Техническая информация
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\KMSpico\YW3ZJ16UTVV.exe' = '%PROGRAM_FILES%\KMSpico\YW3ZJ16UTVV.exe:*:Enabled:CODYQX4 Emulator'
Создает и запускает на исполнение:
- %TEMP%\KMSpico\KMSpico_setup.exe /PASSWORD=B478B478c0f8d9FA4OR4Vy6rJRMFdDT81vRL98gyea3oSNFgPFhArZ1i4sd2Sz5zY5e159LQjvPBDPRKCg2CUDxtZTUXNXjbL3BQmjN9dx2OBQUa0GYKotyLjPG4ORJaABKCJXbXm51fmuArZ1i4sd2Sz5zY5e159LQj /verysilent
- %TEMP%\is-UBKTT.tmp\KMSpico_setup.tmp /SL5="$200FE,995474,419840,%TEMP%\KMSpico\KMSpico_setup.exe" /PASSWORD=B478B478c0f8d9FA4OR4Vy6rJRMFdDT81vRL98gyea3oSNFgPFhArZ1i4sd2Sz5zY5e159LQjvPBDPRKCg2CUDxtZTUXNXjbL3BQmjN9dx2OBQUa0GYKotyLjPG4ORJaABKCJXbXm51fmuArZ1i4sd2Sz5zY5e159LQj /verysilent
- %PROGRAM_FILES%\KMSpico\KMSELDI.exe /mtk /silent /log /backup /music
- %TEMP%\rrfk.exe x "%TEMP%\qevnf.7z" -pmzshxbyqcf -o"%TEMP%\" -aoa
- %TEMP%\bzswltbd.exe
- %TEMP%\WindowsUpdate.exe
Запускает на исполнение:
- <SYSTEM32>\taskkill.exe /F /IM YW3ZJ16UTVV.exe
- <SYSTEM32>\reg.exe ADD HKCU\Software\TR2 /v uni /t REG_SZ /d 1
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-23BVI.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-EU5LP.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-1GAQ6.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-H360I.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-PK8FU.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-F24B3.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-P67QN.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-GOSF7.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-3HHD4.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-85CB3.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-HANVU.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-RG2NA.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-L8QBO.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-4RUTM.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-629H7.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-2IC3J.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-QR6JD.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-4DGSE.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-HB2EL.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-U5FN5.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-B6UAH.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-DKDU0.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Log KMSpico.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Check KMSpico.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\KMSpico.lnk
- %PROGRAM_FILES%\KMSpico\sounds\is-3G61S.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-641D1.tmp
- %PROGRAM_FILES%\KMSpico\YW3ZJ16UTVV.exe
- %PROGRAM_FILES%\KMSpico\KMSpico.log
- %PROGRAM_FILES%\KMSpico\data\dumm
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Uninstall KMSpico.lnk
- %PROGRAM_FILES%\KMSpico\unins000.dat
- %PROGRAM_FILES%\KMSpico\sounds\is-1VFV9.tmp
- %PROGRAM_FILES%\KMSpico\data\is-417LJ.tmp
- %PROGRAM_FILES%\KMSpico\data\is-1GQ9J.tmp
- %PROGRAM_FILES%\KMSpico\data\is-2N5CE.tmp
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-QOROL.tmp
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-SKLH8.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-FPKJQ.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-47KN1.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-GK78K.tmp
- %PROGRAM_FILES%\KMSpico\data\is-OV3CV.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-1FKQ1.tmp
- %PROGRAM_FILES%\KMSpico\is-JIG7F.tmp
- %PROGRAM_FILES%\KMSpico\is-DUB4I.tmp
- %PROGRAM_FILES%\KMSpico\is-HGRVA.tmp
- %PROGRAM_FILES%\KMSpico\is-L6FS6.tmp
- %PROGRAM_FILES%\KMSpico\is-EKI2A.tmp
- %PROGRAM_FILES%\KMSpico\is-P70C3.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-PRFVU.tmp
- %PROGRAM_FILES%\KMSpico\is-V7S56.tmp
- %PROGRAM_FILES%\KMSpico\is-G85R9.tmp
- %PROGRAM_FILES%\KMSpico\is-1FO72.tmp
- %PROGRAM_FILES%\KMSpico\is-0MDPJ.tmp
- %TEMP%\nsr2.tmp\ExecDos.dll
- %TEMP%\WindowsUpdate.exe
- %TEMP%\qevnf.7z
- %TEMP%\bzswltbd.exe
- %TEMP%\rrfk.exe
- %TEMP%\is-N7J4B.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-N7J4B.tmp\_isetup\_iscrypt.dll
- %TEMP%\is-N7J4B.tmp\_isetup\_RegDLL.tmp
- %TEMP%\KMSpico\KMSpico_setup.exe
- %TEMP%\is-UBKTT.tmp\KMSpico_setup.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-MNAPA.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-4EEQI.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-VB5AG.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-A8GOK.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-6INKL.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-FM959.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-6HDRI.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-J2J5Q.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-OU8EV.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-83UPC.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-RLJ03.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-2BQRJ.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-OUQNR.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-CBVN3.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-O06N1.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-EBO7F.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-JN8QH.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-UH8GP.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-B0PV1.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-N218C.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-6L4RJ.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-0O3RB.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\KMSpico\YW3ZJ16UTVV.exe
- %PROGRAM_FILES%\KMSpico\Service_KMS.exe
Удаляет следующие файлы:
- %TEMP%\KMSpico\KMSpico_setup.exe
- %TEMP%\is-UBKTT.tmp\KMSpico_setup.tmp
- %PROGRAM_FILES%\KMSpico\YW3ZJ16UTVV.exe
- %PROGRAM_FILES%\KMSpico\data\dumm
- %TEMP%\is-N7J4B.tmp\_isetup\_iscrypt.dll
- %TEMP%\nsr2.tmp\ExecDos.dll
