppData\Roaming\MyApp\is-5DNJH.tmp0%ReversingLabs
                        C:\Users\user\AppData\Roaming\MyApp\is-AKF7M.tmp8%ReversingLabs

                        Unpacked PE Files

                        ⊘No Antivirus matches

                        Domains

                        ⊘No Antivirus matches

                        URLs

                        SourceDetectionScannerLabelLink
                        http://bugreports.qt.io/Microsoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogicRocket_q_recei0%Avira URL Cloudsafe
                        agriework.life100%Avira URL Cloudmalware
                        ftp://.mode0%Avira URL Cloudsafe
                        farfinable.top100%Avira URL Cloudmalware
                        https://bugreports.qt-project.org.The0%Avira URL Cloudsafe
                        http://www.remobjects.com/psU0%Avira URL Cloudsafe
                        https://agriework.life/api100%Avira URL Cloudmalware

                        Domains and IPs

                        Contacted Domains

                        NameIPActiveMaliciousAntivirus DetectionReputation
                        bg.microsoft.map.fastly.net
                        		199.232.210.172
                        		truefalse
                          		high
                          plus.l.google.com
                          		216.58.206.78
                          		truefalse
                            		high
                            play.google.com
                            		142.250.181.238
                            		truefalse
                              		high
                              t.me
                              		149.154.167.99
                              		truefalse
                                		high
                                www.google.com
                                		142.250.186.68
                                		truefalse
                                  		high
                                  agriework.life
                                  		104.21.48.1
                                  		truetrue
                                    		unknown
                                    pki-goog.l.google.com
                                    		142.250.185.163
                                    		truefalse
                                      		high
                                      10.74.0.0.in-addr.arpa
                                      		unknown
                                      		unknownfalse
                                        		unknown
                                        c.pki.goog
                                        		unknown
                                        		unknownfalse
                                          		high
                                          apis.google.com
                                          		unknown
                                          		unknownfalse
                                            		high

                                            Contacted URLs

                                            NameMaliciousAntivirus DetectionReputation
                                            techspherxe.topfalse
                                              		high
                                              agriework.lifetrue
                                              • Avira URL Cloud: malware
                                              		unknown
                                              farfinable.toptrue
                                              • Avira URL Cloud: malware
                                              		unknown
                                              https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhEfalse
                                                		high
                                                https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.uiLLJjqnhCQ.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/rs=AHpOoo8NP2y291iiPDmfAN0GV3dvCuqlYA/cb=gapi.loaded_0false
                                                  		high
                                                  https://agriework.life/apitrue
                                                  • Avira URL Cloud: malware
                                                  		unknown

