Edit tour

Windows Analysis Report
KMSpico.exe

Overview

General Information

Sample name:	KMSpico.exe
Analysis ID:	1632207
MD5:	d70ab01c774cb1b93c518ce62bec27cf
SHA1:	23e3e816d95ca8527f3ab26a4ce7bd42e4fa5b3a
SHA256:	81e4808bcd2b11a4fd3b23668882628bcbdce55c62009daa4b97b15e421e6d13
Tags:	exeLummaStealeruser-aachum
Infos:

Detection

LummaC Stealer

Score:	82
Range:	0 - 100
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected AntiVM3

Yara detected LummaC Stealer

.NET source code contains potential unpacker

C2 URLs / IPs found in malware configuration

Changes security center settings (notifications, updates, antivirus, firewall)

Disables the Smart Screen filter

Found many strings related to Crypto-Wallets (likely being stolen)

Sample uses string decryption to hide its real strings

Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges

Sigma detected: Silenttrinity Stager Msbuild Activity

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Costura Assembly Loader

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Sigma detected: Use Short Name Path in Command Line

Stores files to the Windows start menu directory

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

KMSpico.exe (PID: 7008 cmdline: "C:\Users\user\Desktop\KMSpico.exe" MD5: D70AB01C774CB1B93C518CE62BEC27CF)

KMSpico.tmp (PID: 7032 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp" /SL5="$103B4,33390065,844800,C:\Users\user\Desktop\KMSpico.exe" MD5: E4C43138CCB8240276872FD1AEC369BE)

KMSpico.exe (PID: 3556 cmdline: "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" MD5: A02164371A50C5FF9FA2870EF6E8CFA3)

KMSpico.tmp (PID: 5136 cmdline: "C:\Users\user~1\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp" /SL5="$2044E,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe" MD5: 1778C1F66FF205875A6435A33229AB3C)

cmd.exe (PID: 7056 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 776 cmdline: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI" MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

cmd.exe (PID: 7076 cmdline: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd"" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3244 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6856 cmdline: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F MD5: 76CD6626DD8834BD4A42E6A565104DC2)

UninsHs.exe (PID: 6096 cmdline: "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe MD5: 245824502AEFE21B01E42F61955AA7F4)

KMSELDI.exe (PID: 6184 cmdline: "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup MD5: F0280DE3880EF581BF14F9CC72EC1C16)

core.exe (PID: 2368 cmdline: "C:\Users\user\AppData\Roaming\MyApp\core.exe" MD5: 439A40D01995AB73701DDF4BA440BE40)

MSBuild.exe (PID: 6652 cmdline: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe" MD5: 8FDF47E0FF70C40ED3A17014AEEA4232)

chrome.exe (PID: 3372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 4492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,6215369390879059982,17652730807270396997,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2424 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

svchost.exe (PID: 6260 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6632 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6724 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6752 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

sppsvc.exe (PID: 6796 cmdline: C:\Windows\system32\sppsvc.exe MD5: 320823F03672CEB82CC3A169989ABD12)

svchost.exe (PID: 5648 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5460 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 1472 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

AutoPico.exe (PID: 7044 cmdline: "C:\Program Files\KMSpico\AutoPico.exe" /silent MD5: CFE1C391464C446099A5EB33276F6D57)

WerFault.exe (PID: 5572 cmdline: C:\Windows\system32\WerFault.exe -u -p 7044 -s 1624 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 1396 cmdline: C:\Windows\System32\svchost.exe -k WerSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

WerFault.exe (PID: 968 cmdline: C:\Windows\system32\WerFault.exe -pss -s 432 -p 7044 -ip 7044 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

svchost.exe (PID: 1808 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 4604 cmdline: C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 1508 cmdline: C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

cleanup

Malware Configuration

Threatname: LummaC

{"C2 url": ["agriework.life", "explorebieology.run", "moderzysics.top", "seedsxouts.shop", "codxefusion.top", "farfinable.top", "techspherxe.top"], "Build id": "AEeq9Q--for"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000000A.00000002.1599992271.000000000526A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.1604119169.0000000006FD0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000016.00000002.2863240024.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
0000000A.00000002.1573432475.00000000042DE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
00000016.00000002.2868508738.00000000015D3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000A.00000002.1599992271.0000000005591000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Process Memory Space: core.exe PID: 2368	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
Process Memory Space: core.exe PID: 2368	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: MSBuild.exe PID: 6652	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 5 entries

Unpacked PEs

Source	Rule	Description	Author
10.2.core.exe.6fd0000.11.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
22.2.MSBuild.exe.400000.0.raw.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
10.2.core.exe.6fd0000.11.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
10.2.core.exe.562bf64.7.raw.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
10.2.core.exe.562bf64.7.unpack	JoeSecurity_CosturaAssemblyLoader	Yara detected Costura Assembly Loader	Joe Security
22.2.MSBuild.exe.400000.0.unpack	JoeSecurity_LummaCStealer_4	Yara detected LummaC Stealer	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, CommandLine: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, CommandLine|base64offset|contains: H!", Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7076, ParentProcessName: cmd.exe, ProcessCommandLine: SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F, ProcessId: 6856, ProcessName: schtasks.exe

Sigma detected: Silenttrinity Stager Msbuild Activity

Source: Network Connection

Author: Kiran kumar s, oscd.community: Data: DestinationIp: 149.154.167.99, DestinationIsIpv6: false, DestinationPort: 443, EventID: 3, Image: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, Initiated: true, ProcessId: 6652, Protocol: tcp, SourceIp: 192.168.2.7, SourceIsIpv6: false, SourcePort: 49689

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223, CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223, CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe", ParentImage: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe, ParentProcessId: 6652, ParentProcessName: MSBuild.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223, ProcessId: 3372, ProcessName: chrome.exe

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp" /SL5="$103B4,33390065,844800,C:\Users\user\Desktop\KMSpico.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp" /SL5="$103B4,33390065,844800,C:\Users\user\Desktop\KMSpico.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp, NewProcessName: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp, OriginalFileName: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp, ParentCommandLine: "C:\Users\user\Desktop\KMSpico.exe", ParentImage: C:\Users\user\Desktop\KMSpico.exe, ParentProcessId: 7008, ParentProcessName: KMSpico.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp" /SL5="$103B4,33390065,844800,C:\Users\user\Desktop\KMSpico.exe" , ProcessId: 7032, ProcessName: KMSpico.tmp

