File name:

KMSPico.exe

Full analysis: https://app.any.run/tasks/5ba96b77-c274-404d-b0a2-ca8aaa771499
Verdict: Malicious activity
Analysis date: November 29, 2024, 14:44:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
amsi-bypass
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

B1881F6380807EA9BAC4C3F5BC68428F

SHA1:

07C5AE44CE8D03215752DA0D177BE1CEE5B26993

SHA256:

2E1AC85DD7F9BBA349476B999A3D0DBFE8C79C70CBC3DA470ABF75211D801706

SSDEEP:

98304:mrq3BdwbGHXyd5ejSpdrCIYG5ts4tGUWBTBWzjwJd7gDm9ejykll/9O9UJ+2QtF/:UHXArpgWq47SpFEcM5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • KMSpico_setup.exe (PID: 4264)
      • WindowsDefender.exe (PID: 2380)
      • KMSpico_setup.exe (PID: 2728)
      • WindowsDefender.exe (PID: 5604)
      • AutoPico.exe (PID: 4036)
      • KMSELDI.exe (PID: 2408)

    • Adds extension to the Windows Defender exclusion list

      • WindowsDefender.exe (PID: 5604)

    • Uninstalls Malicious Software Removal Tool (MRT)

      • cmd.exe (PID: 5712)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 1400)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • KMSPico.exe (PID: 4708)
      • KMSPico.exe (PID: 3836)
      • KMSPico.tmp (PID: 3508)
      • KMSpico_setup.exe (PID: 4264)
      • KMSpico_setup.exe (PID: 2728)
      • KMSpico_setup.tmp (PID: 5888)
      • WindowsDefender.exe (PID: 5604)
      • KMSELDI.exe (PID: 2408)

    • Reads security settings of Internet Explorer

      • KMSPico.tmp (PID: 5208)
      • KMSpico_setup.tmp (PID: 1704)

    • Reads the Windows owner or organization settings

      • KMSPico.tmp (PID: 3508)
      • KMSpico_setup.tmp (PID: 5888)

    • Starts process via Powershell

      • powershell.exe (PID: 2356)

    • Starts POWERSHELL.EXE for commands execution

      • WindowsDefender.exe (PID: 2380)
      • WindowsDefender.exe (PID: 5604)

    • Process drops legitimate windows executable

      • KMSpico_setup.tmp (PID: 5888)

    • Script adds exclusion path to Windows Defender

      • WindowsDefender.exe (PID: 5604)

    • Found strings related to reading or modifying Windows Defender settings

      • WindowsDefender.exe (PID: 5604)

    • Script adds exclusion extension to Windows Defender

      • WindowsDefender.exe (PID: 5604)

    • The process executes via Task Scheduler

      • powershell.exe (PID: 5576)

    • Starts CMD.EXE for commands execution

      • WindowsDefender.exe (PID: 5604)
      • KMSpico_setup.tmp (PID: 5888)

    • Manipulates environment variables

      • powershell.exe (PID: 4624)

    • Starts SC.EXE for service management

      • WindowsDefender.exe (PID: 5604)
      • cmd.exe (PID: 3688)

    • Uses powercfg.exe to modify the power settings

      • WindowsDefender.exe (PID: 5604)

    • Process uninstalls Windows update

      • wusa.exe (PID: 932)

    • Invokes assembly entry point (POWERSHELL)

      • powershell.exe (PID: 5576)

    • Executing commands from ".cmd" file

      • KMSpico_setup.tmp (PID: 5888)

    • Possibly patching Antimalware Scan Interface function (YARA)

      • KMSELDI.exe (PID: 2408)

  • INFO

    • Checks supported languages

      • KMSPico.exe (PID: 4708)
      • KMSPico.tmp (PID: 5208)
      • KMSPico.tmp (PID: 3508)
      • KMSPico.exe (PID: 3836)
      • KMSpico_setup.exe (PID: 4264)
      • WindowsDefender.exe (PID: 2380)
      • KMSpico_setup.tmp (PID: 1704)
      • KMSpico_setup.exe (PID: 2728)
      • KMSpico_setup.tmp (PID: 5888)

    • Create files in a temporary directory

      • KMSPico.exe (PID: 4708)
      • KMSPico.exe (PID: 3836)
      • KMSPico.tmp (PID: 3508)
      • KMSpico_setup.exe (PID: 4264)
      • KMSpico_setup.exe (PID: 2728)
      • KMSpico_setup.tmp (PID: 5888)

    • Reads the computer name

      • KMSPico.tmp (PID: 5208)
      • KMSPico.exe (PID: 3836)
      • KMSPico.tmp (PID: 3508)
      • KMSpico_setup.tmp (PID: 1704)
      • KMSpico_setup.tmp (PID: 5888)

    • Process checks computer location settings

      • KMSPico.tmp (PID: 5208)
      • KMSpico_setup.tmp (PID: 1704)

    • Creates files in the program directory

      • KMSPico.tmp (PID: 3508)

    • Creates a software uninstall entry

      • KMSPico.tmp (PID: 3508)

    • The process uses the downloaded file

      • powershell.exe (PID: 2356)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 159744
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: AutoPico
FileDescription: AutoPico Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: AutoPico
ProductVersion: 1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
56
Malicious processes
9
Suspicious processes
5

