File name:

getkmspico.com-KMSpico-setup.zip

Full analysis: https://app.any.run/tasks/1ecd14ce-e3fc-4d42-96d3-05e6d10376e3
Verdict: Malicious activity
Analysis date: December 22, 2024, 22:06:38
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

2E286F3F68A215B58D134A22C3A36766

SHA1:

872783B04855DE3681813A645872B694F803A23A

SHA256:

1E0321278152004BD4A93E6CF70DF30282BF3DE3BDAC4F5A43314891C233FC8D

SSDEEP:

98304:sZrxTFnAsxOEZJkPqdETqDk5hClGuc2V/N4+lWe42HzriI8FlWE7KZ6ntCQoLl6K:sisxWKvQGp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • KMSpico-setup.exe (PID: 7156)
      • KMSpico-setup.exe (PID: 6300)
      • _setup.exe (PID: 5640)
      • KMSpico-setup.exe (PID: 6484)
      • KMSELDI.exe (PID: 5696)
      • AutoPico.exe (PID: 6480)
      • KMSELDI.exe (PID: 6316)

    • Uses Task Scheduler to autorun other applications

      • KMSpico-setup.tmp (PID: 4932)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3140)

    • Changes image file execution options

      • KMSELDI.exe (PID: 5696)
      • AutoPico.exe (PID: 6480)
      • KMSELDI.exe (PID: 6572)
      • KMSELDI.exe (PID: 6316)
      • AutoPico.exe (PID: 6740)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6352)
      • KMSpico-setup.tmp (PID: 3488)
      • KMSpico-setup.tmp (PID: 4008)

    • Executable content was dropped or overwritten

      • KMSpico-setup.exe (PID: 7156)
      • KMSpico-setup.exe (PID: 6300)
      • KMSpico-setup.tmp (PID: 4008)
      • KMSpico-setup.exe (PID: 6484)
      • KMSpico-setup.tmp (PID: 4932)
      • _setup.exe (PID: 5640)
      • _setup.tmp (PID: 5728)
      • KMSELDI.exe (PID: 5696)

    • Reads the Windows owner or organization settings

      • KMSpico-setup.tmp (PID: 4008)
      • KMSpico-setup.tmp (PID: 4932)
      • _setup.tmp (PID: 5728)

    • Uses TASKKILL.EXE to kill process

      • KMSpico-setup.tmp (PID: 4932)

    • Process drops legitimate windows executable

      • _setup.tmp (PID: 5728)

    • Starts CMD.EXE for commands execution

      • _setup.tmp (PID: 5728)

    • Creates a new Windows service

      • sc.exe (PID: 4996)

    • Executing commands from ".cmd" file

      • _setup.tmp (PID: 5728)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 4548)

    • Modifies the phishing filter of IE

      • _setup.tmp (PID: 5728)

    • Uses ICACLS.EXE to modify access control lists

      • KMSELDI.exe (PID: 6316)

    • Connects to unusual port

      • KMSELDI.exe (PID: 6316)

    • Takes ownership (TAKEOWN.EXE)

      • KMSELDI.exe (PID: 6316)

    • Executes application which crashes

      • KMSELDI.exe (PID: 6316)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6352)
      • KMSpico-setup.tmp (PID: 4008)

    • Checks supported languages

      • SearchApp.exe (PID: 5064)
      • KMSpico-setup.tmp (PID: 3488)
      • KMSpico-setup.exe (PID: 7156)
      • KMSpico-setup.exe (PID: 6300)
      • KMSpico-setup.tmp (PID: 4008)
      • KMSpico-setup.exe (PID: 6484)
      • KMSpico-setup.tmp (PID: 4932)
      • _setup.exe (PID: 5640)
      • _setup.tmp (PID: 5728)
      • KMSELDI.exe (PID: 5696)
      • UninsHs.exe (PID: 396)
      • AutoPico.exe (PID: 6480)
      • SECOH-QAD.exe (PID: 5432)
      • KMSELDI.exe (PID: 6572)
      • KMSELDI.exe (PID: 6316)
      • SECOH-QAD.exe (PID: 6056)
      • AutoPico.exe (PID: 6740)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6352)

    • Process checks computer location settings

      • KMSpico-setup.tmp (PID: 3488)
      • KMSpico-setup.tmp (PID: 4008)
      • SearchApp.exe (PID: 5064)

    • Create files in a temporary directory

      • KMSpico-setup.exe (PID: 7156)
      • KMSpico-setup.exe (PID: 6300)
      • KMSpico-setup.tmp (PID: 4008)
      • KMSpico-setup.tmp (PID: 4932)
      • _setup.exe (PID: 5640)
      • KMSpico-setup.exe (PID: 6484)
      • _setup.tmp (PID: 5728)

    • Reads the computer name

      • KMSpico-setup.tmp (PID: 3488)
      • KMSpico-setup.tmp (PID: 4008)
      • KMSpico-setup.tmp (PID: 4932)
      • _setup.tmp (PID: 5728)
      • KMSELDI.exe (PID: 5696)
      • AutoPico.exe (PID: 6480)
      • KMSELDI.exe (PID: 6316)
      • KMSELDI.exe (PID: 6572)
      • AutoPico.exe (PID: 6740)