                                                  URLs from Memory and Binaries

                                                  NameSourceMaliciousAntivirus DetectionReputation
                                                  https://mail.google.com/chat/download?usp=chrome_defaultfaultchrome.exe, 0000001C.00000002.2467021735.000061940187C000.00000004.00001000.00020000.00000000.sdmpfalse
                                                    		high
                                                    http://qt-project.org/xml/features/report-whitespace-only-CharDatacore.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                      		high
                                                      https://myaccount.google.com/find-your-phone?utm_source=ga-chrome-actions&utm_medium=findYourPhonechrome.exe, 0000001C.00000002.2461851598.0000619400C90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                        		high
                                                        http://www.fontbureau.com/designersKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                          		high
                                                          http://bugreports.qt.io/core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                            		high
                                                            http://Passport.NET/tbposesvchost.exe, 0000001B.00000002.2429698786.000001F218249000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		high
                                                              https://mail.google.com/chat/chrome.exe, 0000001C.00000002.2460579220.0000619400A04000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                		high
                                                                https://g.live.com/odclientsettings/Prod.C:svchost.exe, 00000002.00000003.1204028372.000001AD37056000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                  		high
                                                                  https://bugreports.qt-project.org.Thecore.exe, 0000000A.00000000.1520505451.000000000130F000.00000002.00000001.01000000.0000000D.sdmp, core.exe, 0000000A.00000002.1751981175.000000000130F000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                  • Avira URL Cloud: safe
                                                                  		unknown
                                                                  http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issuesvchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                    		high
                                                                    https://www.remobjects.com/psKMSpico.exe, 00000000.00000003.1185152035.000000007F1BB000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000000.00000003.1182879766.0000000003680000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000001.00000000.1186718304.0000000000311000.00000020.00000001.01000000.00000004.sdmpfalse
                                                                      		high
                                                                      https://www.google.com/chrome/tips/chrome.exe, 0000001C.00000002.2461851598.0000619400C90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                        		high
                                                                        https://www.innosetup.com/KMSpico.exe, 00000000.00000003.1185152035.000000007F1BB000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000000.00000003.1182879766.0000000003680000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 00000001.00000000.1186718304.0000000000311000.00000020.00000001.01000000.00000004.sdmpfalse
                                                                          		high
                                                                          http://www.galapagosdesign.com/DPleaseKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                            		high
                                                                            https://ogs.google.com/widget/callout?eom=1chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                              		high
                                                                              https://login.microsoftonline.com/ppsecure/EnumerateDevices.srfsvchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		high
                                                                                http://ccsca2021.ocsp-certum.com05KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                  		high
                                                                                  https://account.live.com/inlinesignup.aspx?iww=1&id=80600ssuersvchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		high
                                                                                    http://www.zhongyicts.com.cnKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                      		high
                                                                                      http://schemas.xmlsoap.org/ws/2005/05/identity/claims/namecore.exe, 0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2429037018.00000000033D1000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                        		high
                                                                                        https://dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1375180791.00000297D565A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377485618.00000297D562B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		high
                                                                                          http://www.certum.pl/CPS0KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                            		high
                                                                                            https://g.live.com/1rewlive5skydrive/OneDriveProductionV2?OneDriveUpdate=9c123752e31a927b78dc96231b6svchost.exe, 00000002.00000003.1204028372.000001AD370C2000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                              		high
                                                                                              http://www.innosetup.com/KMSpico.tmp, KMSpico.tmp, 0000000C.00000002.2420505019.0000000000401000.00000020.00000001.01000000.0000000A.sdmpfalse
                                                                                                		high
                                                                                                https://play.google.com/log?format=json&hasfast=truesyncdata.v1.AsyncDataService/GetAsyncDatachrome.exe, 0000001C.00000002.2447605453.000001E5C65A7000.00000004.10000000.00040000.00000000.sdmpfalse
                                                                                                  		high
                                                                                                  https://stackoverflow.com/q/14436606/23354core.exe, 0000000A.00000002.1760982373.00000000044D1000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                    		high
                                                                                                    http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsdtysvchost.exe, 0000001B.00000003.1811342570.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811437835.000001F217B54000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		high
                                                                                                      https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsuersvchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		high
                                                                                                        https://account.live.com/msangcwamsvchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		high
                                                                                                          http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineKMSpico.exe, KMSpico.exe, 00000009.00000002.2420493718.0000000000401000.00000020.00000001.01000000.00000008.sdmpfalse
                                                                                                            		high
                                                                                                            http://crl.ver)svchost.exe, 0000001B.00000002.2425683303.000001F217293000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		high
                                                                                                              http://passport.net/tbsvchost.exe, 0000001B.00000002.2426709500.000001F2172B2000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		high
                                                                                                                ftp://.modecore.exe, 0000000A.00000000.1520505451.000000000130F000.00000002.00000001.01000000.0000000D.sdmp, core.exe, 0000000A.00000002.1751981175.000000000130F000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                                                                • Avira URL Cloud: safe
                                                                                                                		unknown
                                                                                                                https://dev.virtualearth.net/REST/v1/Locationssvchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		high
                                                                                                                  http://www.carterandcone.comlKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                    		high
                                                                                                                    https://myaccount.google.com/data-and-privacy?utm_source=ga-chrome-actions&utm_medium=managePrivacychrome.exe, 0000001C.00000002.2461851598.0000619400C90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                      		high
                                                                                                                      http://nsis.sf.net/NSIS_ErrorKMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                        		high
                                                                                                                        https://dynamic.tsvchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		high
                                                                                                                          http://schemas.xmlsoap.org/ws/2005/02/scomsvchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                            		high
                                                                                                                            https://dev.virtualearth.net/REST/v1/Routes/Transitsvchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		high
                                                                                                                              https://login.microsoftonline.com/ppsecure/ResolveUser.srfsuersvchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                		high
                                                                                                                                http://trolltech.com/xml/features/report-start-end-entitycore.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                                                                                  		high
                                                                                                                                  https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/svchost.exe, 00000003.00000002.1377760032.00000297D5670000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1373477349.00000297D566E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    		high
                                                                                                                                    https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=svchost.exe, 00000003.00000003.1375566197.00000297D5631000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		high
                                                                                                                                      http://crl.certum.pl/ctsca2021.crl0oKMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                                                        		high
                                                                                                                                        http://www.phreedom.org/md5)08:27core.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                                                                                          		high
                                                                                                                                          http://www.founder.com.cn/cn/bTheKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                            		high
                                                                                                                                            https://dev.virtualearth.net/REST/v1/Routes/Drivingsvchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		high
                                                                                                                                              https://login.microsoftonline.com/ppsecure/deviceremovecredential.srfsvchost.exe, 0000001B.00000003.1776755196.000001F217B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		high
                                                                                                                                                http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdlineSetupUKMSpico.exe, 00000009.00000002.2420493718.0000000000401000.00000020.00000001.01000000.00000008.sdmpfalse
                                                                                                                                                  		high
                                                                                                                                                  https://login.microsoftonline.com/ppsecure/DeviceQuery.srfsvchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		high
                                                                                                                                                    https://login.microsoftonline.com/MSARST2.srfsvchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777218668.000001F217B63000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		high
                                                                                                                                                      http://www.openssl.org/support/faq.htmlcore.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                                                                                                        		high
                                                                                                                                                        http://www.typography.netDKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                          		high
                                                                                                                                                          https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=svchost.exe, 00000003.00000002.1377485618.00000297D562B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		high
                                                                                                                                                            http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd/12yvsvchost.exe, 0000001B.00000002.2428156646.000001F217B13000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		high
                                                                                                                                                              http://crl.thawte.com/ThawteTimestampingCA.crl0KMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2428044215.00000000068A6000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1720602264.0000000000E52000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1736192441.0000000000AF8000.00000002.00000001.01000000.00000014.sdmpfalse
