API tools faq
paste
paladin316

Exes_8ac6048052fe6d058ea3c6b5a386e8c6_exe_2019-07-12_08_30.txt

paladin316
Jul 12th, 2019
2,334
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 61.82 KB | None | 0 0
raw download clone embed print report
  1.  
  2. * MalFamily: "Ramnit"
  3.  
  4. * MalScore: 10.0
  5.  
  6. * File Name: "Exes_8ac6048052fe6d058ea3c6b5a386e8c6.exe"
  7. * File Size: 3816884
  8. * File Type: "PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive"
  9. * SHA256: "26dabe0dcfdda0b276272aa36803e9c68d16c0c9be268bfcb63d5004b639db21"
  10. * MD5: "8ac6048052fe6d058ea3c6b5a386e8c6"
  11. * SHA1: "d1421972e36d14ec459b610eae60f1887d095038"
  12. * SHA512: "90830292633117c2b6990abed881dc39dfeb7cefdb060fda4748fcae3e37a82b20ee2b9fd7e3d6398af345e81c7a7827b52b7738a4e8e574233c5d5aad6918c3"
  13. * CRC32: "0490C867"
  14. * SSDEEP: "49152:wjyBJd4GWRIViV0a6iZqh/6DwjCY2KnltPf1v01WQu7JrvO6AXsJWIs7wNPym/2g:7B8eUV0xl/6DwN270TcyWNMNqmu5lPw"
  15.  
  16. * Process Execution:
  17. "Exes_8ac6048052fe6d058ea3c6b5a386e8c6.exe",
  18. "Exes_8ac6048052fe6d058ea3c6b5a386e8c6Srv.exe",
  19. "DesktopLayer.exe",
  20. "chrome.exe",
  21. "HEU_KMS_Activator_v11.2.0.EXE",
  22. "7Z.EXE",
  23. "kms_x64.exe",
  24. "DownLoader.sfx.exe",
  25. "DownLoader.exe",
  26. "cmd.exe",
  27. "services.exe",
  28. "OSPPSVC.EXE",
  29. "svchost.exe",
  30. "taskeng.exe",
  31. "taskeng.exe",
  32. "msoia.exe",
  33. "msoia.exe",
  34. "taskhost.exe",
  35. "svchost.exe",
  36. "WerFault.exe",
  37. "wermgr.exe"
  38.  
  39.  
  40. * Executed Commands:
  41. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_8ac6048052fe6d058ea3c6b5a386e8c6Srv.exe",
  42. "C:\\Windows\\Temp\\HEU_KMS_Activator_v11.2.0.EXE",
  43. "C:\\Windows\\Temp\\DownLoader.sfx.exe",
  44. "C:\\Program Files (x86)\\Microsoft\\DesktopLayer.exe",
  45. "C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe",
  46. "C:\\Users\\user\\AppData\\Local\\Temp\\7Z.EXE x C:\\Users\\user\\AppData\\Local\\Temp\\KMSmini.7z -y -oC:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\",
  47. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\kms_x64.exe",
  48. "C:\\Windows\\Temp\\DownLoader.exe ",
  49. "Clear.bat ",
  50. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE\"",
  51. "taskhost.exe $(Arg0)",
  52. "C:\\Windows\\System32\\svchost.exe -k WerSvcGroup",
  53. "taskeng.exe C01B87DA-9935-44D0-8424-8439147E6223 S-1-5-18:NT AUTHORITY\\System:Service:",
  54. "taskeng.exe 9E1E2ED1-F91D-4DCC-8CE3-924C3C87B52C S-1-5-21-0000000000-0000000000-0000000000-1000:Host\\user:Interactive:1",
  55. "C:\\Windows\\system32\\WerFault.exe -u -p 2268 -s 288",
  56. "\"C:\\Windows\\system32\\wermgr.exe\" \"-queuereporting_svc\" \"C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_08380aec\"",
  57. "\"C:\\Program Files\\Common Files\\Microsoft Shared\\Office15\\OLicenseHeartbeat.exe\"",
  58. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload mininterval:2880",
  59. "\"C:\\Program Files\\Microsoft Office\\Office15\\msoia.exe\" scan upload"
  60.  
  61.  
  62. * Signatures Detected:
  63.  
  64. "Description": "At least one process apparently crashed during execution",
  65. "Details":
  66.  
  67.  
  68. "Description": "Attempts to connect to a dead IP:Port (1 unique times)",
  69. "Details":
  70.  
  71. "IP": "218.92.218.38:80"
  72.  
  73.  
  74.  
  75.  
  76. "Description": "Creates RWX memory",
  77. "Details":
  78.  
  79.  
  80. "Description": "A process attempted to delay the analysis task.",
  81. "Details":
  82.  
  83. "Process": "svchost.exe tried to sleep 254 seconds, actually delayed analysis time by 0 seconds"
  84.  
  85.  
  86.  
  87.  
  88. "Description": "Reads data out of its own binary image",
  89. "Details":
  90.  
  91. "self_read": "process: Exes_8ac6048052fe6d058ea3c6b5a386e8c6.exe, pid: 2360, offset: 0x00000000, length: 0x003a3db0"
  92.  
  93.  
  94. "self_read": "process: Exes_8ac6048052fe6d058ea3c6b5a386e8c6.exe, pid: 2360, offset: 0x0001b01c, length: 0x00388d98"
  95.  
  96.  
  97. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x00000000, length: 0x00010000"
  98.  
  99.  
  100. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0000ffec, length: 0x00010000"
  101.  
  102.  