    • Creates files in the program directory

      • KMSpico-setup.tmp (PID: 4932)
      • _setup.tmp (PID: 5728)
      • KMSELDI.exe (PID: 5696)
      • AutoPico.exe (PID: 6480)
      • KMSELDI.exe (PID: 6572)
      • KMSELDI.exe (PID: 6316)
      • AutoPico.exe (PID: 6740)

    • The sample compiled with english language support

      • _setup.tmp (PID: 5728)

    • Creates a software uninstall entry

      • _setup.tmp (PID: 5728)

    • Reads the machine GUID from the registry

      • KMSELDI.exe (PID: 5696)
      • AutoPico.exe (PID: 6480)
      • SearchApp.exe (PID: 5064)
      • KMSELDI.exe (PID: 6572)
      • KMSELDI.exe (PID: 6316)
      • AutoPico.exe (PID: 6740)

    • Reads product name

      • KMSELDI.exe (PID: 5696)
      • AutoPico.exe (PID: 6480)
      • KMSELDI.exe (PID: 6572)
      • KMSELDI.exe (PID: 6316)
      • AutoPico.exe (PID: 6740)

    • Reads Microsoft Office registry keys

      • KMSELDI.exe (PID: 5696)
      • AutoPico.exe (PID: 6480)
      • KMSELDI.exe (PID: 6572)
      • KMSELDI.exe (PID: 6316)
      • AutoPico.exe (PID: 6740)

    • Reads Environment values

      • AutoPico.exe (PID: 6480)
      • KMSELDI.exe (PID: 5696)
      • KMSELDI.exe (PID: 6572)
      • KMSELDI.exe (PID: 6316)
      • AutoPico.exe (PID: 6740)

    • Manual execution by a user

      • KMSELDI.exe (PID: 6572)
      • KMSELDI.exe (PID: 6696)
      • KMSELDI.exe (PID: 5876)
      • KMSELDI.exe (PID: 6316)
      • AutoPico.exe (PID: 372)
      • AutoPico.exe (PID: 6740)

    • Reads the software policy settings

      • SearchApp.exe (PID: 5064)
      • WerFault.exe (PID: 3000)

    • Checks proxy server information

      • WerFault.exe (PID: 3000)

    • Creates files or folders in the user directory

      • WerFault.exe (PID: 3000)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2020:02:26 20:36:14
ZipCRC: 0x46df3661
ZipCompressedSize: 3608887
ZipUncompressedSize: 3699136
ZipFileName: KMSpico-setup.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
312
Monitored processes
177
Malicious processes
11
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe kmspico-setup.exe kmspico-setup.tmp no specs kmspico-setup.exe kmspico-setup.tmp kmspico-setup.exe kmspico-setup.tmp taskkill.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs _setup.exe checknetisolation.exe no specs conhost.exe no specs _setup.tmp checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs checknetisolation.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs uninshs.exe no specs conhost.exe no specs schtasks.exe no specs sc.exe no specs kmseldi.exe autopico.exe secoh-qad.exe no specs sppextcomobj.exe no specs kmseldi.exe no specs kmseldi.exe kmseldi.exe no specs kmseldi.exe takeown.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs takeown.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs takeown.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs icacls.exe no specs conhost.exe no specs werfault.exe secoh-qad.exe no specs sppextcomobj.exe no specs slui.exe no specs autopico.exe no specs autopico.exe searchapp.exe

Process information

PID
CMD
Path
Indicators
Parent process
128"C:\WINDOWS\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewyC:\Windows\SysWOW64\CheckNetIsolation.exe—KMSpico-setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
128"C:\WINDOWS\System32\icacls.exe" C:\WINDOWS\System32\spp\store\2.0\cache\cache.dat /grant :r administrators:(d,f) C:\Windows\System32\icacls.exe—KMSELDI.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ntmarta.dll
132"C:\WINDOWS\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=NcsiUwpApp_8wekyb3d8bbweC:\Windows\SysWOW64\CheckNetIsolation.exe—KMSpico-setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
188"C:\WINDOWS\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.XboxGamingOverlay_8wekyb3d8bbweC:\Windows\SysWOW64\CheckNetIsolation.exe—KMSpico-setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
204C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—SECOH-QAD.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
236\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CheckNetIsolation.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
244"C:\WINDOWS\System32\SLUI.exe" RuleId=379cccfb-d4e0-48fe-b0f2-0136097be147;Action=CleanupState;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
372"C:\Program Files\KMSpico\AutoPico.exe" C:\Program Files\KMSpico\AutoPico.exe—explorer.exe
User:
admin
Company:
@ByELDI
Integrity Level:
MEDIUM
Description:
AutoPico
Exit code:
3221226540
Version:
16.1.0.0
Modules
Images
c:\program files\kmspico\autopico.exe
c:\windows\system32\ntdll.dll
396"C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\admin\AppData\Local\Temp\is-HITGO.tmp\_setup.exeC:\Program Files\KMSpico\UninsHs.exe—_setup.tmp
User:
admin
Company:
Han-soft
Integrity Level:
HIGH
Description:
Uninstall for InnoSetup by Han-soft
Exit code:
0
Version:
2.1.0.283
Modules
Images
c:\program files\kmspico\uninshs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
444"C:\WINDOWS\system32\CheckNetIsolation.exe" LoopbackExempt -a -n=Microsoft.549981C3F5F10_8wekyb3d8bbweC:\Windows\SysWOW64\CheckNetIsolation.exe—KMSpico-setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
AppContainer Network Isolation Diagnostic Tool
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\checknetisolation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
26 765
Read events
26 374
Write events
366
Delete events
25

