Technical Information
Modifies file system
Creates the following files
- %TEMP%\kmsnano\bios\keymaps\ar
- %TEMP%\kmsnano\bios\keymaps\bepo
- %TEMP%\kmsnano\bios\keymaps\common
- %TEMP%\kmsnano\bios\keymaps\da
- %TEMP%\kmsnano\bios\keymaps\de
- %TEMP%\kmsnano\bios\keymaps\de-ch
- %TEMP%\kmsnano\bios\keymaps\en-gb
- %TEMP%\kmsnano\bios\keymaps\en-us
- %TEMP%\kmsnano\bios\keymaps\es
- %TEMP%\kmsnano\bios\keymaps\et
- %TEMP%\kmsnano\bios\keymaps\fi
- %TEMP%\kmsnano\bios\keymaps\fo
- %TEMP%\kmsnano\bios\keymaps\fr
- %TEMP%\kmsnano\bios\keymaps\fr-be
- %TEMP%\kmsnano\bios\keymaps\fr-ca
- %TEMP%\kmsnano\bios\keymaps\fr-ch
- %TEMP%\kmsnano\bios\keymaps\hr
- %TEMP%\kmsnano\bios\keymaps\hu
- %TEMP%\kmsnano\bios\keymaps\is
- %TEMP%\kmsnano\bios\keymaps\it
- %TEMP%\kmsnano\bios\keymaps\ja
- %TEMP%\kmsnano\bios\keymaps\lt
- %TEMP%\kmsnano\bios\keymaps\lv
- %TEMP%\kmsnano\bios\keymaps\mk
- %TEMP%\kmsnano\bios\keymaps\modifiers
- %TEMP%\kmsnano\bios\keymaps\nl
- %TEMP%\kmsnano\bios\keymaps\nl-be
- %TEMP%\kmsnano\bios\keymaps\no
- %TEMP%\kmsnano\bios\openbios-ppc
- %TEMP%\kmsnano\bios\palcode-clipper
- %TEMP%\kmsnano\bios\keymaps\pl
- %TEMP%\kmsnano\bios\keymaps\pt
- %TEMP%\kmsnano\bios\keymaps\pt-br
- %TEMP%\kmsnano\bios\keymaps\ru
- %TEMP%\kmsnano\bios\keymaps\sl
- %TEMP%\kmsnano\bios\keymaps\sv
- %TEMP%\kmsnano\bios\keymaps\th
- %TEMP%\kmsnano\bios\keymaps\tr
- %TEMP%\kmsnano\bios\qemu-icon.bmp
- %TEMP%\kmsnano\bios\qemu.ico
- %TEMP%\kmsnano\bios\bios.bin
- %TEMP%\kmsnano\bios\kvmvapic.bin
- %TEMP%\kmsnano\bios\linuxboot.bin
- %TEMP%\kmsnano\bios\multiboot.bin
- %TEMP%\kmsnano\bios\ppc_rom.bin
- %TEMP%\kmsnano\bios\sgabios.bin
- %TEMP%\kmsnano\bios\slof.bin
- %TEMP%\kmsnano\bios\spapr-rtas.bin
- %TEMP%\kmsnano\bios\vgabios-cirrus.bin
- %TEMP%\kmsnano\bios\vgabios-qxl.bin
- %TEMP%\kmsnano\bios\vgabios-stdvga.bin
- %TEMP%\kmsnano\bios\vgabios-vmware.bin
- %TEMP%\kmsnano\bios\vgabios.bin
- %TEMP%\kmsnano\disco.vmdk
- %TEMP%\kmsnano\run.bat
- %TEMP%\kmsnano\00-start_qemu_manual.cmd
- %TEMP%\kmsnano\activate_office2010.cmd
- %TEMP%\kmsnano\activate_office2013.cmd
- %TEMP%\kmsnano\activate_windows.cmd
- %TEMP%\kmsnano\convert_windows_retail2vl.cmd
- %TEMP%\kmsnano\fix hacktivations.cmd
- %TEMP%\kmsnano\manual.cmd
- %TEMP%\kmsnano\manual_silent.cmd
- %TEMP%\kmsnano\office2010vl\office14reginfo.reg
- %TEMP%\kmsnano\kmscert2013\project\project.reg
- %TEMP%\kmsnano\kmscert2013\proplus\proplus.reg
- %TEMP%\kmsnano\kmscert2013\visio\visio.reg
- %TEMP%\kmsnano\timesync.ini
- %TEMP%\kmsnano\bios\cpus-x86_64.conf
- %TEMP%\kmsnano\office2010vl\tokens.dat
- %TEMP%\kmsnano\bios\bamboo.dtb
- %TEMP%\kmsnano\bios\petalogix-ml605.dtb
- %TEMP%\kmsnano\bios\petalogix-s3adsp1800.dtb
- %TEMP%\kmsnano\bios\pxe-e1000.rom
- %TEMP%\kmsnano\bios\pxe-eepro100.rom
- %TEMP%\kmsnano\bios\pxe-ne2k_pci.rom
- %TEMP%\kmsnano\bios\pxe-pcnet.rom
- %TEMP%\kmsnano\bios\pxe-rtl8139.rom
- %TEMP%\kmsnano\bios\pxe-virtio.rom
- %TEMP%\kmsnano\bios\s390-zipl.rom
- %TEMP%\kmsnano\kmscert2013\project\licenses.sl.issuance.client_bridge_office.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licenses.sl.issuance.client_bridge_office.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licenses.sl.issuance.client_bridge_office.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licenses.sl.issuance.client_root.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licenses.sl.issuance.client_root.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licenses.sl.issuance.client_root.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licenses.sl.issuance.client_root_bridge_test.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licenses.sl.issuance.client_root_bridge_test.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licenses.sl.issuance.client_root_bridge_test.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licenses.sl.issuance.client_stil.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licenses.sl.issuance.client_stil.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licenses.sl.issuance.client_stil.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licenses.sl.issuance.client_ul.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licenses.sl.issuance.client_ul.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licenses.sl.issuance.client_ul.