| URL: | https://kms-auto.site/windows-10-activator/ |
| Full analysis: | https://app.any.run/tasks/fbc45866-3c9e-4ed4-97e7-d8c49517e337 |
| Verdict: | Malicious activity |
| Threats: | Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. |
| Analysis date: | April 19, 2025, 20:46:18 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MD5: | 9EFD4BFED963C11F7A402C76A026C2B7 |
| SHA1: | D796CBD9506608C05CD772DED311D2ABDE737265 |
| SHA256: | 33303CDADC1E59428DDB214CCAEA6B8246F0E87491163D2F1F527D6B1D15CFF3 |
| SSDEEP: | 3:N8NPEQRQWXML8iEGqW:2tQkBivD |
MALICIOUS
Uses Task Scheduler to run other applications
- update.exe (PID: 7648)
- smss.exe (PID: 6752)
Uses Task Scheduler to autorun other applications
- update.exe (PID: 7648)
- smss.exe (PID: 6752)
RMS mutex has been found
- winserv.exe (PID: 7808)
- winserv.exe (PID: 6908)
- winserv.exe (PID: 6760)
Changes the autorun value in the registry
- IP.exe (PID: 4120)
RMS is detected
- winserv.exe (PID: 6908)
Starts NET.EXE to view/change users localgroup
- cmd.exe (PID: 3620)
- net.exe (PID: 4208)
- net.exe (PID: 3240)
- cmd.exe (PID: 7836)
- net.exe (PID: 5772)
- cmd.exe (PID: 5952)
- cmd.exe (PID: 1004)
- net.exe (PID: 7356)
- cmd.exe (PID: 7136)
- net.exe (PID: 4572)
- cmd.exe (PID: 6252)
- net.exe (PID: 3884)
Starts NET.EXE to view/add/change user profiles
- net.exe (PID: 7436)
- cmd.exe (PID: 8160)
Creates or modifies Windows services
- RDPWinst.exe (PID: 5544)
RDPWRAP has been detected
- RDPWinst.exe (PID: 5544)
SUSPICIOUS
Starts CMD.EXE for commands execution
- GSetup.exe (PID: 1240)
- update.exe (PID: 7648)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 2984)
- install.exe (PID: 4740)
- update.exe (PID: 7648)
- svchost.exe (PID: 7312)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
Executable content was dropped or overwritten
- KMSTools Lite.exe (PID: 7804)
- install.exe (PID: 4740)
- GSetup.exe (PID: 1240)
- 7zaxxx.exe (PID: 3176)
- update.exe (PID: 7648)
- svchost.exe (PID: 7312)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
- RDPWinst.exe (PID: 5544)
Reads the BIOS version
- KMSTools Lite.exe (PID: 7804)
- KMS.exe (PID: 7256)
- update.exe (PID: 7648)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
Process drops legitimate windows executable
- install.exe (PID: 4740)
- svchost.exe (PID: 7312)
- IP.exe (PID: 4120)
- RDPWinst.exe (PID: 5544)
Drops 7-zip archiver for unpacking
- GSetup.exe (PID: 1240)
Reads the date of Windows installation
- update.exe (PID: 7648)
- smss.exe (PID: 6752)
- winserv.exe (PID: 7808)
- winserv.exe (PID: 6908)
- winserv.exe (PID: 6760)
Uses ICACLS.EXE to modify access control lists
- cmd.exe (PID: 684)
- cmd.exe (PID: 924)
- cmd.exe (PID: 7720)
- cmd.exe (PID: 3012)
- cmd.exe (PID: 3676)
- cmd.exe (PID: 3268)
- cmd.exe (PID: 7964)
- cmd.exe (PID: 536)
- cmd.exe (PID: 3304)
- cmd.exe (PID: 7520)
- cmd.exe (PID: 5308)
- cmd.exe (PID: 5164)
- cmd.exe (PID: 4628)
- cmd.exe (PID: 536)
- cmd.exe (PID: 7172)
- cmd.exe (PID: 6872)
- cmd.exe (PID: 5124)
- cmd.exe (PID: 7728)
- cmd.exe (PID: 8068)
- cmd.exe (PID: 2656)
- cmd.exe (PID: 6560)
- cmd.exe (PID: 3304)
- cmd.exe (PID: 6640)
- cmd.exe (PID: 1748)
- cmd.exe (PID: 3012)
- cmd.exe (PID: 7152)
- cmd.exe (PID: 3884)
- cmd.exe (PID: 2104)
- cmd.exe (PID: 2240)
- cmd.exe (PID: 5864)
- cmd.exe (PID: 8160)
- cmd.exe (PID: 5608)
- cmd.exe (PID: 8092)
- cmd.exe (PID: 5164)
- cmd.exe (PID: 7960)
- cmd.exe (PID: 2656)
- cmd.exe (PID: 6252)
- cmd.exe (PID: 2840)
- cmd.exe (PID: 2564)
- cmd.exe (PID: 6404)
