File name:

KMSAUTO.2018.V1.5.3.rar

Full analysis: https://app.any.run/tasks/ab6399a1-f353-41d8-85ae-0502cdac07be
Verdict: Malicious activity
Analysis date: July 08, 2025, 13:16:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
kms
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

A85EAC002928ACE6BBDD9C38DCCC0489

SHA1:

962CF3CBC987284708F85DDBC5E2270C4D60E8CA

SHA256:

5DD424D55D332A96C59AFE4D4F30C52CBBC06E766BF82F5632E67BD171923053

SSDEEP:

49152:A9wrICJf9rFz/mKRIkID17mx5idipAla+OGXmtkQ+eQ52a/YVwkjm9d3KreTu2y9:31xz5R+1sidngtkFpF0e9oeTu27kd

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • KMSAuto Net.exe (PID: 3620)
      • KMSAuto Net.exe (PID: 1632)
      • certmgr.exe (PID: 3636)
      • certmgr.exe (PID: 2696)
      • KMSSS.exe (PID: 4684)
      • FakeClient.exe (PID: 3704)

    • Generic archive extractor

      • WinRAR.exe (PID: 2080)

  • SUSPICIOUS

    • KMS tool has been detected

      • KMSAuto Net.exe (PID: 3620)
      • KMSAuto Net.exe (PID: 1632)
      • KMSAuto Net.exe (PID: 1632)

    • Reads Internet Explorer settings

      • KMSAuto Net.exe (PID: 1632)

    • Starts CMD.EXE for commands execution

      • KMSAuto Net.exe (PID: 1632)
      • cmd.exe (PID: 6260)

    • Drops 7-zip archiver for unpacking

      • KMSAuto Net.exe (PID: 1632)

    • Executable content was dropped or overwritten

      • KMSAuto Net.exe (PID: 1632)
      • wzt.dat (PID: 5352)
      • bin.dat (PID: 6896)
      • AESDecoder.exe (PID: 5724)
      • bin_x64.dat (PID: 5744)
      • bin_x64.dat (PID: 6164)

    • Process drops legitimate windows executable

      • wzt.dat (PID: 5352)
      • bin_x64.dat (PID: 5744)
      • bin_x64.dat (PID: 6164)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4512)
      • cmd.exe (PID: 3760)
      • cmd.exe (PID: 864)
      • cmd.exe (PID: 5824)

    • Adds/modifies Windows certificates

      • certmgr.exe (PID: 3636)
      • certmgr.exe (PID: 2696)

    • There is functionality for taking screenshot (YARA)

      • KMSAuto Net.exe (PID: 1632)

    • Drops a system driver (possible attempt to evade defenses)

      • bin_x64.dat (PID: 5744)
      • bin_x64.dat (PID: 6164)

    • Application launched itself

      • cmd.exe (PID: 6260)

    • Creates a new Windows service

      • sc.exe (PID: 2292)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 1632)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • KMSAuto Net.exe (PID: 1632)

    • Executes as Windows Service

      • KMSSS.exe (PID: 4684)

    • Creates or modifies Windows services

      • KMSAuto Net.exe (PID: 1632)

    • Windows service management via SC.EXE

      • sc.exe (PID: 3556)

    • Uses ROUTE.EXE to modify routing table

      • cmd.exe (PID: 5716)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2080)

    • Manual execution by a user

      • KMSAuto Net.exe (PID: 3620)
      • KMSAuto Net.exe (PID: 1632)

    • Reads the machine GUID from the registry

      • KMSAuto Net.exe (PID: 1632)
      • KMSSS.exe (PID: 4684)

    • Checks supported languages

      • KMSAuto Net.exe (PID: 1632)
      • wzt.dat (PID: 5352)
      • AESDecoder.exe (PID: 5724)
      • bin_x64.dat (PID: 5744)
      • certmgr.exe (PID: 2696)
      • certmgr.exe (PID: 3636)
      • bin.dat (PID: 6896)
      • KMSSS.exe (PID: 4684)
      • bin_x64.dat (PID: 6164)
      • FakeClient.exe (PID: 3704)

    • Creates a new folder

      • cmd.exe (PID: 4960)
      • cmd.exe (PID: 6412)

    • Reads the computer name

      • KMSAuto Net.exe (PID: 1632)
      • KMSSS.exe (PID: 4684)
      • FakeClient.exe (PID: 3704)

    • Creates files or folders in the user directory

      • KMSAuto Net.exe (PID: 1632)

    • Reads Environment values

      • KMSAuto Net.exe (PID: 1632)

    • Reads product name

      • KMSAuto Net.exe (PID: 1632)

    • Creates files in the program directory

      • cmd.exe (PID: 6412)
      • wzt.dat (PID: 5352)
      • KMSAuto Net.exe (PID: 1632)
      • bin.dat (PID: 6896)
      • AESDecoder.exe (PID: 5724)
      • bin_x64.dat (PID: 5744)
      • KMSSS.exe (PID: 4684)
      • bin_x64.dat (PID: 6164)

    • The sample compiled with english language support

      • wzt.dat (PID: 5352)
      • KMSAuto Net.exe (PID: 1632)
      • bin_x64.dat (PID: 5744)
      • bin_x64.dat (PID: 6164)