                                                                                                                                                                		high
                                                                                                                                                                http://subca.ocsp-certum.com05KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                                                                                  		high
                                                                                                                                                                  https://stackoverflow.com/q/11564914/23354;core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                    		high
                                                                                                                                                                    http://subca.ocsp-certum.com02KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                                                                                      		high
                                                                                                                                                                      http://subca.ocsp-certum.com01KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                                                                                        		high
                                                                                                                                                                        https://myaccount.google.com/signinoptions/password?utm_source=ga-chrome-actions&utm_medium=changePWchrome.exe, 0000001C.00000002.2461851598.0000619400C90000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                          		high
                                                                                                                                                                          http://repository.certum.pl/ctnca2.cer09KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                                                                                            		high
                                                                                                                                                                            http://www.fonts.comKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                              		high
                                                                                                                                                                              https://apis.google.comchrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                		high
                                                                                                                                                                                http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsdsvchost.exe, 0000001B.00000002.2425190256.000001F217224000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2429042451.000001F217B7B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811437835.000001F217B54000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1811512009.000001F217B56000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		high
                                                                                                                                                                                  https://signup.live.com/signup.aspxsvchost.exe, 0000001B.00000003.1777180067.000001F217B40000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B55000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777096689.000001F217B3B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1777060923.000001F217B4D000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B2C000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		high
                                                                                                                                                                                    https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/svchost.exe, 00000003.00000003.1374124657.00000297D5667000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377733971.00000297D5668000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377485618.00000297D562B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		high
                                                                                                                                                                                      https://google-ohttp-relay-query.fastly-edge.com/2Pchrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		high
                                                                                                                                                                                        http://fontawesome.iohttp://fontawesome.io/license/WebfontKMSpico.tmp, 0000000C.00000002.2428044215.00000000062A0000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000002.2437576505.000000001C312000.00000002.00000001.01000000.0000001F.sdmpfalse
                                                                                                                                                                                          		high
                                                                                                                                                                                          https://account.live.com/inlinesignup.aspx?iww=1&id=80601svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		high
                                                                                                                                                                                            https://account.live.com/inlinesignup.aspx?iww=1&id=80600svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		high
                                                                                                                                                                                              https://account.live.com/inlinesignup.aspx?iww=1&id=80603svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                		high
                                                                                                                                                                                                https://ogs.google.com/widget/app/so?eom=1chrome.exe, 0000001C.00000002.2468854576.0000619401F85000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		high
                                                                                                                                                                                                  http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymoussvchost.exe, 0000001B.00000002.2428294929.000001F217B37000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                    		high
                                                                                                                                                                                                    https://dev.ditu.live.com/REST/v1/Transit/Stops/svchost.exe, 00000003.00000002.1377795516.00000297D5677000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1373003184.00000297D5675000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                      		high
                                                                                                                                                                                                      https://www.google.com/searchchrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                        		high
                                                                                                                                                                                                        https://account.live.com/inlinesignup.aspx?iww=1&id=80605svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                          		high
                                                                                                                                                                                                          https://account.live.com/inlinesignup.aspx?iww=1&id=80604svchost.exe, 0000001B.00000003.1777493503.000001F217B56000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776835221.000001F217B52000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000003.1776614553.000001F217B29000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                            		high
                                                                                                                                                                                                            https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=svchost.exe, 00000003.00000003.1375364704.00000297D5649000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000002.1377541627.00000297D5642000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374901644.00000297D5658000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1375223996.00000297D564A000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                              		high
                                                                                                                                                                                                              https://github.com/mgravell/protobuf-netcore.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                		high
                                                                                                                                                                                                                https://login.microsoftonline.com/ppsecure/deviceaddmsacredential.srfsvchost.exe, 0000001B.00000003.1776755196.000001F217B10000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 0000001B.00000002.2425409864.000001F217244000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                  https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?svchost.exe, 00000003.00000002.1377708829.00000297D5663000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000003.00000003.1374405238.00000297D5662000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                    https://www.certum.pl/CPS0KMSpico.tmp, 00000001.00000002.1540527665.0000000000AED000.00000004.00000010.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                      		high
                                                                                                                                                                                                                      http://schemas.xmlsoap.org/ws/2005/02/trust/Issuesvchost.exe, 0000001B.00000002.2425683303.000001F21725F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                        		high
                                                                                                                                                                                                                        http://www.fontbureau.com/designers/cabarga.htmlNKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                          		high
                                                                                                                                                                                                                          https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=svchost.exe, 00000003.00000002.1377541627.00000297D5642000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                            		high
                                                                                                                                                                                                                            http://www.founder.com.cn/cnKMSELDI.exe, 00000014.00000002.2443446220.000000001D952000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                              		high
                                                                                                                                                                                                                              http://schemas.xmlsoap.org/ws/2005/02/scsvchost.exe, 0000001B.00000002.2428692234.000001F217B5F000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                		high
                                                                                                                                                                                                                                http://www.remobjects.com/psUKMSpico.exe, 00000009.00000003.1479031039.00000000021E0000.00000004.00001000.00020000.00000000.sdmp, KMSpico.exe, 00000009.00000003.1489660631.0000000001F58000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2420505019.0000000000401000.00000020.00000001.01000000.0000000A.sdmpfalse
                                                                                                                                                                                                                                • Avira URL Cloud: safe
                                                                                                                                                                                                                                		unknown
                                                                                                                                                                                                                                https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview2Kchrome.exe, 0000001C.00000003.1831820938.0000619000184000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000003.1885965833.0000619401AEC000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                  		high
                                                                                                                                                                                                                                  https://stackoverflow.com/q/2152978/23354core.exe, 0000000A.00000002.1793045806.0000000007B70000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1785751625.00000000054DA000.00000004.00000800.00020000.00000000.sdmpfalse
                                                                                                                                                                                                                                    		high
                                                                                                                                                                                                                                    http://qt-project.org/xml/features/report-start-end-entitycore.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                                                                                                                                                                                      		high
                                                                                                                                                                                                                                      http://bugreports.qt.io/Microsoft-IIS/4.Microsoft-IIS/5.Netscape-Enterprise/3.WebLogicRocket_q_receicore.exe, 0000000A.00000002.1751981175.00000000014D3000.00000002.00000001.01000000.0000000D.sdmpfalse
                                                                                                                                                                                                                                      • Avira URL Cloud: safe
                                                                                                                                                                                                                                      		unknown