  103. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0001ffd8, length: 0x00010000"
  104.  
  105.  
  106. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0002ffc4, length: 0x00010000"
  107.  
  108.  
  109. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0003ffb0, length: 0x00010000"
  110.  
  111.  
  112. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0004ff9c, length: 0x00010000"
  113.  
  114.  
  115. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0005ff88, length: 0x00010000"
  116.  
  117.  
  118. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0006ff74, length: 0x00010000"
  119.  
  120.  
  121. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0007ff60, length: 0x00010000"
  122.  
  123.  
  124. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0008ff4c, length: 0x00010000"
  125.  
  126.  
  127. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0009ff38, length: 0x00010000"
  128.  
  129.  
  130. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x000aff24, length: 0x00010000"
  131.  
  132.  
  133. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x000b5414, length: 0x00001000"
  134.  
  135.  
  136. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x000b5428, length: 0x00000200"
  137.  
  138.  
  139. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x000b54b3, length: 0x00000200"
  140.  
  141.  
  142. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x000b54cf, length: 0x00000800"
  143.  
  144.  
  145. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x000b5c1b, length: 0x00000200"
  146.  
  147.  
  148. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x000b5c9e, length: 0x00000200"
  149.  
  150.  
  151. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x000b5e1b, length: 0x0027a000"
  152.  
  153.  
  154. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0032f42d, length: 0x00000200"
  155.  
  156.  
  157. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0032f4a0, length: 0x00000200"
  158.  
  159.  
  160. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0032f62d, length: 0x00048f45"
  161.  
  162.  
  163. "self_read": "process: HEU_KMS_Activator_v11.2.0.EXE, pid: 2380, offset: 0x0037856a, length: 0x00000008"
  164.  
  165.  
  166. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00000000, length: 0x00000007"
  167.  
  168.  
  169. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00000000, length: 0x00002000"
  170.  
  171.  
  172. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00000007, length: 0x00076987"
  173.  
  174.  
  175. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00001ff0, length: 0x00002000"
  176.  
  177.  
  178. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00003fe0, length: 0x00002000"
  179.  
  180.  
  181. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00005fd0, length: 0x00002000"
  182.  
  183.  
  184. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00007fc0, length: 0x00002000"
  185.  
  186.  
  187. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00009fb0, length: 0x00002000"
  188.  
  189.  
  190. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0000bfa0, length: 0x00002000"
  191.  
  192.  
  193. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0000df90, length: 0x00002000"
  194.  
  195.  
  196. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0000ff80, length: 0x00002000"
  197.  
  198.  
  199. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00011f70, length: 0x00002000"
  200.  
  201.  
  202. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00013f60, length: 0x00002000"
  203.  
  204.  
  205. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00015f50, length: 0x00002000"
  206.  
  207.  
  208. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00017f40, length: 0x00002000"
  209.  
  210.  
  211. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00019f30, length: 0x00002000"
  212.  
  213.  
  214. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0001bf20, length: 0x00002000"
  215.  
  216.  
  217. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0001df10, length: 0x00002000"
  218.  
  219.  
  220. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0001ff00, length: 0x00002000"
  221.  
  222.  
  223. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00021ef0, length: 0x00002000"
  224.  
  225.  
  226. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00023ee0, length: 0x00002000"
  227.  
  228.  
  229. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00025ed0, length: 0x00002000"
  230.  
  231.  
  232. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00027ec0, length: 0x00002000"
  233.  
  234.  
  235. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00029eb0, length: 0x00002000"
  236.  
  237.  
  238. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0002bea0, length: 0x00002000"
  239.  
  240.  
  241. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0002de90, length: 0x00002000"
  242.  
  243.  
  244. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0002fe80, length: 0x00002000"
  245.  
  246.  
  247. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00031e70, length: 0x00002000"
  248.  
  249.  
  250. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00033e60, length: 0x00002000"
  251.  
  252.  
  253. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00035e50, length: 0x00002000"
  254.  
  255.  
  256. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00037e40, length: 0x00002000"
  257.  
  258.  
  259. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00039e30, length: 0x00002000"
  260.  
  261.  
  262. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0003be20, length: 0x00002000"
  263.  
  264.  
  265. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0003de10, length: 0x00002000"
  266.  
  267.  
  268. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0003e800, length: 0x00000031"
  269.  
  270.  
  271. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x0003e819, length: 0x00038132"
  272.  
  273.  
  274. "self_read": "process: DownLoader.sfx.exe, pid: 2652, offset: 0x00076986, length: 0x00000008"
  275.  
  276.  
  277. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x00000000, length: 0x00010000"
  278.  
  279.  
  280. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0000ffec, length: 0x00010000"
  281.  
  282.  
  283. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0001ffd8, length: 0x00010000"
  284.  
  285.  
  286. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0002ffc4, length: 0x00010000"
  287.  
  288.  
  289. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0003ffb0, length: 0x00010000"
  290.  
  291.  
  292. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0004ff9c, length: 0x00010000"
  293.  
  294.  
  295. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0005ff88, length: 0x00010000"
  296.  
  297.  
  298. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0006ff74, length: 0x00010000"
  299.  
  300.  
  301. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0007ff60, length: 0x00010000"
  302.  
  303.  
  304. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0008ff4c, length: 0x00010000"
  305.  
  306.  
  307. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x0009ff38, length: 0x00010000"
  308.  
  309.  
  310. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000aff24, length: 0x00010000"
  311.  
  312.  
  313. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000bff10, length: 0x00010000"
  314.  
  315.  
  316. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000c5814, length: 0x00001000"
  317.  