    • Adds a route via ROUTE.EXE

      • ROUTE.EXE (PID: 3588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

FileVersion: RAR v4
CompressedSize: 3494384
UncompressedSize: 8991592
OperatingSystem: Win32
ModifyDate: 2017:10:31 13:35:34
PackingMethod: Normal
ArchivedFileName: KMSAUTO.2018.V1.5.3\KMSAuto Net.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
201
Monitored processes
66
Malicious processes
5
Suspicious processes
5

Behavior graph

Click at the process to see the details
start winrar.exe no specs rundll32.exe no specs kmsauto net.exe no specs kmsauto net.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs wzt.dat no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs certmgr.exe no specs cmd.exe no specs conhost.exe no specs certmgr.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bin.dat no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs aesdecoder.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bin_x64.dat no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs netstat.exe no specs find.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs kmsss.exe no specs cmd.exe no specs conhost.exe no specs bin_x64.dat no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs route.exe no specs cmd.exe no specs conhost.exe no specs fakeclient.exe

Process information

PID
CMD
Path
Indicators
Parent process
620C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
728C:\WINDOWS\Sysnative\cmd.exe /c echo test>>"C:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\test.test"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
864C:\WINDOWS\Sysnative\cmd.exe /D /c bin.dat -y -pkmsautoC:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1044\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1132\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1200C:\WINDOWS\Sysnative\cmd.exe /D /c del /F /Q "bin.dat"C:\Windows\System32\cmd.exe—KMSAuto Net.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1204\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1336find ":1688 "C:\Windows\System32\find.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Find String (grep) Utility
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\find.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1612\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
5 760
Read events
5 728
Write events
17
Delete events
15

Modification events

(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\KMSAUTO.2018.V1.5.3.rar
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:4
Value:
(PID) Process:(2080) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:3
Value:
Executable files
26
Suspicious files
6
Text files
16
Unknown types
7

Dropped files

PID
Process
Filename
Type
2080WinRAR.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\KMSAuto Net.exeexecutable
MD5:FD743B55D530E0468805DE0E83758FE9
SHA256:161937ED1502C491748D055287898DD37AF96405AEFF48C2500B834F6739E72D
2080WinRAR.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\readme\readme_cn.txttext
MD5:331ABF76B15C262AB1062B2A4133EF1D
SHA256:563DF1A8135D7A95B83732402E5E7B9758ED087BE77713BE3FB3F16368A0E626
2080WinRAR.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\readme\readme_vi.txttext
MD5:41AB829389DE2A3B0B553B6F06238B81
SHA256:8C5142852F9D45E9991A7C085D42FD85FEEFE5A1CE6D7423179F9005382087E5
2080WinRAR.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\readme\readme_bg.txttext
MD5:C55477D53DC34F0C75E62E9657C6A443
SHA256:99D0EDB27FB925CED9CC874B9DFEE992922C793CB3DC2FF316C27FC5C2F95CB8
2080WinRAR.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\Leer Informacion.txttext
MD5:325D5B655C582A93892CD4B87A751CDC
SHA256:8972F7BF9AFAB204BB81BC426875464170E49091538157B5D21269E3C4447777
2080WinRAR.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\readme\readme_es.txttext
MD5:A509B07A4DD2B8C071E603317BA56063
SHA256:7474EEBB4B6F28F8C93F86FB684CB27BE73BAA448919531D331CAF2F137759CE
2080WinRAR.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\readme\readme_en.txttext
MD5:D3CB6D4222275D20965FADAF211B6F7B
SHA256:0B92CCD1EBE970BE36D35DC5B4E4887DAD4CC77A1AA6544AB735884C17478BB5
2080WinRAR.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\readme\readme_fr.txttext
MD5:6BDE29D200D4A7A9A704F49F73207C7D
SHA256:250973C8879BB759AAC7F31582FFFB00414BFC5449FE4979F2A2B44EC4664D70
728cmd.exeC:\Users\admin\Desktop\KMSAUTO.2018.V1.5.3\test.testtext
MD5:9F06243ABCB89C70E0C331C61D871FA7
SHA256:837CCB607E312B170FAC7383D7CCFD61FA5072793F19A25E75FBACB56539B86B
6896bin.datC:\ProgramData\KMSAuto\bin\TunMirror2.exe.aesbinary
MD5:A1A5AFA53B578DB6ABF400A88548F487
SHA256:A9E76D637E0C0A65036D7F2D5C3D7B1C53218B94716554F4D9F6630DCFF8C75A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
21
DNS requests
16
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
436
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2272
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2272
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5060
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
52.137.106.217:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1268
svchost.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
1268
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
436
svchost.exe
20.190.159.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
436
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 52.137.106.217
  • 51.104.136.2
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.131
  • 20.190.159.68
  • 40.126.31.130
  • 20.190.159.71
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
Process
Message
FakeClient.exe
WdfCoInstaller: [07/08/2025 13:17.29.192] ReadComponents: WdfSection for Driver Service windivert using KMDF lib version Major 0x1, minor 0x9
FakeClient.exe
WdfCoInstaller: [07/08/2025 13:17.29.192] BootApplication: could not open service windivert, error error(1060) The specified service does not exist as an installed service.
FakeClient.exe
WdfCoInstaller: [07/08/2025 13:17.29.192] BootApplication: GetStartType error error(87) The parameter is incorrect. Driver Service name windivert
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSAUTO.2018.V1.5.3.rar