                                                                                                                                                                                                                                      World Map of Contacted IPs

                                                                                                                                                                                                                                      • No. of IPs < 25%
                                                                                                                                                                                                                                      • 25% < No. of IPs < 50%
                                                                                                                                                                                                                                      • 50% < No. of IPs < 75%
                                                                                                                                                                                                                                      • 75% < No. of IPs

                                                                                                                                                                                                                                      Public IPs

                                                                                                                                                                                                                                      IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                                                      104.21.48.1
                                                                                                                                                                                                                                      		agriework.lifeUnited States
                                                                                                                                                                                                                                      		13335CLOUDFLARENETUStrue
                                                                                                                                                                                                                                      142.250.186.68
                                                                                                                                                                                                                                      		www.google.comUnited States
                                                                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                                                                      216.58.206.78
                                                                                                                                                                                                                                      		plus.l.google.comUnited States
                                                                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                                                                      149.154.167.99
                                                                                                                                                                                                                                      		t.meUnited Kingdom
                                                                                                                                                                                                                                      		62041TELEGRAMRUfalse
                                                                                                                                                                                                                                      8.8.8.8
                                                                                                                                                                                                                                      		unknownUnited States
                                                                                                                                                                                                                                      		15169GOOGLEUSfalse
                                                                                                                                                                                                                                      142.250.181.238
                                                                                                                                                                                                                                      		play.google.comUnited States
                                                                                                                                                                                                                                      		15169GOOGLEUSfalse

                                                                                                                                                                                                                                      Private

                                                                                                                                                                                                                                      IP
                                                                                                                                                                                                                                      192.168.2.4
                                                                                                                                                                                                                                      127.0.0.1

                                                                                                                                                                                                                                      General Information

                                                                                                                                                                                                                                      Joe Sandbox version:42.0.0 Malachite
                                                                                                                                                                                                                                      Analysis ID:1632207
                                                                                                                                                                                                                                      Start date and time:2025-03-07 20:52:52 +01:00
                                                                                                                                                                                                                                      Joe Sandbox product:CloudBasic
                                                                                                                                                                                                                                      Overall analysis duration:0h 12m 16s
                                                                                                                                                                                                                                      Hypervisor based Inspection enabled:false
                                                                                                                                                                                                                                      Report type:full
                                                                                                                                                                                                                                      Cookbook file name:default.jbs
                                                                                                                                                                                                                                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                                                      Number of analysed new started processes analysed:33
                                                                                                                                                                                                                                      Number of new started drivers analysed:0
                                                                                                                                                                                                                                      Number of existing processes analysed:0
                                                                                                                                                                                                                                      Number of existing drivers analysed:0
                                                                                                                                                                                                                                      Number of injected processes analysed:0
                                                                                                                                                                                                                                      Technologies:
                                                                                                                                                                                                                                      • HCA enabled
                                                                                                                                                                                                                                      • EGA enabled
                                                                                                                                                                                                                                      • AMSI enabled
                                                                                                                                                                                                                                      Analysis Mode:default
                                                                                                                                                                                                                                      Analysis stop reason:Timeout
                                                                                                                                                                                                                                      Sample name:KMSpico.exe
                                                                                                                                                                                                                                      Detection:MAL
                                                                                                                                                                                                                                      Classification:mal86.phis.troj.spyw.evad.winEXE@63/803@10/8
                                                                                                                                                                                                                                      EGA Information:
                                                                                                                                                                                                                                      • Successful, ratio: 85.7%
                                                                                                                                                                                                                                      HCA Information:
                                                                                                                                                                                                                                      • Successful, ratio: 70%
                                                                                                                                                                                                                                      • Number of executed functions: 287
                                                                                                                                                                                                                                      • Number of non-executed functions: 175
                                                                                                                                                                                                                                      Cookbook Comments:
                                                                                                                                                                                                                                      • Found application associated with file extension: .exe

                                                                                                                                                                                                                                      Warnings

                                                                                                                                                                                                                                      • Exclude process from analysis (whitelisted): dllhost.exe
                                                                                                                                                                                                                                      • Excluded IPs from analysis (whitelisted): 23.60.203.209, 199.232.210.172, 78.47.168.188, 90.187.112.137, 167.235.139.237, 85.215.229.230, 40.126.31.129, 40.126.31.73, 20.190.159.71, 40.126.31.69, 40.126.31.2, 40.126.31.67, 20.190.159.128, 20.190.159.2, 40.69.147.202, 172.217.16.206, 74.125.133.84, 142.250.186.78, 142.250.185.78, 142.250.185.206, 142.250.185.227, 142.250.185.110, 142.250.184.202, 142.250.184.234, 216.58.206.74, 172.217.16.138, 172.217.18.10, 172.217.18.106, 142.250.185.234, 216.58.206.42, 142.250.185.138, 172.217.16.202, 142.250.185.202, 142.250.185.74, 142.250.185.170, 142.250.186.42, 142.250.185.106, 142.250.181.234, 142.250.186.74, 216.58.212.138, 172.217.23.106, 142.250.74.202, 20.189.173.21, 172.217.18.14, 142.250.186.142, 40.71.69.253, 142.250.186.174, 104.40.67.19, 216.58.206.35, 142.250.186.110, 142.250.186.67, 216.58.206.46, 142.250.185.163, 204.79.197.222
                                                                                                                                                                                                                                      • Excluded domains from analysis (whitelisted): onedsblobvmssprdeus03.eastus.cloudapp.azure.com, fp.msedge.net, 1.pool.ntp.org, clientservices.googleapis.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, onedsblobvmssprdcus02.centralus.cloudapp.azure.com, clients2.google.com, redirector.gvt1.com, login.live.com, onedsblobprdwus16.westus.cloudapp.azure.com, update.googleapis.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, wu-b-net.trafficmanager.net, onedsblobvmssprdwus04.westus.cloudapp.azure.com, optimizationguide-pa.googleapis.com, prdv4a.aadg.msidentity.com, fs.microsoft.com, accounts.google.com, ctldl.windowsupdate.com.delivery.microsoft.com, www.tm.v4.a.prd.aadg.trafficmanager.net, ctldl.windowsupdate.com, ogads-pa.googleapis.com, login.msa.msidentity.com, e16604.f.akamaiedge.net, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.tm.lg.prod.aadmsa.trafficmanager.net
                                                                                                                                                                                                                                      • Execution Graph export aborted for target KMSELDI.exe, PID 7928 because it is empty
                                                                                                                                                                                                                                      • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                                                      • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                                                      • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                                                                                                                                                                                                                                      • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                                                      • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                                                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                                                      • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                                                      • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                                                      • Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