  318.  
  319. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000c5828, length: 0x00000200"
  320.  
  321.  
  322. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000c58b3, length: 0x00000200"
  323.  
  324.  
  325. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000c58cf, length: 0x00013e00"
  326.  
  327.  
  328. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000d94ff, length: 0x00000200"
  329.  
  330.  
  331. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000d95a6, length: 0x00000200"
  332.  
  333.  
  334. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000d96ff, length: 0x00003823"
  335.  
  336.  
  337. "self_read": "process: kms_x64.exe, pid: 2604, offset: 0x000dcf1a, length: 0x00000008"
  338.  
  339.  
  340.  
  341.  
  342. "Description": "A process created a hidden window",
  343. "Details":
  344.  
  345. "Process": "DownLoader.exe -> Clear.bat"
  346.  
  347.  
  348.  
  349.  
  350. "Description": "Drops a binary and executes it",
  351. "Details":
  352.  
  353. "binary": "C:\\Windows\\Temp\\DownLoader.exe"
  354.  
  355.  
  356. "binary": "C:\\Windows\\Temp\\HEU_KMS_Activator_v11.2.0.exe"
  357.  
  358.  
  359. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\7Z.EXE"
  360.  
  361.  
  362. "binary": "C:\\Windows\\Temp\\DownLoader.sfx.exe"
  363.  
  364.  
  365. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_8ac6048052fe6d058ea3c6b5a386e8c6Srv.exe"
  366.  
  367.  
  368. "binary": "C:\\Program Files (x86)\\Microsoft\\DesktopLayer.exe"
  369.  
  370.  
  371. "binary": "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\kms_x64.exe"
  372.  
  373.  
  374.  
  375.  
  376. "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
  377. "Details":
  378.  
  379. "Process": "DesktopLayer.exe (2012)"
  380.  
  381.  
  382.  
  383.  
  384. "Description": "Tries to unhook or modify Windows functions monitored by Cuckoo",
  385. "Details":
  386.  
  387. "unhook": "function_name: NtWriteVirtualMemory, type: modification"
  388.  
  389.  
  390.  
  391.  
  392. "Description": "Attempts to repeatedly call a single API many times in order to delay analysis time",
  393. "Details":
  394.  
  395. "Spam": "services.exe (500) called API GetSystemTimeAsFileTime 14003741 times"
  396.  
  397.  
  398. "Spam": "HEU_KMS_Activator_v11.2.0.EXE (2380) called API GetSystemTimeAsFileTime 15130 times"
  399.  
  400.  
  401.  
  402.  
  403. "Description": "Creates a hidden or system file",
  404. "Details":
  405.  
  406. "file": "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\HEU_KMS_Service.exe"
  407.  
  408.  
  409.  
  410.  
  411. "Description": "File has been identified by 48 Antiviruses on VirusTotal as malicious",
  412. "Details":
  413.  
  414. "K7AntiVirus": "Trojan ( 004b5f9f1 )"
  415.  
  416.  
  417. "MicroWorld-eScan": "Dropped:Trojan.Zbot.IVF"
  418.  
  419.  
  420. "CAT-QuickHeal": "W32.Ramnit.A"
  421.  
  422.  
  423. "Cylance": "Unsafe"
  424.  
  425.  
  426. "Alibaba": "Virus:Win32/HackKMS.d0e44187"
  427.  
  428.  
  429. "K7GW": "Trojan ( 004b5f9f1 )"
  430.  
  431.  
  432. "Arcabit": "Trojan.Zbot.IVF"
  433.  
  434.  
  435. "TrendMicro": "PE_RAMNIT.H"
  436.  
  437.  
  438. "Baidu": "Win32.Virus.Nimnul.a"
  439.  
  440.  
  441. "F-Prot": "W32/Ramnit.B!Generic"
  442.  
  443.  
  444. "Symantec": "ML.Attribute.HighConfidence"
  445.  
  446.  
  447. "APEX": "Malicious"
  448.  
  449.  
  450. "Paloalto": "generic.ml"
  451.  
  452.  
  453. "ClamAV": "Win.Trojan.Ramnit-1847"
  454.  
  455.  
  456. "Kaspersky": "Virus.Win32.Nimnul.a"
  457.  
  458.  
  459. "BitDefender": "Dropped:Trojan.Zbot.IVF"
  460.  
  461.  
  462. "NANO-Antivirus": "Virus.Win32.Nimnul.bpchjo"
  463.  
  464.  
  465. "AegisLab": "Virus.Win32.Nimnul.n!c"
  466.  
  467.  
  468. "Avast": "Win32:RmnDrp"
  469.  
  470.  
  471. "Rising": "Trojan.Win32.Agent_.qo (CLASSIC:bWQ1OmaUvNXs0SXKz7mbaISx9ms)"
  472.  
  473.  
  474. "Ad-Aware": "Dropped:Trojan.Zbot.IVF"
  475.  
  476.  
  477. "Emsisoft": "Dropped:Trojan.Zbot.IVF (B)"
  478.  
  479.  
  480. "Comodo": "Malware@#34rngr71fy8yv"
  481.  
  482.  
  483. "F-Secure": "Malware.W32/Ramnit.CD"
  484.  
  485.  
  486. "DrWeb": "Win32.Rmnet"
  487.  
  488.  
  489. "McAfee-GW-Edition": "BehavesLike.Win32.Virus.wc"
  490.  
  491.  
  492. "FireEye": "Generic.mg.8ac6048052fe6d05"
  493.  
  494.  
  495. "Sophos": "W32/Patched-I"
  496.  