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", CommandLine: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", CommandLine|base64offset|contains: , Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd"", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 7056, ParentProcessName: cmd.exe, ProcessCommandLine: sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI", ProcessId: 776, ProcessName: sc.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 628, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6260, ProcessName: svchost.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:08:56.045257+0100	2028371	3	Unknown Traffic	192.168.2.7	49689	149.154.167.99	443	TCP
2025-03-07T21:08:58.389091+0100	2028371	3	Unknown Traffic	192.168.2.7	49690	104.21.32.1	443	TCP
2025-03-07T21:09:00.835047+0100	2028371	3	Unknown Traffic	192.168.2.7	49692	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:08:58.847075+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49690	104.21.32.1	443	TCP
2025-03-07T21:09:01.680891+0100	2054653	1	A Network Trojan was detected	192.168.2.7	49692	104.21.32.1	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-03-07T21:08:58.847075+0100	2049836	1	A Network Trojan was detected	192.168.2.7	49690	104.21.32.1	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: farfinable.top	Avira URL Cloud: Label: malware
Source: agriework.life	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["agriework.life", "explorebieology.run", "moderzysics.top", "seedsxouts.shop", "codxefusion.top", "farfinable.top", "techspherxe.top"], "Build id": "AEeq9Q--for"}

Multi AV Scanner detection for dropped file

Source: C:\Program Files\KMSpico\AutoPico.exe (copy)	ReversingLabs: Detection: 75%
Source: C:\Program Files\KMSpico\KMSELDI.exe (copy)	ReversingLabs: Detection: 71%
Source: C:\Program Files\KMSpico\Service_KMS.exe (copy)	ReversingLabs: Detection: 76%
Source: C:\Program Files\KMSpico\is-6NLBA.tmp	ReversingLabs: Detection: 71%
Source: C:\Program Files\KMSpico\is-DAA62.tmp	ReversingLabs: Detection: 76%
Source: C:\Program Files\KMSpico\is-IIAU3.tmp	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe (copy)	ReversingLabs: Detection: 73%
Source: C:\Users\user\AppData\Roaming\MyApp\data\is-LB333.tmp	ReversingLabs: Detection: 73%

Multi AV Scanner detection for submitted file

Source: KMSpico.exe	ReversingLabs: Detection: 21%
Source: KMSpico.exe	Virustotal: Detection: 30%			Perma Link

Sample uses string decryption to hide its real strings

Source: 0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: agriework.life
Source: 0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: explorebieology.run
Source: 0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: moderzysics.top
Source: 0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: seedsxouts.shop
Source: 0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: codxefusion.top
Source: 0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: farfinable.top
Source: 0000000A.00000002.1599992271.000000000586A000.00000004.00000800.00020000.00000000.sdmp	String decryptor: techspherxe.top

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041C281 CryptUnprotectData,		22_2_0041C281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041C281 CryptUnprotectData,		22_2_0041C281

Source: core.exe, 0000000A.00000000.1322050546.00000000018D3000.00000002.00000001.01000000.0000000D.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_87307bcc-a

