Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Service KMSELDI] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\KMSpico\AutoPico.exe' = '%PROGRAM_FILES%\KMSpico\AutoPico.exe:*:Enabled:Hotbird64 - qad - CODYQX4 Emulator'
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\KMSpico\KMSServer.exe' = '%PROGRAM_FILES%\KMSpico\KMSServer.exe:*:Enabled:CODYQX4 Emulator'
Создает и запускает на исполнение:
- '%TEMP%\is-1GM81.tmp\KMSpico_setup.tmp' /SL5="$2010C,537762,66048,%TEMP%\KMSpico\KMSpico_setup.exe"
- '%PROGRAM_FILES%\KMSpico\KMSELDI.exe' /silent /log /backup
- '%PROGRAM_FILES%\KMSpico\AutoPico.exe'
- '%TEMP%\RarSFX0\K.exe'
- '%TEMP%\RarSFX0\setup.exe'
- '%TEMP%\KMSpico\KMSpico_setup.exe'
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' delete "KMSServerService"
- '<SYSTEM32>\sc.exe' create "KMSServerService" DisplayName= "KMS Server Service" binPath= "%PROGRAM_FILES%\KMSpico\KMSServer.exe" obj= "NT AUTHORITY\NetworkService"
- '<SYSTEM32>\schtasks.exe' /Create /TN "AutoPico Daily Restart" /TR "%PROGRAM_FILES%\KMSpico\AutoPico.exe" /SC DAILY /ST 11:59:59 /RU SYSTEM /RL Highest /F
- '<SYSTEM32>\sc.exe' create "Service KMSELDI" binPath= "%PROGRAM_FILES%\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\KMSpico\sounds\is-THRIO.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-MK77S.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-8RRHO.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-EH3JN.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-D5SV0.tmp
- %PROGRAM_FILES%\KMSpico\is-NG48T.tmp
- %PROGRAM_FILES%\KMSpico\is-R3KN1.tmp
- %PROGRAM_FILES%\KMSpico\is-4EQV5.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-BU32P.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-KUTVL.tmp
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-L40OT.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-148N2.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-GDK1Q.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-KBOTV.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-LFLMT.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-T8IO7.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-LTJ4U.tmp
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-3GD4D.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-H0R4M.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-7S2PP.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-GD2ST.tmp
- %PROGRAM_FILES%\KMSpico\is-MBOFP.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Uninstall KMSpico.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\AutoPico.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Check KMSpico.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\KMSpico.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Log KMSpico.lnk
- %PROGRAM_FILES%\KMSpico\KMSpico.log
- %PROGRAM_FILES%\KMSpico\KMSWrapper32.dll
- %PROGRAM_FILES%\KMSpico\KMSServer.exe
- %PROGRAM_FILES%\KMSpico\unins000.dat
- %PROGRAM_FILES%\KMSpico\dumm
- %PROGRAM_FILES%\KMSpico\is-P2H5U.tmp
- %PROGRAM_FILES%\KMSpico\is-JEH7U.tmp
- %PROGRAM_FILES%\KMSpico\is-LE36M.tmp
- %PROGRAM_FILES%\KMSpico\is-6RKME.tmp
- %PROGRAM_FILES%\KMSpico\is-KFB6S.tmp
- %PROGRAM_FILES%\KMSpico\is-7BG2J.tmp
- %PROGRAM_FILES%\KMSpico\is-8BAFB.tmp
- %PROGRAM_FILES%\KMSpico\is-HPH2T.tmp
- %PROGRAM_FILES%\KMSpico\is-D6UHS.tmp
- %PROGRAM_FILES%\KMSpico\is-D0L4M.tmp
- %PROGRAM_FILES%\KMSpico\is-7HFFR.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-HTS25.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-JUV16.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-E15BD.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-9FN4S.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-GA163.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-T9QFL.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-63H21.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-17RBL.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-PHCUI.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-3OLSM.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-JFPC9.tmp
- %TEMP%\is-1GM81.tmp\KMSpico_setup.tmp
- %TEMP%\is-SNNV1.tmp\_isetup\_RegDLL.tmp
- %TEMP%\KMSpico\KMSpico_setup.exe
- %TEMP%\RarSFX0\K.exe
- %TEMP%\RarSFX0\setup.exe
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-QP52T.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-JVRKD.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-VUVG1.tmp
- %TEMP%\is-SNNV1.tmp\_isetup\_shfoldr.dll
- %PROGRAM_FILES%\KMSpico\is-3RNEA.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-TPGL2.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-PO4T3.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-FRHOC.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-R5LIM.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-GK5K6.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-GE5D2.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-95IFC.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-UI2B3.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-VJB9S.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-BUR50.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-DMVPE.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-UCK42.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-3G1L9.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-5IUSI.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-FOUA9.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-8I08H.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-DTEF4.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-SSKFG.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-LUVVS.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-GA3I2.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-E6NI9.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-RSRL1.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\KMSpico\KMSServer.exe
- %PROGRAM_FILES%\KMSpico\Service_KMS.exe
