Техническая информация
Для обеспечения автозапуска и распространения:
Создает следующие сервисы:
- [<HKLM>\SYSTEM\ControlSet001\Services\Service KMSELDI] 'Start' = '00000002'
Вредоносные функции:
Для обхода брандмауэра удаляет или модифицирует следующие ключи реестра:
- [<HKLM>\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] '%PROGRAM_FILES%\KMSpico\KMSServer.exe' = '%PROGRAM_FILES%\KMSpico\KMSServer.exe:*:Enabled:CODYQX4 Emulator'
Создает и запускает на исполнение:
- '%TEMP%\is-2MPGN.tmp\KMSpico_setup.tmp' /SL5="$20108,886168,419840,%TEMP%\KMSpico\KMSpico_setup.exe" /verysilent
- '%PROGRAM_FILES%\KMSpico\KMSELDI.exe' /mtk /silent /log /backup /music
- '%TEMP%\RarSFX0\KMSpico.exe'
- '%TEMP%\KMSpico\KMSpico_setup.exe' /verysilent
Запускает на исполнение:
- '<SYSTEM32>\sc.exe' create "KMSServerService" DisplayName= "KMS Server Service" binPath= "%PROGRAM_FILES%\KMSpico\KMSServer.exe" obj= "NT AUTHORITY\NetworkService"
- '<SYSTEM32>\sc.exe' delete "KMSServerService"
- '<SYSTEM32>\sc.exe' create "Service KMSELDI" binPath= "%PROGRAM_FILES%\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"
Изменения в файловой системе:
Создает следующие файлы:
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-NTI5T.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-U0BHG.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-6AI5R.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-NVTQU.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-4GNVS.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-D3PR4.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-54VMP.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-0BBPK.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-RKH3K.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-EOMNJ.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-4L7BI.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-4R6I7.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-VFH82.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-USGEQ.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-5N81Q.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-OHMIA.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-V6RP6.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-BEPBP.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-V5TTO.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-BE3AN.tmp
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Log KMSpico.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Check KMSpico.lnk
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\KMSpico.lnk
- %PROGRAM_FILES%\KMSpico\sounds\is-HAJLV.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-0HL61.tmp
- %PROGRAM_FILES%\KMSpico\KMSServer.exe
- %PROGRAM_FILES%\KMSpico\KMSpico.log
- %PROGRAM_FILES%\KMSpico\dumm
- %ALLUSERSPROFILE%\Start Menu\Programs\KMSpico\Uninstall KMSpico.lnk
- %PROGRAM_FILES%\KMSpico\unins000.dat
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-3U9T2.tmp
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-P7E4M.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-5AUOI.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-EA369.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-GCRE4.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-9GRPH.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-GD4KD.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-66UU7.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-2OA14.tmp
- %PROGRAM_FILES%\KMSpico\sounds\is-EQUUJ.tmp
- %PROGRAM_FILES%\KMSpico\is-9PA5O.tmp
- %PROGRAM_FILES%\KMSpico\is-KR8QO.tmp
- %PROGRAM_FILES%\KMSpico\is-QOGBQ.tmp
- %PROGRAM_FILES%\KMSpico\is-QSL9O.tmp
- %PROGRAM_FILES%\KMSpico\is-E1ORS.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-OCT3B.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-KR9HU.tmp
- %PROGRAM_FILES%\KMSpico\is-OQ163.tmp
- %PROGRAM_FILES%\KMSpico\is-GLU3V.tmp
- %PROGRAM_FILES%\KMSpico\is-INSJ9.tmp
- %TEMP%\RarSFX0\SetupComplete.cmd
- %TEMP%\KMSpico\KMSpico_setup.exe
- %TEMP%\RarSFX0\RunOnce.reg
- %TEMP%\RarSFX0\Clean.cmd
- %TEMP%\RarSFX0\KMSpico.exe
- %PROGRAM_FILES%\KMSpico\is-392R2.tmp
- %PROGRAM_FILES%\KMSpico\is-TTJ6V.tmp
- %TEMP%\is-6HS1U.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-2MPGN.tmp\KMSpico_setup.tmp
- %TEMP%\is-6HS1U.tmp\_isetup\_RegDLL.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-5E0LH.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-DC4CH.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-DH175.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-17B64.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-1V18O.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-T3PE8.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-U537F.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-48LNL.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-GRVBP.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-5TO5D.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-N5O1I.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-SEVLA.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-DUVS9.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-SNK86.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-I0FPL.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-I6OPC.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-U6ILK.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-CV3IJ.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-73NM9.tmp
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-1IHI9.tmp
Присваивает атрибут 'скрытый' для следующих файлов:
- %PROGRAM_FILES%\KMSpico\KMSServer.exe
- %PROGRAM_FILES%\KMSpico\Service_KMS.exe
Удаляет следующие файлы:
- %TEMP%\RarSFX0\RunOnce.reg
- %TEMP%\RarSFX0\KMSpico.exe