  497.  
  498. "SentinelOne": "DFI - Suspicious PE"
  499.  
  500.  
  501. "Cyren": "W32/Ramnit.B!Generic"
  502.  
  503.  
  504. "Jiangmin": "Win32/PatchFile.et"
  505.  
  506.  
  507. "Avira": "W32/Ramnit.CD"
  508.  
  509.  
  510. "Antiy-AVL": "Virus/Win32.Nimnul.a"
  511.  
  512.  
  513. "Microsoft": "Virus:Win32/Ramnit.A"
  514.  
  515.  
  516. "ZoneAlarm": "Virus.Win32.Nimnul.a"
  517.  
  518.  
  519. "GData": "Dropped:Trojan.Zbot.IVF"
  520.  
  521.  
  522. "VBA32": "Malware-Cryptor.Win32.073"
  523.  
  524.  
  525. "ALYac": "Dropped:Trojan.Zbot.IVF"
  526.  
  527.  
  528. "MAX": "malware (ai score=94)"
  529.  
  530.  
  531. "Zoner": "Trojan.Win32.Ramnit.23698"
  532.  
  533.  
  534. "ESET-NOD32": "Win32/Ramnit.A"
  535.  
  536.  
  537. "Tencent": "Win32.Virus.Nimnul.Edxu"
  538.  
  539.  
  540. "Ikarus": "Virus.Ramnit"
  541.  
  542.  
  543. "AVG": "Win32:RmnDrp"
  544.  
  545.  
  546. "Cybereason": "malicious.052fe6"
  547.  
  548.  
  549. "Panda": "Generic Suspicious"
  550.  
  551.  
  552. "CrowdStrike": "win/malicious_confidence_60% (W)"
  553.  
  554.  
  555. "Qihoo-360": "Win32/Trojan.Ransom.f24"
  556.  
  557.  
  558.  
  559.  
  560. "Description": "Checks the system manufacturer, likely for anti-virtualization",
  561. "Details":
  562.  
  563.  
  564. "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
  565. "Details":
  566.  
  567. "target": "clamav:Win.Trojan.Ramnit-1847, sha256:26dabe0dcfdda0b276272aa36803e9c68d16c0c9be268bfcb63d5004b639db21, type:PE32 executable (GUI) Intel 80386, for MS Windows, InstallShield self-extracting archive"
  568.  
  569.  
  570. "dropped": "clamav:Win.Malware.Autoit-6753917-0, sha256:aeaac9e5b5fb3aa355a9ce8b961834e039e7d5cd45fc1f1637c1eedd9f4dd85b , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\HEU_KMS_Renewal.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  571.  
  572.  
  573. "dropped": "clamav:Win.Malware.Autoit-6753917-0, sha256:8b7b042c70b69c0b2b0d1a6d722e6e297add172808581fe28f92430c2389c37a , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\HEU_KMS_TAP.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  574.  
  575.  
  576. "dropped": "clamav:Win.Malware.Autoit-6753917-0, sha256:7388e26fd56fec09fb606ad42b3cbf6d11e451d0dc21d999e11977c1142aa11a , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\kms.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  577.  
  578.  
  579. "dropped": "clamav:Win.Malware.Autoit-6753917-0, sha256:d746ccb0ec85a812bc6d1c32208f738a784d27064fdd70a9adf7289eef8ac47a , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\kms_x64.exe, type:PE32+ executable (GUI) x86-64, for MS Windows"
  580.  
  581.  
  582. "dropped": "clamav:Win.Malware.Autoit-6753917-0, sha256:7901ae0b153cdb7dbdd1085207055d9ebbad12cca56b404471d63de3eb8b41b5 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\autAE6C.tmp*C:\\Users\\user\\AppData\\Local\\Temp\\KMSmini.7z, type:7-zip archive data, version 0.4"
  583.  
  584.  
  585. "dropped": "clamav:Win.Malware.Autoit-6753917-0, sha256:5ad3ba6a79e8c71c06738c0ac0a078b43d208d99bc458b5dd9724682894fd204 , guest_paths:C:\\Windows\\Temp\\HEU_KMS_Activator_v11.2.0.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows"
  586.  
  587.  
  588. "dropped": "clamav:Win.Trojan.Generic-53, sha256:fd6c69c345f1e32924f0a5bb7393e191b393a78d58e2c6413b03ced7482f2320 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\Exes_8ac6048052fe6d058ea3c6b5a386e8c6Srv.exe*C:\\Program Files (x86)\\Microsoft\\DesktopLayer.exe, type:PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed"
  589.  
  590.  
  591. "dropped": "clamav:Win.Trojan.Ramnit-1847, sha256:60b4baa11dcbcab53c55cf45d49b324a785c8cbf51c33ea97c38ed8f11d0e9c6 , guest_paths:C:\\Users\\user\\AppData\\Local\\Temp\\nsbA6ED.tmp\\System.dll, type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows"
  592.  
  593.  
  594.  
  595.  
  596.  
  597. * Started Service:
  598. "osppsvc",
  599. "WerSvc"
  600.  
  601.  
  602. * Mutexes:
  603. "KyUffThOkYwRRtgPP",
  604. "SAMPLE_MUTEX_Shelling",
  605. "DefaultTabtip-MainUI",
  606. "CicLoadWinStaWinSta0",
  607. "Local\\MSCTF.CtfMonitorInstMutexDefault1",
  608. "Local\\WERReportingForProcess2268",
  609. "Global\\\\xe5\\x88\\x90\\xc2\\x8f",
  610. "Global\\\\xe1\\x9f\\xa0\\xc7\\x83",
  611. "WERUI_BEX64-e0bfc78dc22baf57413d9e3a2494cb68424d695b"
  612.  