Source: KMSpico.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Access	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Word	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Access	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Word	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Core	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Education	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Enterprise	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Core	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Core	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\driver	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\icons	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\logs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\unins000.dat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\is-L75HR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\is-IIAU3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\is-C96NM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\is-GQU4U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\is-6NLBA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\is-DAA62.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\is-2L4A1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-7L8L1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-H7F0B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-SM9U4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-KH0DC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-IB7SS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-N18QG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-C5UVT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Access\is-17DH9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-SUSN9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-DSH1H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-QE8I5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-JVVND.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-HG3D0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-OPD17.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-3JPFI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Excel\is-J4D5I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-7D2QQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-SJN9A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-69E6V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-EPS5G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-RHIHF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-TUTDH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-MS2R2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Groove\is-NRH4U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-GB0LM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-7QU5K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-UR92J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-I5SLL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-NHO08.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-2I7DC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-DEU8B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\InfoPath\is-U39DC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-F75TS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-AGK4H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-7A1B1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-S9A5S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-390FA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-U3AEQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-AA8TE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\OneNote\is-NN7SS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-D9C9B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-2HPJV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-3KP69.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-95FK5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-JS2KN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-6VNVP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-SVQ0B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Outlook\is-FM0HE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-J8NE5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-L8120.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-EPCQC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-1LPUG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-0HV6E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-80JEA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-CR2N2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\PowerPoint\is-1V992.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-11L29.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-5NESI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-AQID8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-CDO2T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-NA0QE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-7OI8E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-U7E7K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectPro\is-LHQ1O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-FBSRM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-TCPHM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-B5Q4U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-0MQVC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-RHS6P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-21RS3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-HM1NV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProjectStd\is-O9CPG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-RGGGE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-6B9FD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-OPE7E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-RELHT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-ERG1E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-JC9NB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-T3SE4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\ProPlus\is-SSTEA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-SVRMG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-NQP3L.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-GAIQO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-M4SOG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-3J50C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-MB784.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-UVNG3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Publisher\is-QS9U6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-57K3S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-KLKSG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-QB64T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-VP7H5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-PLDPL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-J3HSG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-BG63S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\SmallBusBasics\is-GEI74.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-98PEH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-RMR7S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-TG0BR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-NPEPS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-55738.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-0PP2D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-JPLFG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Standard\is-6FO74.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-LDLCH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-A7SJR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-AMJLJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-AVDGL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-V1NJ5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-OVU7T.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-74COT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-MEVS6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-AVRJR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-GEREB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-3BC85.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-IF0JF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-VSFVB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-T3KQU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-E2D64.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-ICF4A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-7U9QE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Visio\is-NSC5D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-PFG9H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-KK70C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-4FATS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-DS29H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-VLHT5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-ENDTG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-OJ7MC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2010\Word\is-RPL72.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\is-9UVVN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\is-811LB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\is-SID4N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\is-KNU1N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\is-GLG40.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\is-EC65O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\is-JA6TK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-JMF18.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-GMLGO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Access\is-OBJGC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-3I59R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-VBHHE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Excel\is-SLN0L.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-GI3R1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-U6365.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\InfoPath\is-FN421.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-MQ52I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-DC1FF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Lync\is-35C3A.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-CUO6O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-9BFP5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\OneNote\is-0PKRD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-UN261.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-72GNB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Outlook\is-QPSR6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-JQIGK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-03473.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\PowerPoint\is-DQVFJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-3JTJE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-8Q94R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectPro\is-JGJJ7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-OG3F8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-IP50K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProjectStd\is-8DFHR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-GOQB5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-KP6Q1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-MPTLH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\ProPlus\is-4GILB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-NVH3M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-SLSNM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Publisher\is-8JVOS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-4N3H4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-U055I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Standard\is-QFVK0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-TS75E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-NS5AT.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-HVUDG.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioPro\is-AMEUN.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-G599V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-E3RCF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\VisioStd\is-DL5C9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-J1DBH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-EJB95.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2013\Word\is-6TN3H.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\is-9J96K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\is-EEUI9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\is-NCNPR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\is-6O61S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\is-NC5L9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\is-L95EL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\is-UNL6N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-FKVT7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-AM951.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Access\is-H520D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-GKREH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-0EKFB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Excel\is-37QMK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-KAFBA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-37A42.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Mondo\is-5UPLV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-GMVUP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-JL1N4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\OneNote\is-MOUE1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-HLPIS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-IF369.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Outlook\is-AU4FI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-9C977.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-HJ0BP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\PowerPoint\is-SAP9R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-QVO4C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-BB4UB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectPro\is-CEAAF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-I37Q7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-P0G9B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProjectStd\is-A2BM6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-E2HSL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-J4AS7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\ProPlus\is-EOHM7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-EQD5G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-N8TK4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Publisher\is-NLR8G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-IVG6N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-MT4MV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\SkypeforBusiness\is-CLE6J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-99KBS.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-9JCQJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Standard\is-IOF9E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-84CDR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-7UQ73.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioPro\is-38JLK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-1E1FJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-O8N7J.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\VisioStd\is-L9VES.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-RIPVI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-5VTG6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscert2016\Word\is-1BHLK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\is-7IBC0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-TMS44.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Core\is-SA960.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-RCGTL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Education\is-DJVR6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-ULRJ2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Enterprise\is-QQ3VO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-GJA9E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-LMVD6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-50T05.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\EnterpriseS\is-MGT07.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-8216P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW10\Professional\is-GBJ6P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\is-T6634.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-758U4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-FOL7B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-GRH0N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-26RNO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-GGO48.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-1PG0V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-L017N.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-A5VTP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-UQCHA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-7UJDA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-5D4SI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Business\is-E0FOU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-BEFO3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-9G7A7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-81RJV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-BU1GV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-7J8VB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-MC7PB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-6D9MM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-CB2HL.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-IAJ1O.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-BEJ0G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-GOU1G.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\BusinessN\is-OBLAO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-7GIE5.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-JAN9E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-G7O55.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-PNFFV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-T7B78.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-F611S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-0QE6C.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-3ENP2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-CVN3P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-R38RJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-L8ITU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW6\Enterprise\is-AO41Q.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-EEREH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-9F1CA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-DUROI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-VNN9V.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-H0V67.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Embedded\is-OT5DQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-KI6N0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-TEVL8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-9P0TK.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-G75TQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-LO0E1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-GLKBD.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-JDCRF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-JRNU3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-QJA6D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW7\Professional\is-SRJO7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\is-5HIQH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-GF2KC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Core\is-B6VSR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-F41BE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreN\is-GSS9I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-TSDAE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\CoreSingleLanguage\is-BSU24.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-M93OO.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Enterprise\is-LU2B8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-68DE0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\EnterpriseN\is-EI7QV.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-VP2O0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\Professional\is-JC3ME.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-4KKGR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalN\is-POD04.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-0S54S.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW8\ProfessionalWMC\is-I3QLQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\is-MJU8M.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-ERFUC.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Core\is-RJEV4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-S2J84.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\CoreConnectedSingleLanguage\is-4FUFA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-0TBMF.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\EmbeddedIndustry\is-N0VAH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-JE105.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Enterprise\is-BFF2E.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-LLPT4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\Professional\is-A8EER.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-7OL4K.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ProfessionalWMC\is-TDU3R.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-I7OR4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerDatacenter\is-1PBNP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-EJKGA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\cert\kmscertW81\ServerStandard\is-HJRP8.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\driver\is-SRHD6.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\driver\is-EHRL3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\driver\is-CTDHU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\driver\is-A08CE.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\driver\is-5DT42.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\icons\is-MALQI.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\icons\is-6TEC9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\icons\is-OJ2B4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\icons\is-E4C4I.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\logs\is-4S2VU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\logs\is-JSQM3.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\logs\is-O8K73.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-LMB7B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-5BR0U.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-RC1Q2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-KM2M2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-CR9P7.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-JK2TA.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-95KN1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-4MQHQ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-8DVQU.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-SJAOR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-DTRVM.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\scripts\is-2QUO2.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-9KK17.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-DLBR9.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-9FDQP.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-N6MAJ.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-TU1KR.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-Q56GB.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-4L433.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-EIQF4.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-03UIH.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-6O07P.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-80I7B.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Directory created: C:\Program Files\KMSpico\sounds\is-1U4FD.tmp	Jump to behavior
Source: C:\Program Files\KMSpico\KMSELDI.exe	Directory created: C:\Program Files\KMSpico\logs\KMSELDI.log
Source: C:\Program Files\KMSpico\AutoPico.exe	Directory created: C:\Program Files\KMSpico\logs\AutoPico.log

Source: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MyApp_is1

Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.7:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.32.1:443 -> 192.168.2.7:49692 version: TLS 1.2