                                                                                                                                                                                                                                      Simulations

                                                                                                                                                                                                                                      Behavior and APIs

                                                                                                                                                                                                                                      TimeTypeDescription
                                                                                                                                                                                                                                      14:53:52API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                                                                                                                                      14:54:50API Interceptor3x Sleep call for process: MSBuild.exe modified
                                                                                                                                                                                                                                      14:54:56API Interceptor1x Sleep call for process: WerFault.exe modified
                                                                                                                                                                                                                                      14:55:02API Interceptor1x Sleep call for process: MpCmdRun.exe modified
                                                                                                                                                                                                                                      19:54:45Task SchedulerRun new task: AutoPico Daily Restart path: "C:\Program Files\KMSpico\AutoPico.exe" s>/silent

                                                                                                                                                                                                                                      Joe Sandbox View / Context

                                                                                                                                                                                                                                      IPs

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      104.21.48.1Stormwater Works Drawings Spec.jsGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                      • www.lucynoel6465.shop/jgkl/
                                                                                                                                                                                                                                      Shipment Delivery No DE0093002-PDF.exeGet hashmaliciousLokibotBrowse
                                                                                                                                                                                                                                      • touxzw.ir/tking3/five/fre.php
                                                                                                                                                                                                                                      Remittance_CT022024.exeGet hashmaliciousLokibotBrowse
                                                                                                                                                                                                                                      • touxzw.ir/fix/five/fre.php
                                                                                                                                                                                                                                      http://microsoft-sharepoint4543464633.pages.dev/index-2jc93/Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                                                      • microsoft-sharepoint4543464633.pages.dev/index-2jc93/
                                                                                                                                                                                                                                      install.exeGet hashmaliciousBabadedaBrowse
                                                                                                                                                                                                                                      • api.secureserver.top/api/files/winpleskdedicated/installer.exe?key=winpleskdedicated
                                                                                                                                                                                                                                      ZmK1CAc4VP.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                      • www.tumbetgirislinki.fit/4wrd/
                                                                                                                                                                                                                                      uI1A364y2P.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                      • www.lucynoel6465.shop/jgkl/
                                                                                                                                                                                                                                      QUOTATION NO REQ-19-000640.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                      • www.lucynoel6465.shop/am6a/
                                                                                                                                                                                                                                      LLLLLLLLASSSEERRRR.ps1Get hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                      • www.tumbetgirislinki.fit/k566/
                                                                                                                                                                                                                                      laserl.ps1Get hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                      • www.lucynoel6465.shop/jgkl/?y2IHp=hI+cEEoDMRK5HtHlz4V8IEOzbfVROUzo+nuR9x41ri89hVkyLZ4bVRvwmPB4YpqMZl4/b+D+8qc7dcfD2Dlpe8No0hPfAwO5oFY7qBV6wzFyOtp6qA==&iLy=Wfpx
                                                                                                                                                                                                                                      149.154.167.99http://45.142.208.144.sslip.io/blog/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.org/img/emoji/40/F09F9889.png
                                                                                                                                                                                                                                      http://xn--r1a.website/s/ogorodruGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.org/img/favicon.ico
                                                                                                                                                                                                                                      http://cryptorabotakzz.com/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.org/
                                                                                                                                                                                                                                      http://cache.netflix.com.id1.wuush.us.kg/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.org/dl?tme=fe3233c08ff79d4814_5062105595184761217
                                                                                                                                                                                                                                      http://investors.spotify.com.sg2.wuush.us.kg/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.org/
                                                                                                                                                                                                                                      http://bekaaviator.kz/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.org/
                                                                                                                                                                                                                                      http://telegramtw1.org/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.org/?setln=pl
                                                                                                                                                                                                                                      http://makkko.kz/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.org/
                                                                                                                                                                                                                                      http://telegram.dogGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • telegram.dog/
                                                                                                                                                                                                                                      LnSNtO8JIa.exeGet hashmaliciousCinoshi StealerBrowse
                                                                                                                                                                                                                                      • t.me/cinoshibot