  613.  
  614. * Modified Files:
  615. "C:\\Users\\user\\AppData\\Local\\Temp\\nsbA6EC.tmp",
  616. "C:\\Users\\user\\AppData\\Local\\Temp\\nsbA6ED.tmp\\System.dll",
  617. "C:\\Users\\user\\AppData\\Local\\Temp\\Exes_8ac6048052fe6d058ea3c6b5a386e8c6Srv.exe",
  618. "C:\\Windows\\Temp\\HEU_KMS_Activator_v11.2.0.exe",
  619. "C:\\Windows\\Temp\\DownLoader.sfx.exe",
  620. "C:\\Program Files (x86)\\Microsoft\\pxA7A6.tmp",
  621. "C:\\Program Files (x86)\\Microsoft\\DesktopLayer.exe",
  622. "C:\\Program Files (x86)\\Google\\Chrome\\Application\\debug.log",
  623. "C:\\Users\\user\\AppData\\Local\\Temp\\autAE6C.tmp",
  624. "C:\\Users\\user\\AppData\\Local\\Temp\\KMSmini.7z",
  625. "C:\\Users\\user\\AppData\\Local\\Temp\\autB004.tmp",
  626. "C:\\Users\\user\\AppData\\Local\\Temp\\7Z.EXE",
  627. "C:\\Windows\\Temp\\__tmp_rar_sfx_access_check_7507500",
  628. "C:\\Windows\\Temp\\DownLoader.exe",
  629. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert",
  630. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010",
  631. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro",
  632. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus",
  633. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard",
  634. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio",
  635. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013",
  636. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro",
  637. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus",
  638. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard",
  639. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro",
  640. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\KMSClient",
  641. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj",
  642. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x64",
  643. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x86",
  644. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\left.jpg",
  645. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\theme.jpg",
  646. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\ICO_211.ico",
  647. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\ICO_221.ico",
  648. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\help.htm",
  649. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\office.reg",
  650. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\office.reg",
  651. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\office.reg",
  652. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\office.reg",
  653. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\office.reg",
  654. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\office.reg",
  655. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\office.reg",
  656. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\office.reg",
  657. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\service.inf",
  658. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\mdmlasno.PNF",
  659. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\msclmd.PNF",
  660. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms",
  661. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms",
  662. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms",
  663. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms",
  664. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_PKC.xrm-ms",
  665. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_PKC.xrm-ms",
  666. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_PKC.xrm-ms",
  667. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_PKC.xrm-ms",
  668. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_PLUGIN_MANIFEST.xrm-ms",
  669. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_PLUGIN_MANIFEST.xrm-ms",
  670. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_PLUGIN_MANIFEST.xrm-ms",
  671. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_PLUGIN_MANIFEST.xrm-ms",
  672. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_PPD.xrm-ms",
  673. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_PPD.xrm-ms",
  674. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_PPD.xrm-ms",
  675. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_PPD.xrm-ms",
  676. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_RAC.xrm-ms",
  677. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_RAC.xrm-ms",
  678. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_RAC.xrm-ms",
  679. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_RAC.xrm-ms",
  680. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms",
  681. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms",
  682. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms",
  683. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms",
  684. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms",
  685. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms",
  686. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms",
  687. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms",
  688. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms",
  689. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms",
  690. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms",
  691. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms",
  692. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_SPC.xrm-ms",
  693. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_SPC.xrm-ms",
  694. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_SPC.xrm-ms",
  695. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_SPC.xrm-ms",
  696. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms",
  697. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms",
  698. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms",
  699. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms",
  700. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms",
  701. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms",
  702. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms",
  703. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms",
  704. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms",
  705. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms",
  706. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms",
  707. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms",
  708. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms",
  709. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms",
  710. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms",
  711. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms",
  712. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_UL_OEM.xrm-ms",
  713. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_UL_OEM.xrm-ms",
  714. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_UL_OEM.xrm-ms",
  715. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_UL_OEM.xrm-ms",
  716. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms",
  717. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms",
  718. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms",
  719. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms",
  720. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms",
  721. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms",
  722. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms",
  723. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms",
  724. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_UL_PHN.xrm-ms",
  725. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_UL_PHN.xrm-ms",
  726. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_UL_PHN.xrm-ms",