Source:	Binary string: System.Windows.Forms.pdb source: KMSELDI.exe, 00000014.00000002.2879607649.000000001B343000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: KMSELDI.exe, 00000014.00000002.2879607649.000000001B343000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\dll\System.pdb source: AutoPico.exe, 00000015.00000002.1654858797.0000000019E31000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdbt source: KMSELDI.exe, 00000014.00000002.2879607649.000000001B343000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dlls.pdb source: KMSELDI.exe, 00000014.00000002.2879607649.000000001B3C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdbSHA256e source: core.exe, 0000000A.00000002.1604419678.0000000007210000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1599992271.00000000057A3000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1599992271.000000000572B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: lib.pdb source: KMSELDI.exe, 00000014.00000002.2888927032.000000001D271000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\divert-master\install\WDDK\i386\WinDivert.pdb source: KMSpico.tmp, 0000000C.00000002.2872839221.0000000006160000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2872839221.0000000006766000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1540774715.0000000000012000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1544048779.00000000000C8000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.pdbdlle source: AutoPico.exe, 00000015.00000002.1651589363.00000000006AE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net40\Microsoft.Win32.TaskScheduler.pdb source: core.exe, 0000000A.00000002.1604419678.0000000007210000.00000004.08000000.00040000.00000000.sdmp, core.exe, 0000000A.00000002.1599992271.00000000057A3000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1599992271.000000000572B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdbH source: KMSpico.tmp, 0000000C.00000002.2872839221.0000000006160000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2872839221.0000000006766000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1540774715.0000000000012000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1544048779.00000000000C8000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: pC:\Program Files\KMSpico\AutoPico.PDB@ source: AutoPico.exe, 00000015.00000002.1651477320.00000000004F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdbSHA256}Lq source: core.exe, 0000000A.00000002.1599992271.000000000526A000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1604187455.0000000007060000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: OindoC:\Windows\System.pdb source: AutoPico.exe, 00000015.00000002.1651477320.00000000004F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files\KMSpico\AutoPico.PDBp; source: AutoPico.exe, 00000015.00000002.1651477320.00000000004F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.pdb source: KMSELDI.exe, 00000014.00000002.2879607649.000000001B3C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AutoPico.PDB source: AutoPico.exe, 00000015.00000002.1651477320.00000000004F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: protobuf-net.pdb source: core.exe, 0000000A.00000002.1599992271.000000000526A000.00000004.00000800.00020000.00000000.sdmp, core.exe, 0000000A.00000002.1604187455.0000000007060000.00000004.08000000.00040000.00000000.sdmp
Source:	Binary string: c:\Users\dblock\Source\CodePlex\resourcelib\trunk\Source\ResourceLib\obj\Release\Vestris.ResourceLib.pdb source: KMSpico.tmp, 0000000C.00000002.2872839221.000000000674F000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: m.pdb source: KMSELDI.exe, 00000014.00000002.2879607649.000000001B3C2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Program Files\KMSpico\AutoPico.PDB source: AutoPico.exe, 00000015.00000002.1651477320.00000000004F4000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: c:\divert-master\install\WDDK\amd64\WinDivert.pdb source: KMSpico.tmp, 0000000C.00000002.2872839221.0000000006160000.00000004.00001000.00020000.00000000.sdmp, KMSpico.tmp, 0000000C.00000002.2872839221.0000000006766000.00000004.00001000.00020000.00000000.sdmp, KMSELDI.exe, 00000014.00000000.1540774715.0000000000012000.00000002.00000001.01000000.00000011.sdmp, AutoPico.exe, 00000015.00000000.1544048779.00000000000C8000.00000002.00000001.01000000.00000012.sdmp

Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00452A60 FindFirstFileA,GetLastError,	12_2_00452A60
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_0047531C FindFirstFileA,FindNextFileA,FindClose,	12_2_0047531C
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00464158 SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	12_2_00464158
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004985E4 FindFirstFileA,SetFileAttributesA,FindNextFileA,FindClose,	12_2_004985E4
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00462750 FindFirstFileA,FindNextFileA,FindClose,	12_2_00462750
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00463CDC SetErrorMode,FindFirstFileA,FindNextFileA,FindClose,SetErrorMode,	12_2_00463CDC
Source: C:\Program Files\KMSpico\UninsHs.exe	Code function: 16_2_00401C98 FindFirstFileA,MessageBoxA,RtlZeroMemory,7558D0A0,	16_2_00401C98

Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov eax, ebx	22_2_00425800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+esi*8], 5F115B3Dh	22_2_0044F1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	22_2_0044C2C8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6Eh]	22_2_0041C281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	22_2_0041C281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+2D625574h]	22_2_00423B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then add edi, 02h	22_2_0041B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx+50h]	22_2_00445ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edx+ebx*8], 744E5843h	22_2_0044A050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [ecx+esi]	22_2_00402800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edi-1D950A4Ch]	22_2_0040C880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+08h], esi	22_2_0044E8B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, word ptr [ecx]	22_2_0044E8B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax+17A26B3Eh]	22_2_00431960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, di	22_2_00431960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx eax, byte ptr [esp+edx+565E2674h]	22_2_0041090F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then jmp ecx	22_2_004339DE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-5F5D8690h]	22_2_004311F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov dword ptr [esp+3Ch], 00000800h	22_2_004311F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	22_2_004359A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_00424259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax]	22_2_00447A69
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [eax], cl	22_2_0041FA04
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0000009Ah]	22_2_0044B21F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, ebx	22_2_00407A30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	22_2_0040A2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	22_2_0040A2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [edi+edx*8], esi	22_2_0044E2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], dx	22_2_00424B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov ecx, dword ptr [00460F40h]	22_2_0044C31D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_0043A382
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edi, byte ptr [esp+eax]	22_2_00447B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx]	22_2_00447B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_00439BA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movsx ecx, byte ptr [esi+eax]	22_2_0041B3A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+ecx-52h]	22_2_0044CBA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-27D1E72Ah]	22_2_0044BC57
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+6Eh]	22_2_0041C281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov word ptr [eax], cx	22_2_0041C281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_0043947F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	22_2_00437410
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_00439428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	22_2_00446C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	22_2_0044B4D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-000000B2h]	22_2_0040F480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [ebx], al	22_2_00438482
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_00439491
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], 9F1F8F53h	22_2_0044A490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then cmp word ptr [ebp+edi+02h], 0000h	22_2_004294B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx edx, byte ptr [eax+edi]	22_2_0044AD40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-19B6A066h]	22_2_00421D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-23806A32h]	22_2_0042ED61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [esi], cl	22_2_00439572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edx], al	22_2_00411505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov byte ptr [edx], al	22_2_00411505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov esi, eax	22_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebp, byte ptr [esp+ecx+02h]	22_2_0042B610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax-0Eh]	22_2_00423EEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then mov edx, dword ptr [00458F2Ch]	22_2_00412EB2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-69FBEFB4h]	22_2_0044CF71
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	22_2_004427D0

Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49692 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.7:49690 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.7:49690 -> 104.21.32.1:443

Source: Malware configuration extractor	URLs: agriework.life
Source: Malware configuration extractor	URLs: explorebieology.run
Source: Malware configuration extractor	URLs: moderzysics.top
Source: Malware configuration extractor	URLs: seedsxouts.shop
Source: Malware configuration extractor	URLs: codxefusion.top
Source: Malware configuration extractor	URLs: farfinable.top
Source: Malware configuration extractor	URLs: techspherxe.top

Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 104.21.32.1 104.21.32.1
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49689 -> 149.154.167.99:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49692 -> 104.21.32.1:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.7:49690 -> 104.21.32.1:443

Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.15
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	TCP traffic detected without corresponding DNS query: 2.23.227.208
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /hyukonyas HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: t.me
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyA2KlwBX3mkFo30om9LUFYQhpqLoa_BNhE HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiKo8sBCIWgzQEI9s/OAQiA1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CI62yQEIpLbJAQipncoBCNrwygEIkqHLAQiKo8sBCIWgzQEI9s/OAQiA1s4BCMnczgEIhODOAQii5M4BCK/kzgEI6eTOAQ==Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: chrome.exe, 0000001C.00000002.2899257371.00000F9C00A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: core.exe, 0000000A.00000000.1322050546.00000000018D3000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: 04:7e:cb:e9:fc:a5:5f:7b:d0:9e:ae:36:e1:0c:ae:1email.google.comf5:c8:6a:f3:61:62:f1:3a:64:f5:4f:6d:c9:58:7c:06www.google.comd7:55:8f:da:f5:f1:10:5b:b2:13:28:2b:70:77:29:a3login.yahoo.com39:2a:43:4f:0e:07:df:1f:8a:a3:05:de:34:e0:c2:293e:75:ce:d4:6b:69:30:21:21:88:30:ae:86:a8:2a:71e9:02:8b:95:78:e4:15:dc:1a:71:0a:2b:88:15:44:47login.skype.com92:39:d5:34:8f:40:d1:69:5a:74:54:70:e1:f2:3f:43addons.mozilla.orgb0:b7:13:3e:d0:96:f9:b5:6f:ae:91:c8:74:bd:3a:c0login.live.comd8:f3:5f:4e:b7:87:2b:2d:ab:06:92:e3:15:38:2f:b0global trustee05:e2:e6:a4:cd:09:ea:54:d6:65:b0:75:fe:22:a2:56.google.com0c:76:da:9c:91:0c:4e:2c:9e:fe:15:d0:58:93:3c:4cDigiNotar Root CAf1:4a:13:f4:87:2b:56:dc:39:df:84:ca:7a:a1:06:49DigiNotar Services CA36:16:71:55:43:42:1b:9d:e6:cb:a3:64:41:df:24:38DigiNotar Services 1024 CA0a:82:bd:1e:14:4e:88:14:d7:5b:1a:55:27:be:bf:3eDigiNotar Root CA G2a4:b6:ce:e3:2e:d3:35:46:26:3c:b3:55:3a:a8:92:21CertiID Enterprise Certificate Authority5b:d5:60:9c:64:17:68:cf:21:0e:35:fd:fb:05:ad:41DigiNotar Qualified CA46:9c:2c:b007:27:10:0dDigiNotar Cyber CA07:27:0f:f907:27:10:0301:31:69:b0DigiNotar PKIoverheid CA Overheid en Bedrijven01:31:34:bfDigiNotar PKIoverheid CA Organisatie - G2d6:d0:29:77:f1:49:fd:1a:83:f2:b9:ea:94:8c:5c:b4DigiNotar Extended Validation CA1e:7d:7a:53:3d:45:30:41:96:40:0f:71:48:1f:45:04DigiNotar Public CA 202546:9c:2c:af46:9c:3c:c907:27:14:a9Digisign Server ID (Enrich)4c:0e:63:6aDigisign Server ID - (Enrich)72:03:21:05:c5:0c:08:57:3d:8e:a5:30:4e:fe:e8:b0UTN-USERFirst-Hardware41MD5 Collisions Inc. (http://www.phreedom.org/md5)08:27.EGO.GOV.TR08:64e-islem.kktcmerkezbankasi.org03:1d:a7AC DG Tr equals www.yahoo.com (Yahoo)
Source: chrome.exe, 0000001C.00000003.1688020772.00000F9C0146C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3\|\|(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i
Source: chrome.exe, 0000001C.00000003.1688020772.00000F9C0146C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: <!--_html_template_end_-->`}const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends CrLitElement{constructor(){super(...arguments);this.url={url:""}}static get is(){return"ntp-doodle-share-dialog"}static get styles(){return getCss$2()}render(){return getHtml$2.bind(this)()}static get properties(){return{title:{type:String},url:{type:Object}}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.fire("share",channel)}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);let instance$3=null;function getCss$1(){return instance$3\|\|(instance$3=[...[getCss$4()],css`:host{--ntp-logo-height:168px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#doodle{position:relative}#shareButton{background-color:var(--color-new-tab-page-doodle-share-button-background,none);border:none;height:32px;min-width:32px;padding:0;position:absolute;width:32px;bottom:0}:host-context([dir=ltr]) #shareButton{right:-40px}:host-context([dir=rtl]) #shareButton{left:-40px}#shareButtonIcon{width:18px;height:18px;margin:7px;vertical-align:bottom;mask-image:url(chrome://new-tab-page/icons/share_unfilled.svg);background-color:var(--color-new-tab-page-doodle-share-button-i
Source: chrome.exe, 0000001C.00000002.2899257371.00000F9C00A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 0000001C.00000002.2899257371.00000F9C00A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 0000001C.00000002.2899257371.00000F9C00A4C000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)
Source: chrome.exe, 0000001C.00000003.1718531006.00000F9C00580000.00000004.00001000.00020000.00000000.sdmp, chrome.exe, 0000001C.00000002.2897261896.00000F9C00580000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: c.pki.goog
Source: global traffic	DNS traffic detected: DNS query: t.me
Source: global traffic	DNS traffic detected: DNS query: 69.170.12.0.in-addr.arpa
Source: global traffic	DNS traffic detected: DNS query: agriework.life
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gcp.gvt2.com
Source: global traffic	DNS traffic detected: DNS query: beacons.gvt2.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49671 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	File created: C:\Program Files\KMSpico\driver\is-EHRL3.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	File created: C:\Program Files\KMSpico\driver\is-CTDHU.tmp	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	File created: C:\Program Files\KMSpico\driver\OpenVPN.cer (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	File created: C:\Program Files\KMSpico\driver\certELDI.pfx (copy)	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_0042F520 NtdllDefWindowProc_A,	12_2_0042F520
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00423B84 NtdllDefWindowProc_A,	12_2_00423B84
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004125D8 NtdllDefWindowProc_A,	12_2_004125D8
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00478E54 NtdllDefWindowProc_A,	12_2_00478E54
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00457594 PostMessageA,PostMessageA,SetForegroundWindow,NtdllDefWindowProc_A,	12_2_00457594
Source: C:\Program Files\KMSpico\UninsHs.exe	Code function: 16_2_00401000 BeginPaint,GetStockObject,SelectObject,Rectangle,MoveToEx,LineTo,MoveToEx,LineTo,CreatePen,SelectObject,DeleteObject,MoveToEx,LineTo,MoveToEx,LineTo,SelectObject,DeleteObject,LoadBitmapA,SelectObject,ExitProcess,DeleteDC,DeleteObject,wsprintfA,SelectObject,SetBkColor,DrawTextA,SelectObject,SetBkColor,DrawTextA,LoadIconA,DrawIcon,LoadIconA,DrawIcon,LoadIconA,DrawIcon,GetSysColor,SetBkColor,DrawTextA,DrawTextA,DrawTextA,GetSysColor,SetBkColor,DrawTextA,GetSysColor,SetBkColor,DrawTextA,SelectObject,CreateFontA,CreateWindowExA,SendMessageA,CreateWindowExA,SendMessageA,CreateWindowExA,SendMessageA,CreateFontA,CreateWindowExA,SendMessageA,SetFocus,CreateWindowExA,SendMessageA,SetFocus,CreateWindowExA,SendMessageA,SetFocus,SetTimer,SendMessageA,GetClientRect,ShowWindow,ShowWindow,ShowWindow,ShowWindow,InvalidateRect,lstrcpy,wsprintfA,lstrcpy,ShowWindow,ShowWindow,ShowWindow,wsprintfA,WinExec,ShowWindow,wsprintfA,GetStartupInfoA,InvalidateRect,CloseHandle,EnableWindow,SetWindowTextA,InvalidateRect,ShowWindow,WinExec,InvalidateRect,SendMessageA,SetFocus,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,EnableWindow,GetClientRect,InvalidateRect,DeleteObject,DeleteObject,KillTimer,PostQuitMessage,NtdllDefWindowProc_A,	16_2_00401000

Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe	Code function: 8_2_00409448 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		8_2_00409448
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004555E4 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,		12_2_004555E4

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	File created: C:\Windows\system32\is-95P9D.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	File created: C:\Windows\system32\is-N17B1.tmp	Jump to behavior

Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe	Code function: 8_2_0040840C	8_2_0040840C
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_038F0481	10_2_038F0481
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_038F0000	10_2_038F0000
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_068A20C0	10_2_068A20C0
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_068AF2A0	10_2_068AF2A0
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_068A1A77	10_2_068A1A77
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_068A2225	10_2_068A2225
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_068A20AF	10_2_068A20AF
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_068AB3EE	10_2_068AB3EE
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_068AB3F8	10_2_068AB3F8
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_068AB988	10_2_068AB988
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_0790F960	10_2_0790F960
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_0790E378	10_2_0790E378
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_078F0026	10_2_078F0026
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Code function: 10_2_078F0040	10_2_078F0040
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004707F8	12_2_004707F8
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00480DD3	12_2_00480DD3
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004673A4	12_2_004673A4
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_0043035C	12_2_0043035C
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_0048E360	12_2_0048E360
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004444C8	12_2_004444C8
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004345C4	12_2_004345C4
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00444A70	12_2_00444A70
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00430EE8	12_2_00430EE8
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00486FAC	12_2_00486FAC
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_0045F0C4	12_2_0045F0C4
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00445168	12_2_00445168
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_0045B174	12_2_0045B174
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004352C8	12_2_004352C8
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00469420	12_2_00469420
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00445574	12_2_00445574
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_004519BC	12_2_004519BC
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_0043DD50	12_2_0043DD50
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: 12_2_00487F0C	12_2_00487F0C
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F82493	20_2_00007FFB99F82493
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99FD8908	20_2_00007FFB99FD8908
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F90760	20_2_00007FFB99F90760
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F90770	20_2_00007FFB99F90770
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F907B5	20_2_00007FFB99F907B5
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F84E8F	20_2_00007FFB99F84E8F
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F81AF0	20_2_00007FFB99F81AF0
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F8F110	20_2_00007FFB99F8F110
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F90740	20_2_00007FFB99F90740
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F90768	20_2_00007FFB99F90768
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F90788	20_2_00007FFB99F90788
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F80FD1	20_2_00007FFB99F80FD1
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB99F80FF8	20_2_00007FFB99F80FF8
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB9A140629	20_2_00007FFB9A140629
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB9A287791	20_2_00007FFB9A287791
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB9A298CB5	20_2_00007FFB9A298CB5
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB9A2924EC	20_2_00007FFB9A2924EC
Source: C:\Program Files\KMSpico\KMSELDI.exe	Code function: 20_2_00007FFB9A283A1F	20_2_00007FFB9A283A1F
Source: C:\Program Files\KMSpico\AutoPico.exe	Code function: 21_2_00007FFB99FA9FF2	21_2_00007FFB99FA9FF2
Source: C:\Program Files\KMSpico\AutoPico.exe	Code function: 21_2_00007FFB99FAAD6E	21_2_00007FFB99FAAD6E
Source: C:\Program Files\KMSpico\AutoPico.exe	Code function: 21_2_00007FFB99FA1598	21_2_00007FFB99FA1598
Source: C:\Program Files\KMSpico\AutoPico.exe	Code function: 21_2_00007FFB99FABA30	21_2_00007FFB99FABA30
Source: C:\Program Files\KMSpico\AutoPico.exe	Code function: 21_2_00007FFB99FA9246	21_2_00007FFB99FA9246
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00425800	22_2_00425800
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041E0A3	22_2_0041E0A3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044F1C0	22_2_0044F1C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041C281	22_2_0041C281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00449AA0	22_2_00449AA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00425B70	22_2_00425B70
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0040BB90	22_2_0040BB90
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041B470	22_2_0041B470
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041E4EE	22_2_0041E4EE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004164A7	22_2_004164A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0040ED50	22_2_0040ED50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00426520	22_2_00426520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044BDCB	22_2_0044BDCB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00445ED0	22_2_00445ED0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00401040	22_2_00401040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044D840	22_2_0044D840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044A050	22_2_0044A050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0042A010	22_2_0042A010
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00435020	22_2_00435020
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0042B030	22_2_0042B030
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044D8C0	22_2_0044D8C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004220CA	22_2_004220CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0042E0E0	22_2_0042E0E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004200E7	22_2_004200E7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041E0F3	22_2_0041E0F3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0040C880	22_2_0040C880
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0042E890	22_2_0042E890
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044E8B0	22_2_0044E8B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00431960	22_2_00431960
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00420100	22_2_00420100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00418120	22_2_00418120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004311F8	22_2_004311F8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00430980	22_2_00430980
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00431180	22_2_00431180
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0042A9B0	22_2_0042A9B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00424259	22_2_00424259
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00445270	22_2_00445270
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044320A	22_2_0044320A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00426230	22_2_00426230
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004172CB	22_2_004172CB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004332ED	22_2_004332ED