                                                                                                                                                                                                                                      Domains

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      t.meSecuriteInfo.com.Win32.AdwareX-gen.20631.18363.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      file.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      LtCPevm69G.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Poverty Stealer, PureLog Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      https://graph.org/WBACK-03-06?qb3nGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      EasyWay.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      Collapse.exeGet hashmaliciousLummaC Stealer, PureLog StealerBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      q3na5Mc.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      Yanto v1.2.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      ESVoO7ywn5.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      S2W2ftXM2b.exeGet hashmaliciousAmadey, LummaC Stealer, PureLog Stealer, XWormBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      bg.microsoft.map.fastly.netuolmaTGkHh.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                      • 199.232.214.172
                                                                                                                                                                                                                                      VoaY6Clwfh.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                      • 199.232.210.172
                                                                                                                                                                                                                                      letsVPN.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 199.232.210.172
                                                                                                                                                                                                                                      letsVPN.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 199.232.210.172
                                                                                                                                                                                                                                      NEW ORDER (PO. 2100002 (BT-INC).xlsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 199.232.210.172
                                                                                                                                                                                                                                      Purchase Order.xla.xlsxGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 199.232.214.172
                                                                                                                                                                                                                                      Royal Mail Inland Claim Form V1.3.xlsmGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 199.232.210.172
                                                                                                                                                                                                                                      kDubrmi6B5.msiGet hashmaliciousMetastealerBrowse
                                                                                                                                                                                                                                      • 199.232.210.172
                                                                                                                                                                                                                                      Br6Dejo3eu.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                      • 199.232.214.172
                                                                                                                                                                                                                                      Uy1xrVW6Fh.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                                      • 199.232.214.172
                                                                                                                                                                                                                                      pki-goog.l.google.comuolmaTGkHh.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                      • 142.250.186.67
                                                                                                                                                                                                                                      VoaY6Clwfh.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                      • 142.250.185.163
                                                                                                                                                                                                                                      DHL - OVERDUE ACCOUNT LETTER- FINAL REMINDER - 1300711528.com.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 142.250.185.99
                                                                                                                                                                                                                                      Br6Dejo3eu.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                      • 172.217.23.99
                                                                                                                                                                                                                                      Uy1xrVW6Fh.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                                      • 216.58.206.67
                                                                                                                                                                                                                                      skf7iF4.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 172.217.16.131
                                                                                                                                                                                                                                      SecuriteInfo.com.Win32.RATX-gen.5196.22979.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                                      • 142.250.185.67
                                                                                                                                                                                                                                      SecuriteInfo.com.Win32.RATX-gen.12965.16390.exeGet hashmaliciousXWormBrowse
                                                                                                                                                                                                                                      • 172.217.18.3
                                                                                                                                                                                                                                      https://aircarecolorado.com/locations/van-locations/?tab=jl_magic_tabs_m_th_current_week_gix1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 142.250.186.163
                                                                                                                                                                                                                                      https://aircarecolorado.com/locations/van-locations?tab=jl_magic_tabs_m_th_current_week_gix1Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 142.250.184.195

                                                                                                                                                                                                                                      ASNs

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      TELEGRAMRU4PYRGCo1Di.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                                                                      SecuriteInfo.com.Win32.AdwareX-gen.20631.18363.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      pkNnK2ya0f.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                                                                      XiJhd7Lx30.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                                                                      file.exeGet hashmaliciousPython Stealer, Blank GrabberBrowse
                                                                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                                                                      file.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      LtCPevm69G.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Poverty Stealer, PureLog Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      Shipment advice H-BL Draft.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                                                                      DHL Shipping Details Ref ID 446331798008765975594-pdf.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                                                                      valorant_ESP_aimbot.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 149.154.167.220
                                                                                                                                                                                                                                      CLOUDFLARENETUShttps://skyblueinfra.com/wp-includes/Doc/Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.21.80.1
                                                                                                                                                                                                                                      NmuA605dM4.exeGet hashmaliciousMSIL Logger, MassLogger RATBrowse
                                                                                                                                                                                                                                      • 104.21.16.1
                                                                                                                                                                                                                                      4PYRGCo1Di.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                                      • 104.21.16.1
                                                                                                                                                                                                                                      http://lploverar.bestGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 162.159.136.54
                                                                                                                                                                                                                                      pkNnK2ya0f.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                                                      • 104.21.32.1
                                                                                                                                                                                                                                      Launcher.exeGet hashmaliciousGrowtopia, Phoenix StealerBrowse
                                                                                                                                                                                                                                      • 162.159.128.233
                                                                                                                                                                                                                                      5aQpYG37db.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                      • 104.26.12.205
                                                                                                                                                                                                                                      fls3eql72b.exeGet hashmaliciousAgentTeslaBrowse
                                                                                                                                                                                                                                      • 172.67.74.152
                                                                                                                                                                                                                                      jzqc1V4NqB.exeGet hashmaliciousFormBookBrowse
                                                                                                                                                                                                                                      • 188.114.97.3
                                                                                                                                                                                                                                      XiJhd7Lx30.exeGet hashmaliciousSnake Keylogger, VIP KeyloggerBrowse
                                                                                                                                                                                                                                      • 104.21.64.1

                                                                                                                                                                                                                                      JA3 Fingerprints

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      a0e9f5d64349fb13191bc781f81f42e1plugin-newest_release_.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      plugin-newest_release_.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      AaxpYFDQ32.exeGet hashmaliciousAmadey, Credential Flusher, GCleaner, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      random.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      random.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      43 22.pdf.jsGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      am_no.batGet hashmaliciousAmadey, Credential Flusher, Healer AV Disabler, LummaC Stealer, StealcBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      CgmaT61.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      LtCPevm69G.exeGet hashmaliciousAmadey, Credential Flusher, LummaC Stealer, Poverty Stealer, PureLog Stealer, Stealc, VidarBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99
                                                                                                                                                                                                                                      FvbuInU.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                      • 104.21.48.1
                                                                                                                                                                                                                                      • 149.154.167.99