Behavior graph

Click at the process to see the details
start kmspico.exe kmspico.tmp no specs kmspico.exe kmspico.tmp kmspico_setup.exe windowsdefender.exe no specs powershell.exe no specs conhost.exe no specs kmspico_setup.tmp no specs kmspico_setup.exe kmspico_setup.tmp windowsdefender.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs wusa.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powercfg.exe no specs powercfg.exe no specs powercfg.exe no specs conhost.exe no specs powercfg.exe no specs conhost.exe no specs conhost.exe no specs conhost.exe no specs dialer.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs choice.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs uninshs.exe no specs schtasks.exe no specs kmseldi.exe autopico.exe no specs secoh-qad.exe no specs sppextcomobj.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
440\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
540C:\WINDOWS\system32\sc.exe stop bitsC:\Windows\System32\sc.exe—WindowsDefender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
932wusa /uninstall /kb:890830 /quiet /norestartC:\Windows\System32\wusa.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Update Standalone Installer
Exit code:
87
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wusa.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powercfg.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228C:\WINDOWS\system32\powercfg.exe /x -standby-timeout-ac 0C:\Windows\System32\powercfg.exe—WindowsDefender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Power Settings Command-Line Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\powercfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1400"C:\WINDOWS\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""C:\Windows\System32\cmd.exe—KMSpico_setup.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1416\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
1512C:\WINDOWS\system32\sc.exe stop wuauservC:\Windows\System32\sc.exe—WindowsDefender.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
1062
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
1704"C:\Users\admin\AppData\Local\Temp\is-OIA0V.tmp\KMSpico_setup.tmp" /SL5="$302F2,2952592,69120,C:\Program Files (x86)\AutoPico\KMSpico_setup.exe" C:\Users\admin\AppData\Local\Temp\is-OIA0V.tmp\KMSpico_setup.tmp—KMSpico_setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-oia0v.tmp\kmspico_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
15 118
Read events
15 095
Write events
23
Delete events
0

Modification events

(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.3.3
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files (x86)\AutoPico
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files (x86)\AutoPico\
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:DisplayName
Value:
AutoPico version 1.0
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files (x86)\AutoPico\unins000.exe"
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files (x86)\AutoPico\unins000.exe" /SILENT
(PID) Process:(3508) KMSPico.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AutoPico_is1
Operation:writeName:DisplayVersion
Value:
1.0
Executable files
36
Suspicious files
38
Text files
722
Unknown types
0

Dropped files

PID
Process
Filename
Type
3508KMSPico.tmpC:\Program Files (x86)\AutoPico\is-KRI4G.tmpexecutable
MD5:8E34C5942B6D976A0B6ADE26C07D5FA3
SHA256:C5AF0E9D4BD80FBA2CFB9B9E22CD055785F2561C3205E2206CE8D37F96923AAC
2728KMSpico_setup.exeC:\Users\admin\AppData\Local\Temp\is-H8EV7.tmp\KMSpico_setup.tmpexecutable
MD5:1778C1F66FF205875A6435A33229AB3C
SHA256:95C06ACAC4FE4598840E5556F9613D43AA1039C52DAC64536F59E45A70F79DA6
3508KMSPico.tmpC:\Program Files (x86)\AutoPico\is-NJQAL.tmpexecutable
MD5:A02164371A50C5FF9FA2870EF6E8CFA3
SHA256:64C731ADBE1B96CB5765203B1E215093DCF268D020B299445884A4AE62ED2D3A
3508KMSPico.tmpC:\Users\admin\AppData\Local\Temp\is-OCKEG.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
3508KMSPico.tmpC:\Program Files (x86)\AutoPico\unins000.datbinary
MD5:B22E7C1C3E16ADACA331EA4D4C2C401D
SHA256:DCB11600B66C4EE0F5B8DCC5A8394522210FEA98448D51F40B0B9B69CCDD0A02
4624powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_kntspw5r.ypm.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3508KMSPico.tmpC:\Program Files (x86)\AutoPico\KMSpico_setup.exeexecutable
MD5:A02164371A50C5FF9FA2870EF6E8CFA3
SHA256:64C731ADBE1B96CB5765203B1E215093DCF268D020B299445884A4AE62ED2D3A
3508KMSPico.tmpC:\Program Files (x86)\AutoPico\WindowsDefender.exeexecutable
MD5:DC7090E5881A1255E747AA562E6B6A16
SHA256:E492C77D4584E952218E5183B68AACAB3CBC0D46AD5A08863DAA1ADA03AA5443
2356powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:A6E46EFB9B789882C6047F8A32A5B9E8
SHA256:E84F7410EF023C46C24F52EA44082C223331598FD7A4CCDE0B2B588F4DCC0CD9
3508KMSPico.tmpC:\Program Files (x86)\AutoPico\is-RHE2P.tmpexecutable
MD5:DC7090E5881A1255E747AA562E6B6A16
SHA256:E492C77D4584E952218E5183B68AACAB3CBC0D46AD5A08863DAA1ADA03AA5443
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
23
DNS requests
9
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
732
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
732
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
POST
204
104.126.37.171:443
https://www.bing.com/threshold/xls.aspx
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
732
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
732
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
732
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3976
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
0.pool.ntp.org
  • 62.75.236.38
  • 194.50.19.117
  • 217.144.138.234
  • 188.245.97.96
whitelisted
www.bing.com
  • 2.23.209.144
  • 2.23.209.158
  • 2.23.209.141
  • 2.23.209.149
  • 2.23.209.162
  • 2.23.209.156
  • 2.23.209.150
  • 2.23.209.176
  • 2.23.209.160
whitelisted
3.pool.ntp.org
  • 185.252.140.126
  • 162.159.200.123
  • 62.128.1.18
  • 81.169.217.236
whitelisted
self.events.data.microsoft.com
  • 20.189.173.4
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSPico.exe