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00408AF0	22_2_00408AF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004402F0	22_2_004402F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0040A2B0	22_2_0040A2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044E2B0	22_2_0044E2B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00424B40	22_2_00424B40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00402B30	22_2_00402B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00445B30	22_2_00445B30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004133D2	22_2_004133D2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0043A382	22_2_0043A382
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00447B8F	22_2_00447B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00439BA3	22_2_00439BA3
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041C281	22_2_0041C281
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00439428	22_2_00439428
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00427C30	22_2_00427C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00446C30	22_2_00446C30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00434CC7	22_2_00434CC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004254D0	22_2_004254D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044B4D6	22_2_0044B4D6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004454D0	22_2_004454D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004094E0	22_2_004094E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0040F480	22_2_0040F480
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00439491	22_2_00439491
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044A490	22_2_0044A490
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004294B0	22_2_004294B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044DCB0	22_2_0044DCB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00430D40	22_2_00430D40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0040C550	22_2_0040C550
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00421D50	22_2_00421D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00403560	22_2_00403560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0042ED61	22_2_0042ED61
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00439572	22_2_00439572
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044D570	22_2_0044D570
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00413D00	22_2_00413D00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00411505	22_2_00411505
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0043B52D	22_2_0043B52D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044ED30	22_2_0044ED30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004225C0	22_2_004225C0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0040B5E0	22_2_0040B5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00437DE1	22_2_00437DE1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0040CDF0	22_2_0040CDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0043DDF0	22_2_0043DDF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00430589	22_2_00430589
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00410DB0	22_2_00410DB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00433649	22_2_00433649
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00437E54	22_2_00437E54
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041DE7C	22_2_0041DE7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00407E10	22_2_00407E10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00432E38	22_2_00432E38
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004476D0	22_2_004476D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0043A6E0	22_2_0043A6E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00443EAD	22_2_00443EAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0041DE7C	22_2_0041DE7C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00433F50	22_2_00433F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0043BF50	22_2_0043BF50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00446F50	22_2_00446F50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00444759	22_2_00444759
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00408F60	22_2_00408F60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00403F00	22_2_00403F00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044C70C	22_2_0044C70C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00437720	22_2_00437720
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00431FC0	22_2_00431FC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_004047E2	22_2_004047E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00406FE6	22_2_00406FE6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0043FFF0	22_2_0043FFF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_00431FA0	22_2_00431FA0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: 22_2_0044D7B0	22_2_0044D7B0

Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00408C0C appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00406AC4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 0040595C appears 117 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00457F1C appears 77 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00403400 appears 60 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00445DD4 appears 45 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00457D10 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 004344DC appears 32 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 004078F4 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00403494 appears 83 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00403684 appears 226 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 00453344 appears 98 times
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Code function: String function: 004460A4 appears 59 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0041B460 appears 112 times
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Code function: String function: 0040B2D0 appears 51 times

Source: KMSpico.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: is-I4K1U.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: KMSpico.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32+ executable (console) x86-64, for MS Windows
Source: KMSpico.tmp.8.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Source: KMSpico.tmp.8.dr	Static PE information: Resource name: RT_VERSION type: 370 sysV pure executable not stripped

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report KMSpico.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Windows Analysis Report
KMSpico.exe

Source: KMSpico.exe	Static PE information: Number of sections : 11 > 10
Source: is-I4K1U.tmp.1.dr	Static PE information: Number of sections : 11 > 10
Source: KMSpico.tmp.0.dr	Static PE information: Number of sections : 11 > 10

Source: KMSpico.exe, 00000000.00000003.1001850638.0000000003173000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs KMSpico.exe
Source: KMSpico.exe, 00000000.00000003.1004253630.000000007EFAF000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs KMSpico.exe
Source: KMSpico.exe, 00000000.00000000.998556609.0000000000AF9000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs KMSpico.exe
Source: KMSpico.exe, 00000008.00000003.1286194771.0000000002330000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs KMSpico.exe
Source: KMSpico.exe, 00000008.00000003.1290387178.0000000001F88000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameshfolder.dll~/ vs KMSpico.exe

Source: 10.2.core.exe.7210000.13.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 10.2.core.exe.7210000.13.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'
Source: 10.2.core.exe.7210000.13.raw.unpack, Task.cs	Task registration methods: 'RegisterChanges', 'CreateTask'
Source: 10.2.core.exe.7210000.13.raw.unpack, TaskService.cs	Task registration methods: 'CreateFromToken'
Source: 10.2.core.exe.5753770.3.raw.unpack, ITaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask'
Source: 10.2.core.exe.5753770.3.raw.unpack, TaskFolder.cs	Task registration methods: 'RegisterTaskDefinition', 'RegisterTask', 'CreateFolder'