Удаляет следующие файлы:
- %TEMP%\RarSFX0\K.exe
- %TEMP%\is-1GM81.tmp\KMSpico_setup.tmp
- %PROGRAM_FILES%\KMSpico\KMSWrapper32.dll
- %TEMP%\KMSpico\KMSpico_setup.exe
- %PROGRAM_FILES%\KMSpico\KMSServer.exe
- %PROGRAM_FILES%\KMSpico\dumm
- %TEMP%\is-SNNV1.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-SNNV1.tmp\_isetup\_RegDLL.tmp
Перемещает следующие файлы:
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-3GD4D.tmp в %PROGRAM_FILES%\KMSpico\cert\office2010vl\Office14RegInfo.reg
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-L40OT.tmp в %PROGRAM_FILES%\KMSpico\cert\office2010vl\tokens.dat
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-H0R4M.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-LTJ4U.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\visio.reg
- %PROGRAM_FILES%\KMSpico\sounds\is-8RRHO.tmp в %PROGRAM_FILES%\KMSpico\sounds\complete.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-THRIO.tmp в %PROGRAM_FILES%\KMSpico\sounds\diagnostic.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-EH3JN.tmp в %PROGRAM_FILES%\KMSpico\sounds\affirmative.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-D5SV0.tmp в %PROGRAM_FILES%\KMSpico\sounds\begin.mp3
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-GD2ST.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-LFLMT.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-T8IO7.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-95IFC.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-UI2B3.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-GDK1Q.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-7S2PP.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-KBOTV.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PHN.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-148N2.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\sounds\is-MK77S.tmp в %PROGRAM_FILES%\KMSpico\sounds\transfer.mp3
- %PROGRAM_FILES%\KMSpico\is-D0L4M.tmp в %PROGRAM_FILES%\KMSpico\Log.cmd
- %PROGRAM_FILES%\KMSpico\is-7HFFR.tmp в %PROGRAM_FILES%\KMSpico\Service_KMS.exe
- %PROGRAM_FILES%\KMSpico\is-JEH7U.tmp в %PROGRAM_FILES%\KMSpico\KMSWrapper32.dll
- %PROGRAM_FILES%\KMSpico\is-LE36M.tmp в %PROGRAM_FILES%\KMSpico\KMSWrapper64.dll
- %PROGRAM_FILES%\KMSpico\is-HPH2T.tmp в %PROGRAM_FILES%\KMSpico\TriggerKMS.exe
- %PROGRAM_FILES%\KMSpico\is-P2H5U.tmp в %PROGRAM_FILES%\KMSpico\UnInstall_Service.cmd
- %PROGRAM_FILES%\KMSpico\is-D6UHS.tmp в %PROGRAM_FILES%\KMSpico\Service_KMS.log
- %PROGRAM_FILES%\KMSpico\is-8BAFB.tmp в %PROGRAM_FILES%\KMSpico\Silent.cmd
- %PROGRAM_FILES%\KMSpico\is-6RKME.tmp в %PROGRAM_FILES%\KMSpico\KMSpico.log
- %PROGRAM_FILES%\KMSpico\is-4EQV5.tmp в %PROGRAM_FILES%\KMSpico\AutoPico.exe
- %PROGRAM_FILES%\KMSpico\is-NG48T.tmp в %PROGRAM_FILES%\KMSpico\AutoPico.log
- %PROGRAM_FILES%\KMSpico\sounds\is-BU32P.tmp в %PROGRAM_FILES%\KMSpico\sounds\verified.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-KUTVL.tmp в %PROGRAM_FILES%\KMSpico\sounds\warning.mp3
- %PROGRAM_FILES%\KMSpico\is-KFB6S.tmp в %PROGRAM_FILES%\KMSpico\Install_Task.cmd
- %PROGRAM_FILES%\KMSpico\is-7BG2J.tmp в %PROGRAM_FILES%\KMSpico\KMSELDI.exe
- %PROGRAM_FILES%\KMSpico\is-R3KN1.tmp в %PROGRAM_FILES%\KMSpico\Check_Activation_All.cmd
- %PROGRAM_FILES%\KMSpico\is-MBOFP.tmp в %PROGRAM_FILES%\KMSpico\Install_Service.cmd
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-3OLSM.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-17RBL.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PHN.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-JUV16.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-PHCUI.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-TPGL2.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\project.reg
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-8I08H.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-T9QFL.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-63H21.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-HTS25.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-QP52T.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-JVRKD.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\is-3RNEA.tmp в %PROGRAM_FILES%\KMSpico\unins000.exe
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-VUVG1.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-GA163.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-E15BD.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-JFPC9.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-9FN4S.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-DTEF4.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-R5LIM.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-PO4T3.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\proplus.reg
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-GK5K6.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-GE5D2.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-DMVPE.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-VJB9S.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-FRHOC.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-BUR50.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-UCK42.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-5IUSI.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-E6NI9.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-FOUA9.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-3G1L9.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-SSKFG.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PHN.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-LUVVS.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-RSRL1.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-GA3I2.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.OOB.xrm-ms
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: '(null)'
- ClassName: 'EDIT' WindowName: '(null)'
