File name:

KMSAuto++ Portable v1.9.9 b06.7z

Full analysis: https://app.any.run/tasks/9315a6a8-902c-40df-a8f3-918d750a8b9c
Verdict: Malicious activity
Analysis date: March 19, 2025, 15:52:52
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-7z-compressed
File info: 7-zip archive data, version 0.4
MD5:

423EFB73A631241EC0CBA8190AFD7D3E

SHA1:

579FF2365A9499E0C8EEF4FA1EBCD8BA9E228A08

SHA256:

5DEC7CD4F7ED331AA36D40CC6BEEDD9606F382334CB39CAE6B4E33E87BC81021

SSDEEP:

98304:7me5cfyoCMtTUwmyMAYVQyLCp3d9JAH9ul/HmZ7s0XWQHVAHTPUsGXz4CJYGzSjr:C8T06rzVdmIuiuD1xLh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses name of the domain to which a computer belongs via WMI (SCRIPT)

      • cscript.exe (PID: 7012)

    • Uses WMIC.EXE to add exclusions to the Windows Defender

      • cmd.exe (PID: 6700)
      • cmd.exe (PID: 1228)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 6456)

  • SUSPICIOUS

    • The process executes VB scripts

      • cmd.exe (PID: 968)
      • cmd.exe (PID: 1072)
      • cmd.exe (PID: 6068)
      • cmd.exe (PID: 7696)
      • cmd.exe (PID: 6256)

    • Starts SC.EXE for service management

      • KMSAuto.exe (PID: 7304)
      • KMSAuto++.exe (PID: 5112)
      • KMSAuto.exe (PID: 7756)

    • Windows service management via SC.EXE

      • sc.exe (PID: 4040)
      • sc.exe (PID: 8176)
      • sc.exe (PID: 4108)
      • sc.exe (PID: 4380)
      • sc.exe (PID: 7576)
      • sc.exe (PID: 3828)
      • sc.exe (PID: 5364)
      • sc.exe (PID: 7960)

    • Starts CMD.EXE for commands execution

      • KMSAuto.exe (PID: 7304)
      • KMSAuto++.exe (PID: 5112)
      • OInstallLite.exe (PID: 7560)
      • KMSAuto.exe (PID: 7756)
      • O15-19LicSetup.exe (PID: 5508)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 7680)
      • cscript.exe (PID: 5936)
      • cscript.exe (PID: 7012)
      • cscript.exe (PID: 8176)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 7680)
      • cscript.exe (PID: 5936)
      • cscript.exe (PID: 7012)
      • cscript.exe (PID: 8176)
      • cscript.exe (PID: 5212)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 5376)
      • cmd.exe (PID: 5956)
      • cmd.exe (PID: 6040)
      • OInstallLite.exe (PID: 7560)

    • Executable content was dropped or overwritten

      • KMSAuto++.exe (PID: 5112)
      • files.dat (PID: 6036)
      • OInstallLite.exe (PID: 7560)
      • O15-19LicSetup.exe (PID: 5508)
      • files.dat (PID: 3180)

    • Drops 7-zip archiver for unpacking

      • OInstallLite.exe (PID: 7560)
      • O15-19LicSetup.exe (PID: 5508)

    • Process drops legitimate windows executable

      • files.dat (PID: 6036)
      • files.dat (PID: 3180)

    • Starts application with an unusual extension

      • cmd.exe (PID: 1128)
      • cmd.exe (PID: 1116)
      • cmd.exe (PID: 5864)

    • The process drops C-runtime libraries

      • files.dat (PID: 6036)
      • files.dat (PID: 3180)

    • The process bypasses the loading of PowerShell profile settings

      • OInstallLite.exe (PID: 7560)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6456)

    • Probably download files using WebClient

      • OInstallLite.exe (PID: 7560)

    • Starts POWERSHELL.EXE for commands execution

      • OInstallLite.exe (PID: 7560)

    • Found strings related to reading or modifying Windows Defender settings

      • OInstallLite.exe (PID: 7560)

    • Gets a collection of all available drive names (SCRIPT)