  727. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_UL_PHN.xrm-ms",
  728. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.ISSUANCE.CLIENT_WGALIC.xrm-ms",
  729. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.ISSUANCE.CLIENT_WGALIC.xrm-ms",
  730. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.ISSUANCE.CLIENT_WGALIC.xrm-ms",
  731. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.ISSUANCE.CLIENT_WGALIC.xrm-ms",
  732. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms",
  733. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms",
  734. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms",
  735. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms",
  736. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms",
  737. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms",
  738. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms",
  739. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\Licenses.sl.PKEYCONFIG.SIGNED.xrm-ms",
  740. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.RAC.GENERIC.PRIVATE.xrm-ms",
  741. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.RAC.GENERIC.PRIVATE.xrm-ms",
  742. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.RAC.GENERIC.PRIVATE.xrm-ms",
  743. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.RAC.GENERIC.PRIVATE.xrm-ms",
  744. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.RAC.GENERIC.PUBLIC.xrm-ms",
  745. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.RAC.GENERIC.PUBLIC.xrm-ms",
  746. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.RAC.GENERIC.PUBLIC.xrm-ms",
  747. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.RAC.GENERIC.PUBLIC.xrm-ms",
  748. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.SPC.GENERIC.PRIVATE.xrm-ms",
  749. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.SPC.GENERIC.PRIVATE.xrm-ms",
  750. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.SPC.GENERIC.PRIVATE.xrm-ms",
  751. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.SPC.GENERIC.PRIVATE.xrm-ms",
  752. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\Licenses.sl.SPC.GENERIC.PUBLIC.xrm-ms",
  753. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\Licenses.sl.SPC.GENERIC.PUBLIC.xrm-ms",
  754. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\Licenses.sl.SPC.GENERIC.PUBLIC.xrm-ms",
  755. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\Licenses.sl.SPC.GENERIC.PUBLIC.xrm-ms",
  756. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._191301D3_A579_428C_B0C7_D7988500F9E3.OOB.xrm-ms",
  757. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._191301D3_A579_428C_B0C7_D7988500F9E3.PHN.xrm-ms",
  758. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._191301D3_A579_428C_B0C7_D7988500F9E3.PL.xrm-ms",
  759. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._191301D3_A579_428C_B0C7_D7988500F9E3.PPDLIC.xrm-ms",
  760. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._1CF57A59_C532_4E56_9A7D_FFA2FE94B474.OOB.xrm-ms",
  761. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._1CF57A59_C532_4E56_9A7D_FFA2FE94B474.PHN.xrm-ms",
  762. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._1CF57A59_C532_4E56_9A7D_FFA2FE94B474.PL.xrm-ms",
  763. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._1CF57A59_C532_4E56_9A7D_FFA2FE94B474.PPDLIC.xrm-ms",
  764. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._1F76E346_E0BE_49BC_9954_70EC53A4FCFE.OOB.xrm-ms",
  765. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._1F76E346_E0BE_49BC_9954_70EC53A4FCFE.PHN.xrm-ms",
  766. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._1F76E346_E0BE_49BC_9954_70EC53A4FCFE.PL.xrm-ms",
  767. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._1F76E346_E0BE_49BC_9954_70EC53A4FCFE.PPDLIC.xrm-ms",
  768. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.OOB.xrm-ms",
  769. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PHN.xrm-ms",
  770. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PL.xrm-ms",
  771. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\LicenseSetData._2B88C4F2_EA8F_43CD_805E_4D41346E18A7.PPDLIC.xrm-ms",
  772. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._36756CB8_8E69_4D11_9522_68899507CD6A.OOB.xrm-ms",
  773. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._36756CB8_8E69_4D11_9522_68899507CD6A.PHN.xrm-ms",
  774. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._36756CB8_8E69_4D11_9522_68899507CD6A.PL.xrm-ms",
  775. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._36756CB8_8E69_4D11_9522_68899507CD6A.PPDLIC.xrm-ms",
  776. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.OOB.xrm-ms",
  777. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PHN.xrm-ms",
  778. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PL.xrm-ms",
  779. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\LicenseSetData._3E4294DD_A765_49BC_8DBD_CF8B62A4BD3D.PPDLIC.xrm-ms",
  780. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms",
  781. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms",
  782. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms",
  783. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._5980CF2B_E460_48AF_921E_0C2A79025D23.OOB.xrm-ms",
  784. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._5980CF2B_E460_48AF_921E_0C2A79025D23.PHN.xrm-ms",
  785. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._5980CF2B_E460_48AF_921E_0C2A79025D23.PL.xrm-ms",
  786. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._5980CF2B_E460_48AF_921E_0C2A79025D23.PPDLIC.xrm-ms",
  787. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._6F327760_8C5C_417C_9B61_836A98287E0C.OOB.xrm-ms",
  788. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._6F327760_8C5C_417C_9B61_836A98287E0C.PL.xrm-ms",
  789. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._6F327760_8C5C_417C_9B61_836A98287E0C.PPDLIC.xrm-ms",
  790. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._6F327760_8C5C_417C_9B61_836A98287E0C.RAC_Priv.xrm-ms",
  791. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._6F327760_8C5C_417C_9B61_836A98287E0C.RAC_Pub.xrm-ms",
  792. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._92236105_BB67_494F_94C7_7F7A607929BD.OOB.xrm-ms",
  793. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._92236105_BB67_494F_94C7_7F7A607929BD.PL.xrm-ms",
  794. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._92236105_BB67_494F_94C7_7F7A607929BD.PPDLIC.xrm-ms",
  795. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._92236105_BB67_494F_94C7_7F7A607929BD.RAC_Priv.xrm-ms",
  796. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._92236105_BB67_494F_94C7_7F7A607929BD.RAC_Pub.xrm-ms",
  797. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._9DA2A678_FB6B_4E67_AB84_60DD6A9C819A.OOB.xrm-ms",
  798. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._9DA2A678_FB6B_4E67_AB84_60DD6A9C819A.PL.xrm-ms",
  799. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._9DA2A678_FB6B_4E67_AB84_60DD6A9C819A.PPDLIC.xrm-ms",
  800. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._9DA2A678_FB6B_4E67_AB84_60DD6A9C819A.RAC_Priv.xrm-ms",
  801. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._9DA2A678_FB6B_4E67_AB84_60DD6A9C819A.RAC_Pub.xrm-ms",
  802. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._9ED833FF_4F92_4F36_B370_8683A4F13275.OOB.xrm-ms",
  803. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._9ED833FF_4F92_4F36_B370_8683A4F13275.PL.xrm-ms",
  804. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._9ED833FF_4F92_4F36_B370_8683A4F13275.PPDLIC.xrm-ms",