- cmd.exe (PID: 5780)
- cmd.exe (PID: 4464)
- cmd.exe (PID: 7012)
- cmd.exe (PID: 8184)
- cmd.exe (PID: 3896)
- cmd.exe (PID: 6192)
- cmd.exe (PID: 4284)
- cmd.exe (PID: 2656)
- cmd.exe (PID: 900)
- cmd.exe (PID: 2088)
- cmd.exe (PID: 7012)
- cmd.exe (PID: 2420)
- cmd.exe (PID: 3760)
- cmd.exe (PID: 3896)
- cmd.exe (PID: 4308)
- cmd.exe (PID: 4464)
- cmd.exe (PID: 744)
- cmd.exe (PID: 6456)
- cmd.exe (PID: 5736)
- cmd.exe (PID: 5736)
- cmd.exe (PID: 7084)
- cmd.exe (PID: 4284)
- cmd.exe (PID: 3032)
- cmd.exe (PID: 6136)
- cmd.exe (PID: 7964)
- cmd.exe (PID: 7300)
- cmd.exe (PID: 1004)
- cmd.exe (PID: 4736)
- cmd.exe (PID: 8016)
- cmd.exe (PID: 6264)
- cmd.exe (PID: 6752)
- cmd.exe (PID: 4464)
- cmd.exe (PID: 6136)
- cmd.exe (PID: 1096)
- cmd.exe (PID: 5364)
- cmd.exe (PID: 6820)
- cmd.exe (PID: 6228)
- cmd.exe (PID: 7812)
- cmd.exe (PID: 232)
- cmd.exe (PID: 2064)
- cmd.exe (PID: 4892)
- cmd.exe (PID: 7248)
- cmd.exe (PID: 6404)
- cmd.exe (PID: 5512)
- cmd.exe (PID: 4628)
- cmd.exe (PID: 904)
- cmd.exe (PID: 3176)
- cmd.exe (PID: 2088)
- cmd.exe (PID: 7728)
- cmd.exe (PID: 1748)
- cmd.exe (PID: 6540)
- cmd.exe (PID: 4164)
- cmd.exe (PID: 5776)
- cmd.exe (PID: 7152)
- cmd.exe (PID: 7316)
- cmd.exe (PID: 3300)
- cmd.exe (PID: 644)
- cmd.exe (PID: 2064)
- cmd.exe (PID: 7392)
- cmd.exe (PID: 7220)
- cmd.exe (PID: 3156)
- cmd.exe (PID: 5164)
- cmd.exe (PID: 3828)
- cmd.exe (PID: 6808)
- cmd.exe (PID: 5124)
- cmd.exe (PID: 6712)
The process creates files with name similar to system file names
- update.exe (PID: 7648)
Potential Corporate Privacy Violation
- smss.exe (PID: 6752)
- svchost.exe (PID: 2196)
- winserv.exe (PID: 6908)
Detected use of alternative data streams (AltDS)
- IP.exe (PID: 4120)
- smss.exe (PID: 6752)
Application launched itself
- winserv.exe (PID: 7808)
Executing commands from a ".bat" file
- IP.exe (PID: 4120)
- smss.exe (PID: 6752)
- update.exe (PID: 7648)
Modifies hosts file to alter network resolution
- cmd.exe (PID: 6652)
Connects to unusual port
- winserv.exe (PID: 6908)
Uses NETSH.EXE to add a firewall rule or allowed programs
- RDPWinst.exe (PID: 5544)
Checks for external IP
- svchost.exe (PID: 2196)
- smss.exe (PID: 6752)
The process verifies whether the antivirus software is installed
- smss.exe (PID: 6752)
- update.exe (PID: 7648)
- icacls.exe (PID: 7720)
- icacls.exe (PID: 5136)
- icacls.exe (PID: 7832)
- icacls.exe (PID: 4628)
- icacls.exe (PID: 540)
- icacls.exe (PID: 6820)
- icacls.exe (PID: 4268)
- icacls.exe (PID: 2420)
- icacls.exe (PID: 4308)
- icacls.exe (PID: 3304)
- icacls.exe (PID: 7768)
- icacls.exe (PID: 4572)
- icacls.exe (PID: 7392)
- icacls.exe (PID: 232)
- icacls.exe (PID: 7728)
- icacls.exe (PID: 616)
- icacls.exe (PID: 924)
- icacls.exe (PID: 6944)
- icacls.exe (PID: 3956)
Uses TIMEOUT.EXE to delay execution
- cmd.exe (PID: 6004)
- cmd.exe (PID: 4308)
Uses REG/REGEDIT.EXE to modify registry
- cmd.exe (PID: 6560)
- cmd.exe (PID: 7308)
- cmd.exe (PID: 1184)
Found strings related to reading or modifying Windows Defender settings
- update.exe (PID: 7648)
The process executes via Task Scheduler
- unsecapp.exe (PID: 4268)
- winserv.exe (PID: 6760)
Windows service management via SC.EXE
- sc.exe (PID: 6800)
- sc.exe (PID: 5776)
- sc.exe (PID: 7520)
- sc.exe (PID: 5164)
Stops a currently running service
- sc.exe (PID: 744)
- sc.exe (PID: 300)
Starts SC.EXE for service management
- cmd.exe (PID: 6808)
- cmd.exe (PID: 1184)
- cmd.exe (PID: 7252)
- cmd.exe (PID: 4740)
- cmd.exe (PID: 2136)
- cmd.exe (PID: 900)