- %TEMP%\RarSFX0\SetupComplete.cmd
- %PROGRAM_FILES%\KMSpico\KMSServer.exe
- %PROGRAM_FILES%\KMSpico\dumm
- %TEMP%\is-6HS1U.tmp\_isetup\_shfoldr.dll
- %TEMP%\is-6HS1U.tmp\_isetup\_RegDLL.tmp
- %TEMP%\is-2MPGN.tmp\KMSpico_setup.tmp
- %TEMP%\RarSFX0\Clean.cmd
- %TEMP%\KMSpico\KMSpico_setup.exe
Перемещает следующие файлы:
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-NVTQU.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-4GNVS.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-OHMIA.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-V6RP6.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-U0BHG.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-RKH3K.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-6AI5R.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-NTI5T.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-VFH82.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-4L7BI.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-USGEQ.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-5N81Q.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PHN.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-BE3AN.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-BEPBP.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\proplus.reg
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-4R6I7.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-V5TTO.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\sounds\is-EQUUJ.tmp в %PROGRAM_FILES%\KMSpico\sounds\begin.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-66UU7.tmp в %PROGRAM_FILES%\KMSpico\sounds\complete.mp3
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-P7E4M.tmp в %PROGRAM_FILES%\KMSpico\cert\office2010vl\tokens.dat
- %PROGRAM_FILES%\KMSpico\sounds\is-2OA14.tmp в %PROGRAM_FILES%\KMSpico\sounds\affirmative.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-HAJLV.tmp в %PROGRAM_FILES%\KMSpico\sounds\verified.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-0HL61.tmp в %PROGRAM_FILES%\KMSpico\sounds\warning.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-9GRPH.tmp в %PROGRAM_FILES%\KMSpico\sounds\diagnostic.mp3
- %PROGRAM_FILES%\KMSpico\sounds\is-GD4KD.tmp в %PROGRAM_FILES%\KMSpico\sounds\transfer.mp3
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-D3PR4.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-54VMP.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-EOMNJ.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PHN.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-0BBPK.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-5AUOI.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\visio.reg
- %PROGRAM_FILES%\KMSpico\cert\office2010vl\is-3U9T2.tmp в %PROGRAM_FILES%\KMSpico\cert\office2010vl\Office14RegInfo.reg
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-EA369.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\is-GCRE4.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\visio\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-OCT3B.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-KR9HU.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\is-INSJ9.tmp в %PROGRAM_FILES%\KMSpico\TriggerKMS.exe
- %PROGRAM_FILES%\KMSpico\is-OQ163.tmp в %PROGRAM_FILES%\KMSpico\UnInstall_Service.cmd
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-DUVS9.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-N5O1I.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-SNK86.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-I0FPL.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\is-QSL9O.tmp в %PROGRAM_FILES%\KMSpico\Install_Service.cmd
- %PROGRAM_FILES%\KMSpico\is-E1ORS.tmp в %PROGRAM_FILES%\KMSpico\IPAddressControlLib.dll
- %PROGRAM_FILES%\KMSpico\is-392R2.tmp в %PROGRAM_FILES%\KMSpico\unins000.exe
- %PROGRAM_FILES%\KMSpico\is-TTJ6V.tmp в %PROGRAM_FILES%\KMSpico\Check_Activation_All.cmd
- %PROGRAM_FILES%\KMSpico\is-KR8QO.tmp в %PROGRAM_FILES%\KMSpico\Log.cmd
- %PROGRAM_FILES%\KMSpico\is-GLU3V.tmp в %PROGRAM_FILES%\KMSpico\Service_KMS.exe
- %PROGRAM_FILES%\KMSpico\is-QOGBQ.tmp в %PROGRAM_FILES%\KMSpico\KMSELDI.exe
- %PROGRAM_FILES%\KMSpico\is-9PA5O.tmp в %PROGRAM_FILES%\KMSpico\KMSpico.log
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-DC4CH.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-GRVBP.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-DH175.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\project.reg
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-5E0LH.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-T3PE8.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-U537F.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-5TO5D.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\is-48LNL.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\proplus\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-1IHI9.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-CV3IJ.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-SEVLA.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-73NM9.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-17B64.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PL.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-1V18O.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PPDLIC.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-I6OPC.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.OOB.xrm-ms
- %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\is-U6ILK.tmp в %PROGRAM_FILES%\KMSpico\cert\kmscert2013\project\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PHN.xrm-ms
Другое:
Ищет следующие окна:
- ClassName: 'Shell_TrayWnd' WindowName: ''
- ClassName: 'EDIT' WindowName: ''