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licenses.sl.issuance.client_ul_oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licenses.sl.issuance.client_ul_oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licenses.sl.issuance.client_ul_oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licenses.sl.pkeyconfig.signed.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licenses.sl.pkeyconfig.signed.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licenses.sl.pkeyconfig.signed.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licensesetdata._2b88c4f2_ea8f_43cd_805e_4d41346e18a7.oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licensesetdata._2b88c4f2_ea8f_43cd_805e_4d41346e18a7.phn.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licensesetdata._2b88c4f2_ea8f_43cd_805e_4d41346e18a7.pl.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licensesetdata._2b88c4f2_ea8f_43cd_805e_4d41346e18a7.ppdlic.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licensesetdata._3e4294dd_a765_49bc_8dbd_cf8b62a4bd3d.oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licensesetdata._3e4294dd_a765_49bc_8dbd_cf8b62a4bd3d.phn.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licensesetdata._3e4294dd_a765_49bc_8dbd_cf8b62a4bd3d.pl.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licensesetdata._3e4294dd_a765_49bc_8dbd_cf8b62a4bd3d.ppdlic.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licensesetdata._4a5d124a_e620_44ba_b6ff_658961b33b9a.oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licensesetdata._4a5d124a_e620_44ba_b6ff_658961b33b9a.pl.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licensesetdata._4a5d124a_e620_44ba_b6ff_658961b33b9a.ppdlic.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licensesetdata._b322da9c_a2e2_4058_9e4e_f59a6970bd69.oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licensesetdata._b322da9c_a2e2_4058_9e4e_f59a6970bd69.pl.xrm-ms
- %TEMP%\kmsnano\kmscert2013\proplus\licensesetdata._b322da9c_a2e2_4058_9e4e_f59a6970bd69.ppdlic.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licensesetdata._e13ac10e_75d0_4aff_a0cd_764982cf541c.oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licensesetdata._e13ac10e_75d0_4aff_a0cd_764982cf541c.pl.xrm-ms
- %TEMP%\kmsnano\kmscert2013\visio\licensesetdata._e13ac10e_75d0_4aff_a0cd_764982cf541c.ppdlic.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licensesetdata._ed34dc89_1c27_4ecd_8b2f_63d0f4cedc32.oob.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licensesetdata._ed34dc89_1c27_4ecd_8b2f_63d0f4cedc32.phn.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licensesetdata._ed34dc89_1c27_4ecd_8b2f_63d0f4cedc32.pl.xrm-ms
- %TEMP%\kmsnano\kmscert2013\project\licensesetdata._ed34dc89_1c27_4ecd_8b2f_63d0f4cedc32.ppdlic.xrm-ms
- %TEMP%\kmsnano\kms client.exe
- %TEMP%\kmsnano\kmseldi.exe
- %TEMP%\kmsnano\portqry.exe
- %TEMP%\kmsnano\qemu-system-i386.exe
- %TEMP%\kmsnano\timesync.exe
- %TEMP%\kmsnano\fmod.dll
- %TEMP%\kmsnano\intl.dll
- %TEMP%\kmsnano\ipaddresscontrollib.dll
- %TEMP%\kmsnano\jpeg62.dll
- %TEMP%\kmsnano\libcurl-4.dll
- %TEMP%\kmsnano\libgcc_s_dw2-1.dll
- %TEMP%\kmsnano\libglib-2.0-0.dll
- %TEMP%\kmsnano\libgthread-2.0-0.dll
- %TEMP%\kmsnano\libpng12.dll
- %TEMP%\kmsnano\libpng14-14.dll
- %TEMP%\kmsnano\libssp-0.dll
- %TEMP%\kmsnano\mgwz.dll
- %TEMP%\kmsnano\mingwm10.dll
- %TEMP%\kmsnano\msvcr71.dll
- %TEMP%\kmsnano\sdl.dll
- %TEMP%\kmsnano\zlib1.dll
- %TEMP%\kmsnano\stdout.txt
- %TEMP%\kmsnano\stderr.txt
Network activity
Connects to
- '12#.0.0.3':1688
UDP
- DNS ASK 3.#.#.#27.in-addr.arpa
Miscellaneous
Creates and executes the following
- '%TEMP%\kmsnano\kmseldi.exe' /qemu /silent /log
- '%TEMP%\kmsnano\portqry.exe' -n 12#.0.0.3 -p tcp -e 1688
- '%TEMP%\kmsnano\qemu-system-i386.exe' -smbios type=1,manufacturer=Intel,version=1.01234,uuid=564d81c6-cd3a-d8e4-db29-756df139acb9 -uuid 564d81c6-cd3a-d8e4-db29-756df139acb9 -net nic -net user,hostfwd=tcp:0.0.0.0:1688-:1688 -hda dis...
Executes the following
- '<SYSTEM32>\rundll32.exe' <SYSTEM32>\FirewallControlPanel.dll,ShowNotificationDialog /configure /ETOnly 0 /OnProfiles 6 /OtherAllowed 0 /OtherBlocked 0 /OtherEdgeAllowed 0 /NewBlocked 4 "%TEMP%\kmsnano\qemu-system-i386....
- '%TEMP%\kmsnano\kmseldi.exe' /qemu /silent /log' (with hidden window)