INFO
Reads the software policy settings
- slui.exe (PID: 7052)
- slui.exe (PID: 2420)
- IP.exe (PID: 4120)
- smss.exe (PID: 6752)
Application launched itself
- firefox.exe (PID: 2616)
- firefox.exe (PID: 5072)
Checks supported languages
- KMSTools Lite.exe (PID: 7804)
- GSetup.exe (PID: 1240)
- install.exe (PID: 4740)
- 7zaxxx.exe (PID: 3176)
- KMS.exe (PID: 7256)
- update.exe (PID: 7648)
- W10DigitalActivation.exe (PID: 7544)
- win.exe (PID: 2320)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
- svchost.exe (PID: 7312)
- winserv.exe (PID: 7808)
- winserv.exe (PID: 6908)
- RDPWinst.exe (PID: 5544)
- winserv.exe (PID: 6760)
Executable content was dropped or overwritten
- WinRAR.exe (PID: 2984)
Reads mouse settings
- KMSTools Lite.exe (PID: 7804)
- KMS.exe (PID: 7256)
- update.exe (PID: 7648)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
- unsecapp.exe (PID: 7764)
- unsecapp.exe (PID: 4268)
Manual execution by a user
- WinRAR.exe (PID: 2984)
Creates files in the program directory
- KMSTools Lite.exe (PID: 7804)
- install.exe (PID: 4740)
- update.exe (PID: 7648)
- win.exe (PID: 2320)
- svchost.exe (PID: 7312)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
- RDPWinst.exe (PID: 5544)
Checks proxy server information
- slui.exe (PID: 2420)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
Create files in a temporary directory
- KMSTools Lite.exe (PID: 7804)
- GSetup.exe (PID: 1240)
- 7zaxxx.exe (PID: 3176)
- update.exe (PID: 7648)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
Reads the computer name
- GSetup.exe (PID: 1240)
- install.exe (PID: 4740)
- 7zaxxx.exe (PID: 3176)
- win.exe (PID: 2320)
- update.exe (PID: 7648)
- svchost.exe (PID: 7312)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
- winserv.exe (PID: 6908)
- RDPWinst.exe (PID: 5544)
- winserv.exe (PID: 7808)
- winserv.exe (PID: 6760)
Process checks whether UAC notifications are on
- KMSTools Lite.exe (PID: 7804)
- KMS.exe (PID: 7256)
- update.exe (PID: 7648)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
The sample compiled with english language support
- install.exe (PID: 4740)
- GSetup.exe (PID: 1240)
- svchost.exe (PID: 7312)
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
- RDPWinst.exe (PID: 5544)
Process checks computer location settings
- install.exe (PID: 4740)
- update.exe (PID: 7648)
- svchost.exe (PID: 7312)
- smss.exe (PID: 6752)
- winserv.exe (PID: 7808)
- winserv.exe (PID: 6908)
- winserv.exe (PID: 6760)
Reads product name
- update.exe (PID: 7648)
- IP.exe (PID: 4120)
- winserv.exe (PID: 7808)
- winserv.exe (PID: 6908)
- smss.exe (PID: 6752)
- winserv.exe (PID: 6760)
Reads Environment values
- update.exe (PID: 7648)
- IP.exe (PID: 4120)
- winserv.exe (PID: 7808)
- winserv.exe (PID: 6908)
- smss.exe (PID: 6752)
- winserv.exe (PID: 6760)
Creates files or folders in the user directory
- smss.exe (PID: 6752)
- IP.exe (PID: 4120)
- winserv.exe (PID: 6908)
Reads Windows Product ID
- winserv.exe (PID: 7808)
- winserv.exe (PID: 6908)
- winserv.exe (PID: 6760)
Reads the machine GUID from the registry
- winserv.exe (PID: 7808)
- IP.exe (PID: 4120)
- winserv.exe (PID: 6908)
- winserv.exe (PID: 6760)
RDPWRAP has been detected
- smss.exe (PID: 6752)
- RDPWinst.exe (PID: 5544)
Reads CPU info
- smss.exe (PID: 6752)
Themida protector has been detected
- smss.exe (PID: 6752)
The process uses AutoIt
- smss.exe (PID: 6752)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
592
Monitored processes
452
Malicious processes
30
Suspicious processes