  805. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._9ED833FF_4F92_4F36_B370_8683A4F13275.RAC_Priv.xrm-ms",
  806. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._9ED833FF_4F92_4F36_B370_8683A4F13275.RAC_Pub.xrm-ms",
  807. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\LicenseSetData._A24CCA51_3D54_4C41_8A76_4031F5338CB2.OOB.xrm-ms",
  808. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\LicenseSetData._A24CCA51_3D54_4C41_8A76_4031F5338CB2.PHN.xrm-ms",
  809. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\LicenseSetData._A24CCA51_3D54_4C41_8A76_4031F5338CB2.PL.xrm-ms",
  810. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\LicenseSetData._A24CCA51_3D54_4C41_8A76_4031F5338CB2.PPDLIC.xrm-ms",
  811. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.OOB.xrm-ms",
  812. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PL.xrm-ms",
  813. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\standard\\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PPDLIC.xrm-ms",
  814. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms",
  815. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms",
  816. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\proplus\\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms",
  817. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._CAB3A4C4_F31A_4C12_AFA9_A0EECC86BD95.OOB.xrm-ms",
  818. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._CAB3A4C4_F31A_4C12_AFA9_A0EECC86BD95.PHN.xrm-ms",
  819. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._CAB3A4C4_F31A_4C12_AFA9_A0EECC86BD95.PL.xrm-ms",
  820. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._CAB3A4C4_F31A_4C12_AFA9_A0EECC86BD95.PPDLIC.xrm-ms",
  821. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._DD457678_5C3E_48E4_BC67_A89B7A3E3B44.OOB.xrm-ms",
  822. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._DD457678_5C3E_48E4_BC67_A89B7A3E3B44.PHN.xrm-ms",
  823. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._DD457678_5C3E_48E4_BC67_A89B7A3E3B44.PL.xrm-ms",
  824. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\standard\\LicenseSetData._DD457678_5C3E_48E4_BC67_A89B7A3E3B44.PPDLIC.xrm-ms",
  825. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._DF133FF7_BF14_4F95_AFE3_7B48E7E331EF.OOB.xrm-ms",
  826. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._DF133FF7_BF14_4F95_AFE3_7B48E7E331EF.PL.xrm-ms",
  827. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._DF133FF7_BF14_4F95_AFE3_7B48E7E331EF.PPDLIC.xrm-ms",
  828. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._DF133FF7_BF14_4F95_AFE3_7B48E7E331EF.RAC_Priv.xrm-ms",
  829. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\projectpro\\LicenseSetData._DF133FF7_BF14_4F95_AFE3_7B48E7E331EF.RAC_Pub.xrm-ms",
  830. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms",
  831. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms",
  832. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\visiopro\\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms",
  833. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._E558389C_83C3_4B29_ADFE_5E4D7F46C358.OOB.xrm-ms",
  834. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._E558389C_83C3_4B29_ADFE_5E4D7F46C358.PL.xrm-ms",
  835. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._E558389C_83C3_4B29_ADFE_5E4D7F46C358.PPDLIC.xrm-ms",
  836. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._E558389C_83C3_4B29_ADFE_5E4D7F46C358.RAC_Priv.xrm-ms",
  837. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\visio\\LicenseSetData._E558389C_83C3_4B29_ADFE_5E4D7F46C358.RAC_Pub.xrm-ms",
  838. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.OOB.xrm-ms",
  839. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PHN.xrm-ms",
  840. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PL.xrm-ms",
  841. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\LicenseSetData._ED34DC89_1C27_4ECD_8B2F_63D0F4CEDC32.PPDLIC.xrm-ms",
  842. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._FDF3ECB9_B56F_43B2_A9B8_1B48B6BAE1A7.OOB.xrm-ms",
  843. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._FDF3ECB9_B56F_43B2_A9B8_1B48B6BAE1A7.PHN.xrm-ms",
  844. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._FDF3ECB9_B56F_43B2_A9B8_1B48B6BAE1A7.PL.xrm-ms",
  845. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2010\\proplus\\LicenseSetData._FDF3ECB9_B56F_43B2_A9B8_1B48B6BAE1A7.PPDLIC.xrm-ms",
  846. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\HEU_KMS_Renewal.exe",
  847. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\HEU_KMS_TAP.exe",
  848. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\KMSClient\\KMS-Client.exe",
  849. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x86\\KMS-QADhooker.exe",
  850. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x64\\KMS-QADhooker.exe",
  851. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\kms.exe",
  852. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\kms_x64.exe",
  853. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x64\\SppExtComObj.Exe",
  854. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x86\\SppExtComObj.Exe",
  855. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\srvany.exe",
  856. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\KMSClient\\HGM-KMS.dll",
  857. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x86\\KMS-QADhooker.dll",
  858. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x64\\KMS-QADhooker.dll",
  859. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x64\\SppExtComObjHook.dll",
  860. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\SppExtComObj\\x86\\SppExtComObjHook.dll",
  861. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\cert\\kmscert2013\\projectpro\\megasas.sys",
  862. "C:\\Windows\\Temp\\TxPlugin_Install_3101",
  863. "C:\\Windows\\Temp\\FavriteAdd",
  864. "C:\\Windows\\Temp\\Clear.bat",
  865. "C:\\Users\\user\\AppData\\Local\\Temp\\autCA41.tmp",
  866. "C:\\Users\\user\\AppData\\Local\\Temp\\HEU_KMS_Mini_112\\HEU_KMS_Service.exe",
  867. "C:\\Users\\user\\AppData\\Local\\Temp\\~DFB0DA977CC6D0EB3F.TMP",
  868. "C:\\Windows\\sysnative\\LogFiles\\Scm\\4963ad21-c4a5-42a5-b9bd-e441d57204fe",
  869. "C:\\Windows\\sysnative\\LogFiles\\Scm\\6989c65b-f90d-4030-b893-c2a331a9b917",
  870. "C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\Cache\\cache.dat",
  871. "\\Device\\LanmanDatagramReceiver",
  872. "C:\\Windows\\appcompat\\Programs\\RecentFileCache.bcf",
  873. "\\??\\PIPE\\srvsvc",
  874. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  875. "C:\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb",
  876. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edb.chk",
  877. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9EE2.tmp.appcompat.txt",
  878. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA28D.tmp.WERInternalMetadata.xml",
  879. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA2CC.tmp.hdmp",
  880. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERABA7.tmp.mdmp",
  881. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_08380aec\\WER9EE2.tmp.appcompat.txt",
  882. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_08380aec\\WERA28D.tmp.WERInternalMetadata.xml",
  883. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_08380aec\\WERA2CC.tmp.hdmp",
  884. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_08380aec\\WERABA7.tmp.mdmp",
  885. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_08380aec\\Report.wer",
  886. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_08380aec\\Report.wer.tmp"
  887.  