Modification events

(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\getkmspico.com-KMSpico-setup.zip
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6352) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\DSB
Operation:writeName:DynamicText
Value:
(PID) Process:(5064) SearchApp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Feeds\DSB
Operation:writeName:DynamicTextTruncated
Value:
Executable files
39
Suspicious files
53
Text files
741
Unknown types
1

Dropped files

PID
Process
Filename
Type
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b8b1e24f-2898-44c4-861b-2c1a0edd7edd}\0.1.filtertrie.intermediate.txttext
MD5:34BD1DFB9F72CF4F86E6DF6DA0A9E49A
SHA256:8E1E6A3D56796A245D0C7B0849548932FEE803BBDB03F6E289495830E017F14C
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xmltext
MD5:A30E4F77D9662ADB24B1CCE21E462270
SHA256:296138A83CAC0C5599E9564AE00E56832E10B0081F1AFFDA6FBB92A92F303EA0
4008KMSpico-setup.tmpC:\Users\admin\AppData\Local\Temp\is-934UI.tmp\idp.dllexecutable
MD5:8F995688085BCED38BA7795F60A5E1D3
SHA256:203D7B61EAC96DE865AB3B586160E72C78D93AB5532B13D50EF27174126FD006
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b8b1e24f-2898-44c4-861b-2c1a0edd7edd}\Apps.ftbinary
MD5:AB5CF5D309581951ACE7978FF8DF0FF0
SHA256:CA45CAA7DE38CB805EC43EDC8B9332E1E95124A27FBB6E5BD3DDD5E8A526AFC7
6300KMSpico-setup.exeC:\Users\admin\AppData\Local\Temp\is-BE8F4.tmp\KMSpico-setup.tmpexecutable
MD5:9220AABFA74A0D9ACCFEC48F5B668A41
SHA256:305C3D26326BFC3582B4056C20F31819E6F4B95A54A3BC5A7971ECBB86F00BD7
5064SearchApp.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{b8b1e24f-2898-44c4-861b-2c1a0edd7edd}\0.2.filtertrie.intermediate.txttext
MD5:C204E9FAAF8565AD333828BEFF2D786E
SHA256:D65B6A3BF11A27A1CED1F7E98082246E40CF01289FD47FE4A5ED46C221F2F73F
6484KMSpico-setup.exeC:\Users\admin\AppData\Local\Temp\is-K299B.tmp\KMSpico-setup.tmpexecutable
MD5:9220AABFA74A0D9ACCFEC48F5B668A41
SHA256:305C3D26326BFC3582B4056C20F31819E6F4B95A54A3BC5A7971ECBB86F00BD7
7156KMSpico-setup.exeC:\Users\admin\AppData\Local\Temp\is-9GN6H.tmp\KMSpico-setup.tmpexecutable
MD5:9220AABFA74A0D9ACCFEC48F5B668A41
SHA256:305C3D26326BFC3582B4056C20F31819E6F4B95A54A3BC5A7971ECBB86F00BD7
6352WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6352.1929\KMSpico-setup.exeexecutable
MD5:F40C6005D5E178271D54CB2882D50BD8
SHA256:67547D29F8CB79697566A4446C617FFCA59DC0BDC982AFBF64CD7DE189999098
4932KMSpico-setup.tmpC:\Users\admin\AppData\Local\Temp\is-HITGO.tmp\idp.dllexecutable
MD5:8F995688085BCED38BA7795F60A5E1D3
SHA256:203D7B61EAC96DE865AB3B586160E72C78D93AB5532B13D50EF27174126FD006
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
54
DNS requests
37
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
2.16.241.12:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6612
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
3224
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
3224
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3508
svchost.exe
2.16.241.12:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3508
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
2.23.209.140:443
www.bing.com
Akamai International B.V.
GB
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.241.12
  • 2.16.241.19
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 95.101.149.131
  • 2.19.217.218
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.bing.com
  • 2.23.209.140
  • 2.23.209.182
  • 2.23.209.179
  • 2.23.209.130
  • 2.23.209.133
  • 2.23.209.149
  • 23.212.110.211
  • 23.212.110.208
  • 23.212.110.137
  • 23.212.110.203
  • 23.212.110.209
  • 23.212.110.201
  • 23.212.110.138
  • 23.212.110.210
  • 23.212.110.219
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.17
  • 40.126.32.136
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.138
  • 20.190.160.20
  • 40.126.32.68
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
arc.msn.com
  • 20.74.47.205
whitelisted
fd.api.iris.microsoft.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
getkmspico.com-KMSpico-setup.zip