22
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\WINDOWS\system32\net1 localgroup "Remote Desktop Users" john /add | C:\Windows\System32\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Net Command Exit code: 0 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 208 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 232 | icacls "C:\Program Files\DrWeb" /deny "admin":(OI)(CI)(F) | C:\Windows\System32\icacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 232 | C:\WINDOWS\system32\cmd.exe /c icacls "C:\Program Files\Process Lasso" /deny "%username%":(OI)(CI)(F) | C:\Windows\System32\cmd.exe | — | update.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 232 | icacls "C:\Program Files (x86)\Moo0" /deny "admin":(OI)(CI)(F) | C:\Windows\System32\icacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 300 | sc stop bytefenceservice | C:\Windows\System32\sc.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Service Control Manager Configuration Tool Exit code: 1060 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 516 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 516 | icacls "C:\ProgramData\PuzzleMedia" /deny "admin":(OI)(CI)(F) | C:\Windows\System32\icacls.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 536 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | RDPWinst.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 536 | C:\WINDOWS\system32\cmd.exe /c icacls "C:\Windows\Fonts\Mysql" /deny "%username%":(OI)(CI)(F) | C:\Windows\System32\cmd.exe | — | update.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
38 025
Read events
37 918
Write events
107
Delete events
0
Modification events
| (PID) Process: | (5072) firefox.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Mozilla\Firefox\DllPrefetchExperiment |
| Operation: | write | Name: | C:\Program Files\Mozilla Firefox\firefox.exe |
Value: 0 | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 3 |
Value: C:\Users\admin\Desktop\preferences.zip | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 2 |
Value: C:\Users\admin\Desktop\chromium_ext.zip | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\omni_23_10_2024_.zip | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Downloads\KMSTools.zip | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (2984) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
Executable files
16
Suspicious files
207
Text files
40
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5072 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\scriptCache-current.bin | — | |
MD5:— | SHA256:— | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\cookies.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite | — | |
MD5:— | SHA256:— | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm | binary | |
MD5:B7C14EC6110FA820CA6B65F5AEC85911 | SHA256:FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\9kie7cg6.default-release\startupCache\urlCache-current.bin | binary | |
MD5:297E88D7CEB26E549254EC875649F4EB | SHA256:8B75D4FB1845BAA06122888D11F6B65E6A36B140C54A72CC13DF390FD7C95702 | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json.tmp | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\sessionCheckpoints.json | binary | |
MD5:EA8B62857DFDBD3D0BE7D7E4A954EC9A | SHA256:792955295AE9C382986222C6731C5870BD0E921E7F7E34CC4615F5CD67F225DA | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs-1.js | text | |
MD5:2C99A16AED3906D92FFE3EF1808E2753 | SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452 | |||