Source: 10.2.core.exe.5753770.3.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.core.exe.7210000.13.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 10.2.core.exe.5753770.3.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 10.2.core.exe.5753770.3.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 10.2.core.exe.7210000.13.raw.unpack, TaskPrincipal.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 10.2.core.exe.5753770.3.raw.unpack, User.cs	Security API names: System.Security.Principal.SecurityIdentifier.Translate(System.Type)
Source: 10.2.core.exe.7210000.13.raw.unpack, Task.cs	Security API names: Microsoft.Win32.TaskScheduler.Task.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 10.2.core.exe.7210000.13.raw.unpack, TaskFolder.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskFolder.GetAccessControl(System.Security.AccessControl.AccessControlSections)
Source: 10.2.core.exe.7210000.13.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 10.2.core.exe.7210000.13.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)
Source: 10.2.core.exe.5753770.3.raw.unpack, TaskSecurity.cs	Security API names: Microsoft.Win32.TaskScheduler.TaskSecurity.GetAccessControlSectionsFromChanges()
Source: 10.2.core.exe.5753770.3.raw.unpack, TaskSecurity.cs	Security API names: System.Security.AccessControl.CommonObjectSecurity.AddAccessRule(System.Security.AccessControl.AccessRule)

Source: C:\Program Files\KMSpico\AutoPico.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3244:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \BaseNamedObjects\Local\WERReportingForProcess7044
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:7032:120:WilError_03

Source: C:\Users\user\Desktop\KMSpico.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\KMSpico.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: chrome.exe, 0000001C.00000002.2907602526.00000F9C02214000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(metric_value) FROM metrics WHERE metrics.metric_hash = 'CE71BF280B4EB4B5' AND metrics.metric_value > 45;
Source: chrome.exe, 0000001C.00000002.2907602526.00000F9C02214000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(metric_value) FROM metrics WHERE metrics.metric_hash = 'CE71BF280B4EB4B5' AND metrics.metric_value > 120;
Source: chrome.exe, 0000001C.00000002.2900971039.00000F9C00E38000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT COUNT(DISTINCT CAST((event_timestamp / 1000000 / 60 / 10) AS int)) FROM metrics WHERE metrics.metric_hash = 'B4CFE8741404B691' AND metrics.metric_value > 0;
Source: chrome.exe, 0000001C.00000002.2901177080.00000F9C00ED4000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SELECT IFNULL(SUM(metrics.metric_value), 0) FROM metrics WHERE metrics.metric_hash = '534661B278B11BD';

Source: unknown	Process created: C:\Users\user\Desktop\KMSpico.exe "C:\Users\user\Desktop\KMSpico.exe"
Source: C:\Users\user\Desktop\KMSpico.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp "C:\Users\user~1\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp" /SL5="$103B4,33390065,844800,C:\Users\user\Desktop\KMSpico.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\sppsvc.exe C:\Windows\system32\sppsvc.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp	Process created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp	Process created: C:\Users\user\AppData\Roaming\MyApp\core.exe "C:\Users\user\AppData\Roaming\MyApp\core.exe"
Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp "C:\Users\user~1\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp" /SL5="$2044E,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe"
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Process created: C:\Program Files\KMSpico\UninsHs.exe "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Process created: C:\Program Files\KMSpico\KMSELDI.exe "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup
Source: unknown	Process created: C:\Program Files\KMSpico\AutoPico.exe "C:\Program Files\KMSpico\AutoPico.exe" /silent
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k WerSvcGroup
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 7044 -ip 7044
Source: C:\Program Files\KMSpico\AutoPico.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7044 -s 1624
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,6215369390879059982,17652730807270396997,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2424 /prefetch:3
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\KMSpico.exe	Process created: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp "C:\Users\user~1\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp" /SL5="$103B4,33390065,844800,C:\Users\user\Desktop\KMSpico.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp	Process created: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe "C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-BO18O.tmp\KMSpico.tmp	Process created: C:\Users\user\AppData\Roaming\MyApp\core.exe "C:\Users\user\AppData\Roaming\MyApp\core.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe	Process created: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp "C:\Users\user~1\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp" /SL5="$2044E,2952592,69120,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe"	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\AppData\Roaming\MyApp\core.exe	Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Process created: C:\Program Files\KMSpico\UninsHs.exe "C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\user\AppData\Roaming\MyApp\data\KMSpico.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Process created: C:\Program Files\KMSpico\KMSELDI.exe "C:\Program Files\KMSpico\KMSELDI.exe" /silent /backup	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\sc.exe sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default" --remote-debugging-port=9223
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -pss -s 432 -p 7044 -ip 7044
Source: C:\Windows\System32\svchost.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 7044 -s 1624
Source: C:\Windows\System32\WerFault.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2356,i,6215369390879059982,17652730807270396997,262144 --variations-seed-version=20250306-183004.429000 --mojo-platform-channel-handle=2424 /prefetch:3
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: I accept the agreement
Source: C:\Users\user\AppData\Local\Temp\is-PE1VH.tmp\KMSpico.tmp	Automated click: Next >
Source: C:\Program Files\KMSpico\KMSELDI.exe	Automated click: Continue

Source: 10.2.core.exe.7210000.13.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 10.2.core.exe.7210000.13.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 10.2.core.exe.7210000.13.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties
Source: 10.2.core.exe.7060000.12.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 10.2.core.exe.7060000.12.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 10.2.core.exe.7060000.12.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 10.2.core.exe.7060000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 10.2.core.exe.7060000.12.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 10.2.core.exe.53664c8.1.raw.unpack, TypeModel.cs	.Net Code: TryDeserializeList
Source: 10.2.core.exe.53664c8.1.raw.unpack, ListDecorator.cs	.Net Code: Read
Source: 10.2.core.exe.53664c8.1.raw.unpack, TypeSerializer.cs	.Net Code: CreateInstance
Source: 10.2.core.exe.53664c8.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateInstance
Source: 10.2.core.exe.53664c8.1.raw.unpack, TypeSerializer.cs	.Net Code: EmitCreateIfNull
Source: 10.2.core.exe.5753770.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 10.2.core.exe.5753770.3.raw.unpack, ReflectionHelper.cs	.Net Code: InvokeMethod
Source: 10.2.core.exe.5753770.3.raw.unpack, XmlSerializationHelper.cs	.Net Code: ReadObjectProperties