                                                                                                                                                                                                                                      Dropped Files

                                                                                                                                                                                                                                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                                                      C:\Program Files\KMSpico\AutoPico.exe (copy)KMSpico.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                        KMSpico.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                          gbrrdmg01r.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                            gbrrdmg01r.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                              DT9i5dgVjk.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                DT9i5dgVjk.exeGet hashmaliciousLummaCBrowse
                                                                                                                                                                                                                                                  KMSpico.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                                    KMSpico.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                                                                      KMSPico.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                                                        KMSPico.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                                                          Created / dropped Files

                                                                                                                                                                                                                                                          C:\Program Files\KMSpico\AutoPico.exe (copy)

                                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp
                                                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                                          Size (bytes):745664
                                                                                                                                                                                                                                                          Entropy (8bit):6.3215449570323585
                                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                                          SSDEEP:6144:PBQ5SFgDZoQ4en4UgkPKPjmHzo9mfXOXD7ID3omUtu1omUt8AVSlf84mN6DDhBLA:PBq7bgkmsWT7I7omT1omoVSlK8bQF
                                                                                                                                                                                                                                                          MD5:CFE1C391464C446099A5EB33276F6D57
                                                                                                                                                                                                                                                          SHA1:9999BFCDED2C953E025EABAA66B4971DAB122C24
                                                                                                                                                                                                                                                          SHA-256:4A714D98CE40F5F3577C306A66CB4A6B1FF3FD01047C7F4581F8558F0BCDF5FA
                                                                                                                                                                                                                                                          SHA-512:4119A1722202BBC33339747EA02FD35B327890D55BB472CD1E2146CA446D8BA6FDDB1E8CF8BBFAEB08AEC8ED2A9D5C0FA71B73510D409FFACD3908FA72BB53B4
                                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 75%
                                                                                                                                                                                                                                                          Joe Sandbox View:
                                                                                                                                                                                                                                                          • Filename: KMSpico.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: KMSpico.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: gbrrdmg01r.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: gbrrdmg01r.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: DT9i5dgVjk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: DT9i5dgVjk.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: KMSpico.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: KMSpico.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: KMSPico.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          • Filename: KMSPico.exe, Detection: malicious, Browse
                                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u,.V.................<...........Z... ...`....@.. ..............................r.....@..................................Z..K....`..@............P............................................................... ............... ..H............text....:... ...<.................. ..`.rsrc...@....`.......>..............@..@.reloc...............N..............@..B.................Z......H........F...>.........................................................R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5...7..u.nG..q.).o.b......V>K..y ....x.Z...3...1...Y'.._`Q....J.-.z.....;M.*....<.S.a.+.~.w.&.i.cU!.}0.1.2.3.4.5.6.7.8.9.A.B.C.D.E.F.B.C.D.F.G.H.J.K.M.P.Q.R.T.V.W.X.Y.2.3.4.6.7.8.9.6OF:.c._.1.u.H........d.W..G.PX0$..b.y.c|w{.ko.0.g+..v..}.YG.....r.

                                                                                                                                                                                                                                                          C:\Program Files\KMSpico\DevComponents.DotNetBar2.dll (copy)

                                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp
                                                                                                                                                                                                                                                          File Type:PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                                          Size (bytes):5480448
                                                                                                                                                                                                                                                          Entropy (8bit):6.041123739783949
                                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                                          SSDEEP:49152:qfbOajjGpxko0ppeUIyIhObj0oCt3OFQHVD5Exm1VKV0PUeWDRNCttxf73UvnkLY:Tajj0xP0jeUIyIhObj0oCt3Vp1VKV0
                                                                                                                                                                                                                                                          MD5:1397B23F30681F97049DF61F94F54D05
                                                                                                                                                                                                                                                          SHA1:5CB1CE6966E3D6D8B8C398CBD537C814312F194D
                                                                                                                                                                                                                                                          SHA-256:FA76151A783250014AC8FA55D4C833100A623FCAD1D6E2DDADCDE259F5709609
                                                                                                                                                                                                                                                          SHA-512:7D001B5942DAD8CE1A83831B5A87F2FA6A1571BC133CE3C1EBE9988A43A7FCEFC5CDB7870A6E692EF89FB815CFCFF0E9C4B41F24BA0716C6808F190EA3C53535
                                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...;..............!.....`S..........eS.. ....S...... ........................T.....XDT...@...................................S.(.....S.......................S.......................................................S.............. ..H............textxc..ES.. ...PS................. ..`.datax..|.....S......`S.............@....idata..V.....S......pS.............@..@.reloc........S.......S.............@..B.rsrc.........S.......S.............@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                                                          C:\Program Files\KMSpico\KMSELDI.exe (copy)