  888.  
  889. * Deleted Files:
  890. "C:\\Users\\user\\AppData\\Local\\Temp\\nsgA66E.tmp",
  891. "C:\\Users\\user\\AppData\\Local\\Temp\\nsbA6ED.tmp",
  892. "C:\\Users\\user\\AppData\\Local\\Temp\\nsbA6ED.tmp\\System.dll",
  893. "C:\\Users\\user\\AppData\\Local\\Temp\\nsbA6ED.tmp\\",
  894. "C:\\Program Files (x86)\\Microsoft\\pxA7A6.tmp",
  895. "C:\\Users\\user\\AppData\\Local\\Temp\\autAE6C.tmp",
  896. "C:\\Users\\user\\AppData\\Local\\Temp\\autB004.tmp",
  897. "C:\\Windows\\Temp\\__tmp_rar_sfx_access_check_7507500",
  898. "C:\\Users\\user\\AppData\\Local\\Temp\\autCA41.tmp",
  899. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MpIdleTask",
  900. "C:\\Windows\\sysnative\\Tasks\\Microsoft\\Windows Defender\\MP Scheduled Scan",
  901. "C:\\Windows\\SoftwareDistribution\\DataStore\\Logs\\edbtmp.log",
  902. "C:\\Windows\\Temp\\DownLoader.exe",
  903. "C:\\Windows\\Temp\\TxPlugin_Install_3101",
  904. "C:\\Windows\\Temp\\Clear.bat",
  905. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9EE2.tmp",
  906. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WER9EE2.tmp.appcompat.txt",
  907. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA28D.tmp",
  908. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA28D.tmp.WERInternalMetadata.xml",
  909. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA2CC.tmp",
  910. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERA2CC.tmp.hdmp",
  911. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERABA7.tmp",
  912. "C:\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\Temp\\WERABA7.tmp.mdmp",
  913. "C:\\ProgramData\\Microsoft\\Windows\\WER\\ReportQueue\\AppCrash_taskhost.exe_e0bfc78dc22baf57413d9e3a2494cb68424d695b_cab_08380aec\\Report.wer.tmp"
  914.  
  915.  
  916. * Modified Registry Keys:
  917. "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\services\\WerSvc\\Type",
  918. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OfficeSoftwareProtectionPlatform\\ServiceSessionId",
  919. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6989C65B-F90D-4030-B893-C2A331A9B917\\Path",
  920. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6989C65B-F90D-4030-B893-C2A331A9B917\\Hash",
  921. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Id",
  922. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tree\\Microsoft\\Windows Defender\\MP Scheduled Scan\\Index",
  923. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6989C65B-F90D-4030-B893-C2A331A9B917\\Triggers",
  924. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\6989C65B-F90D-4030-B893-C2A331A9B917\\DynamicInfo",
  925. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\ED0D73D7-BC97-46E2-AC55-FD6EB3F72C05\\DynamicInfo",
  926. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\C01B87DA-9935-44D0-8424-8439147E6223",
  927. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\B17E070E-57E3-43F6-96F5-A9A9C921DEBF\\DynamicInfo",
  928. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\9E1E2ED1-F91D-4DCC-8CE3-924C3C87B52C",
  929. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\TaskCache\\Tasks\\DF000DCA-3FA2-48A6-9E59-C0606F9F8D73\\DynamicInfo",
  930. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent",
  931. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Consent\\DefaultConsent",
  932. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug",
  933. "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\StoreLocation",
  934. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\\Debug\\StoreLocation",
  935. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\C01B87DA-9935-44D0-8424-8439147E6223\\data",
  936. "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Handshake\\9E1E2ED1-F91D-4DCC-8CE3-924C3C87B52C\\data"
  937.  
  938.  
  939. * Deleted Registry Keys:
  940.  
  941. * DNS Communications:
  942.  
  943. * Domains:
  944.  
  945. * Network Communication - ICMP:
  946.  
  947. * Network Communication - HTTP:
  948.  
  949. * Network Communication - SMTP:
  950.  
  951. * Network Communication - Hosts:
  952.  
  953. * Network Communication - IRC:
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!