| 5072 | firefox.exe | C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\9kie7cg6.default-release\prefs.js | text | |
MD5:2C99A16AED3906D92FFE3EF1808E2753 | SHA256:08412578CC3BB4922388F8FF8C23962F616B69A1588DA720ADE429129C73C452 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
39
TCP/UDP connections
101
DNS requests
143
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.216.77.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5072 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/canonical.html | unknown | — | — | whitelisted |
5072 | firefox.exe | GET | 200 | 34.107.221.82:80 | http://detectportal.firefox.com/success.txt?ipv4 | unknown | — | — | whitelisted |
5072 | firefox.exe | POST | 200 | 142.250.186.131:80 | http://o.pki.goog/s/we1/uOk | unknown | — | — | whitelisted |
5072 | firefox.exe | POST | 200 | 142.250.186.131:80 | http://o.pki.goog/s/wr3/cgo | unknown | — | — | whitelisted |
5072 | firefox.exe | POST | 200 | 2.16.206.148:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
5072 | firefox.exe | POST | 200 | 2.16.206.148:80 | http://r11.o.lencr.org/ | unknown | — | — | whitelisted |
5072 | firefox.exe | POST | 200 | 2.16.206.143:80 | http://r10.o.lencr.org/ | unknown | — | — | whitelisted |
5072 | firefox.exe | POST | 200 | 142.250.186.131:80 | http://o.pki.goog/we2 | unknown | — | — | whitelisted |
5072 | firefox.exe | POST | 200 | 2.16.206.143:80 | http://r10.o.lencr.org/ | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2104 | svchost.exe | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 23.216.77.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5072 | firefox.exe | 104.21.35.36:443 | kms-auto.site | CLOUDFLARENET | — | suspicious |
5072 | firefox.exe | 34.107.221.82:80 | detectportal.firefox.com | GOOGLE | US | whitelisted |
5072 | firefox.exe | 34.36.137.203:443 | contile.services.mozilla.com | GOOGLE-CLOUD-PLATFORM | US | whitelisted |
5072 | firefox.exe | 142.250.186.131:80 | o.pki.goog | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
kms-auto.site |
| unknown |
detectportal.firefox.com |
| whitelisted |
prod.detectportal.prod.cloudops.mozgcp.net |
| whitelisted |
contile.services.mozilla.com |
| whitelisted |
spocs.getpocket.com |
| whitelisted |
example.org |
| whitelisted |
ipv4only.arpa |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
6752 | smss.exe | Potential Corporate Privacy Violation | ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
6752 | smss.exe | Potential Corporate Privacy Violation | ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
2196 | svchost.exe | Potential Corporate Privacy Violation | POLICY [ANY.RUN] IP Checker (iplogger .co) |
6752 | smss.exe | Potential Corporate Privacy Violation | ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
6752 | smss.exe | Potential Corporate Privacy Violation | ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |
6908 | winserv.exe | Potential Corporate Privacy Violation | REMOTE [ANY.RUN] Remote Access Tool Has been detected |
6752 | smss.exe | Potentially Bad Traffic | ET INFO RDP Wrapper Download (ini) |
2196 | svchost.exe | Device Retrieving External IP Address Detected | INFO [ANY.RUN] External IP Check (ip-api .com) |
2196 | svchost.exe | Device Retrieving External IP Address Detected | ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) |
6752 | smss.exe | Potential Corporate Privacy Violation | ET INFO Autoit Windows Automation tool User-Agent in HTTP Request - Possibly Hostile |