                                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp
                                                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                                          Size (bytes):943808
                                                                                                                                                                                                                                                          Entropy (8bit):6.767661273441453
                                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                                          SSDEEP:12288:sBMSCV2RM+V8PW/+jSZOgJ38Ry3niRTiAH7UrbwIpmOs8b2i:snCEM68Lj5gNi2niRTiq7UrbnbsQ2i
                                                                                                                                                                                                                                                          MD5:F0280DE3880EF581BF14F9CC72EC1C16
                                                                                                                                                                                                                                                          SHA1:43D348E164C35F9E02370F6F66186FBFB15AE2A3
                                                                                                                                                                                                                                                          SHA-256:50EBFA1DD5B147E40244607D5D5BE25709EDF2CC66247A78BEB920C77AC514CC
                                                                                                                                                                                                                                                          SHA-512:AC31A972E9E93E6671F44D403139B0DB89D950097C848FBAF6B9965B722215F74E9ED9BB9E083D31328101E6FCFE7F960A08B3BEA0813900F11D5C1BB40539A6
                                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 71%
                                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...w,.V.....................T........... ... ....@.. ..............................|.....@.................................@...K.... ..8Q...........V............................................................... ............... ..H............text........ ...................... ..`.rsrc...8Q... ...R..................@..@.reloc...............T..............@..B................p.......H.................d....N..............................................R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5...7..u.nG..q.).o.b......V>K..y ....x.Z...3...1...Y'.._`Q....J.-.z.....;M.*....<.S.a.+.~.w.&.i.cU!.}0.1.2.3.4.5.6.7.8.9.A.B.C.D.E.F.B.C.D.F.G.H.J.K.M.P.Q.R.T.V.W.X.Y.2.3.4.6.7.8.9.6OF:.c._.1.u.H........d.W..G.PX0$..b.y.c|w{.ko.0.g+..v..}.YG.....r.

                                                                                                                                                                                                                                                          C:\Program Files\KMSpico\Service_KMS.exe (copy)

                                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp
                                                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                                          Size (bytes):745664
                                                                                                                                                                                                                                                          Entropy (8bit):6.319463845420173
                                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                                          SSDEEP:12288:ABElRekhdrAuBRFm/2ekyQVBomT1omoVSlK8b0v:wElReXuBRM29LToYlKQ0v
                                                                                                                                                                                                                                                          MD5:8D0C31D282CC9194791EA850041C6C45
                                                                                                                                                                                                                                                          SHA1:004AC977DF699CB322B183F798F50E195FB2FC79
                                                                                                                                                                                                                                                          SHA-256:2B533757086499E224D5717F94A0F4C33E705398A7610219D82B9D3BC8763378
                                                                                                                                                                                                                                                          SHA-512:CA73AC23681D783203824F0666F3D0F3F5450AD820D9E376F799AD4F6E43C8D926FA277270358D26D8B1F3518AEC048B87C06FC7A55D0870B769169771BF4D8A
                                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 76%
                                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...v,.V.................<...........Z... ...`....@.. ....................................@..................................Y..S....`..X............P............................................................... ............... ..H............text...4:... ...<.................. ..`.rsrc...X....`.......>..............@..@.reloc...............N..............@..B.................Z......H........F...=..........<...............................................R.j.06.8.@......|.9../..4.CD....T{.2..#=.L..B..N...f(.$.v[.Im..%r..d.h...\.]e..lpHP...^.FW.............X...E..,...?.........k:..AOg.......s..t".5...7..u.nG..q.).o.b......V>K..y ....x.Z...3...1...Y'.._`Q....J.-.z.....;M.*....<.S.a.+.~.w.&.i.cU!.}0.1.2.3.4.5.6.7.8.9.A.B.C.D.E.F.B.C.D.F.G.H.J.K.M.P.Q.R.T.V.W.X.Y.2.3.4.6.7.8.9.6OF:.c._.1.u.H........d.W..G.PX0$..b.y.c|w{.ko.0.g+..v..}.YG.....r.

                                                                                                                                                                                                                                                          C:\Program Files\KMSpico\UninsHs.exe (copy)

                                                                                                                                                                                                                                                          Download File
                                                                                                                                                                                                                                                          Process:C:\Users\user\AppData\Local\Temp\is-4JS13.tmp\KMSpico.tmp
                                                                                                                                                                                                                                                          File Type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
                                                                                                                                                                                                                                                          Category:dropped
                                                                                                                                                                                                                                                          Size (bytes):30208
                                                                                                                                                                                                                                                          Entropy (8bit):7.345126286705076
                                                                                                                                                                                                                                                          Encrypted:false
                                                                                                                                                                                                                                                          SSDEEP:768:W9UWjkIgObdRPcgs7KJPdTyf83EMpX/E9Et:pWj3gOLI7edWf4D/B
                                                                                                                                                                                                                                                          MD5:245824502AEFE21B01E42F61955AA7F4
                                                                                                                                                                                                                                                          SHA1:A58682A8AAE6302F1C934709C5AA1F6C86B2BE99
                                                                                                                                                                                                                                                          SHA-256:0A265B4BB8ACCEAFAFFB001632FA7E4C3F8AC39A71EDA37F253E15BC1B8DB90D
                                                                                                                                                                                                                                                          SHA-512:204B39E31F22BA99CF09C5C8458FC94EA21B47AACC4ABD305F71BA20A35D36BFC0FF53B95180542911C9C6F259DB897DEE76090D953F7EE18A8079CAEFDA7981
                                                                                                                                                                                                                                                          Malicious:true
                                                                                                                                                                                                                                                          Antivirus:
                                                                                                                                                                                                                                                          • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                                                          Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........1.._.._.._.V.L..._.$.M.._...Y.._.Rich._.................PE..L....$.H.................`... .......C.......P....@..........................p..............................................Xi.......P..X...........................................................................................................UPX0....................................UPX1.....`.......V..................@....rsrc.... ...P.......Z..............@..............................................................................................................................................................................................................................................................................................................................................................................................................................................3.03.UPX!....

                                                                                                                                                                                                                                                          C:\Program Files\KMSpico\Vestris.ResourceLib.dll (copy)