- %TEMP%\is-N7J4B.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-N7J4B.tmp\_isetup\_RegDLL.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-PK8FU.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-1GAQ6.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-HANVU.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-H360I.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-3HHD4.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-85CB3.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-23BVI.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-EU5LP.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PHN.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-4DGSE.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-RG2NA.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-L8QBO.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-2IC3J.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-4RUTM.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-HB2EL.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-QR6JD.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-U5FN5.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-B6UAH.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\proplus.reg
- %PROGRAM_FILES%\KMSpico\sounds\is-GK78K.tmp в %PROGRAM_FILES%\KMSpico\sounds\begin.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-FPKJQ.tmp в %PROGRAM_FILES%\KMSpico\sounds\complete.mp3
- %PROGRAM_FILES%\KMSpico\data\is-OV3CV.tmp в %PROGRAM_FILES%\KMSpico\data\data_1_3.dat
- %PROGRAM_FILES%\KMSpico\sounds\is-1FKQ1.tmp в %PROGRAM_FILES%\KMSpico\sounds\affirmative.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-3G61S.tmp в %PROGRAM_FILES%\KMSpico\sounds\verified.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-641D1.tmp в %PROGRAM_FILES%\KMSpico\sounds\warning.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-47KN1.tmp в %PROGRAM_FILES%\KMSpico\sounds\diagnostic.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-1VFV9.tmp в %PROGRAM_FILES%\KMSpico\sounds\transfer.mp3
- %PROGRAM_FILES%\KMSpico\data\is-1GQ9J.tmp в %PROGRAM_FILES%\KMSpico\data\data_1_2.dat
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-P67QN.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-DKDU0.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\visio.reg
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-GOSF7.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-F24B3.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\data\is-2N5CE.tmp в %PROGRAM_FILES%\KMSpico\data\data_1_0.dat
- %PROGRAM_FILES%\KMSpico\data\is-417LJ.tmp в %PROGRAM_FILES%\KMSpico\data\data_1_1.dat
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-QOROL.tmp в %PROGRAM_FILES%\KMSpico\cert\office2010vl\Office14RegInfo.reg
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-SKLH8.tmp в %PROGRAM_FILES%\KMSpico\cert\office2010vl\tokens.dat
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-MNAPA.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-EBO7F.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\is-P70C3.tmp в %PROGRAM_FILES%\KMSpico\UnInstall_Service.cmd
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-PRFVU.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-OUQNR.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-CBVN3.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-JN8QH.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-O06N1.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\is-V7S56.tmp в %PROGRAM_FILES%\KMSpico\TriggerKMS.exe
- %PROGRAM_FILES%\KMSpico\is-EKI2A.tmp в %PROGRAM_FILES%\KMSpico\Install_Service.cmd
- %PROGRAM_FILES%\KMSpico\is-HGRVA.tmp в %PROGRAM_FILES%\KMSpico\IPAddressControlLib.dll
- %PROGRAM_FILES%\KMSpico\is-0MDPJ.tmp в %PROGRAM_FILES%\KMSpico\unins000.exe
- %PROGRAM_FILES%\KMSpico\is-L6FS6.tmp в %PROGRAM_FILES%\KMSpico\Check_Activation_All.cmd
- %PROGRAM_FILES%\KMSpico\is-G85R9.tmp в %PROGRAM_FILES%\KMSpico\Log.cmd
- %PROGRAM_FILES%\KMSpico\is-1FO72.tmp в %PROGRAM_FILES%\KMSpico\Service_KMS.exe
- %PROGRAM_FILES%\KMSpico\is-JIG7F.tmp в %PROGRAM_FILES%\KMSpico\KMSELDI.exe
- %PROGRAM_FILES%\KMSpico\is-DUB4I.tmp в %PROGRAM_FILES%\KMSpico\KMSpico.log
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-83UPC.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-RLJ03.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-4EEQI.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-VB5AG.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-J2J5Q.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-629H7.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PHN.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-OU8EV.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-6HDRI.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-A8GOK.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-N218C.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-UH8GP.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-6L4RJ.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-0O3RB.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-6INKL.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-FM959.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\project.reg
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-B0PV1.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PHN.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-2BQRJ.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PL.xrm-ms
Сетевая активность:
Подключается к:
- 'localhost':1038
- 'xv##bom.biz':80
- 'localhost':1035
TCP:
Запросы HTTP GET:
- xv##bom.biz/script/display.php
- xv##bom.biz/down.txt
UDP:
- DNS ASK xv##bom.biz
Другое:
Ищет следующие окна:
- ClassName: 'TkTopLevel' WindowName: 'Setup'
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: '' WindowName: ''
- ClassName: 'WindowsForms10.Window.208.app.0.378734a' WindowName: 'Setup'
- ClassName: '' WindowName: 'Preparing to install RealPlayer'
- ClassName: 'AppBundlerProgressClass' WindowName: ''
- ClassName: '#32770' WindowName: 'BuzzSocialPoints_DNS_IE Setup'