      • cscript.exe (PID: 5212)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 5212)

    • Gets the drive type (SCRIPT)

      • cscript.exe (PID: 5212)

    • Accesses computer name via WMI (SCRIPT)

      • cscript.exe (PID: 5212)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • cscript.exe (PID: 5212)

    • Sets XML DOM element text (SCRIPT)

      • cscript.exe (PID: 5212)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7476)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 3180)
      • cscript.exe (PID: 5212)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 3180)
      • powershell.exe (PID: 6456)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8004)
      • BackgroundTransferHost.exe (PID: 7276)
      • BackgroundTransferHost.exe (PID: 3180)
      • BackgroundTransferHost.exe (PID: 7868)
      • BackgroundTransferHost.exe (PID: 1180)
      • cscript.exe (PID: 7680)
      • cscript.exe (PID: 5936)
      • WMIC.exe (PID: 4932)
      • cscript.exe (PID: 5212)

    • Checks supported languages

      • KMSAuto.exe (PID: 7304)
      • OInstallLite.exe (PID: 7560)
      • KMSAuto.exe (PID: 7756)

    • Reads product name

      • KMSAuto.exe (PID: 7304)
      • KMSAuto++.exe (PID: 5112)

    • Manual execution by a user

      • KMSAuto.exe (PID: 7304)
      • KMSAuto.exe (PID: 4200)
      • KMSAuto++.exe (PID: 5112)
      • KMSAuto++.exe (PID: 5048)
      • KMSAuto.exe (PID: 7268)
      • KMSAuto.exe (PID: 7756)

    • Reads Environment values

      • KMSAuto.exe (PID: 7304)
      • KMSAuto++.exe (PID: 5112)

    • Reads the computer name

      • KMSAuto.exe (PID: 7304)
      • KMSAuto++.exe (PID: 5112)
      • O15-19LicSetup.exe (PID: 5508)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 3180)

    • Create files in a temporary directory

      • KMSAuto.exe (PID: 7304)
      • KMSAuto.exe (PID: 7756)
      • files.dat (PID: 3180)
      • files.dat (PID: 6980)
      • O15-19LicSetup.exe (PID: 5508)

    • Reads Microsoft Office registry keys

      • OInstallLite.exe (PID: 7560)

    • The sample compiled with english language support

      • OInstallLite.exe (PID: 7560)
      • files.dat (PID: 6036)
      • O15-19LicSetup.exe (PID: 5508)
      • files.dat (PID: 3180)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.7z | 7-Zip compressed archive (v0.4) (57.1)
.7z | 7-Zip compressed archive (gen) (42.8)

EXIF

ZIP

FileVersion: 7z v0.04
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
258
Monitored processes
110
Malicious processes
7
Suspicious processes
11

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs rundll32.exe no specs kmsauto.exe no specs kmsauto.exe cmd.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs shellexperiencehost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs kmsauto++.exe no specs kmsauto++.exe cmd.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs oinstalllite.exe cmd.exe no specs reg.exe no specs conhost.exe no specs conhost.exe no specs cmd.exe no specs wmic.exe no specs conhost.exe no specs files.dat cmd.exe no specs conhost.exe no specs wmic.exe no specs powershell.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs kmsauto.exe no specs kmsauto.exe cmd.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs reg.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs sc.exe no specs conhost.exe no specs o15-19licsetup.exe cmd.exe no specs conhost.exe no specs files.dat cmd.exe no specs conhost.exe no specs cscript.exe cmd.exe no specs conhost.exe no specs files.dat no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\WINDOWS\Sysnative\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender" /v DisableAntiSpywareC:\Windows\System32\reg.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
232\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616"C:\WINDOWS\Sysnative\reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows Script Host\Settings" /v Enabled /t REG_DWORD /d 1 /fC:\Windows\System32\reg.exe—OInstallLite.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
736\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
864\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
968"C:\WINDOWS\Sysnative\cmd.exe" /c cscript //nologo "C:\Users\admin\AppData\Local\Temp\slmgr.vbs" /dlvC:\Windows\System32\cmd.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
976\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1012"C:\WINDOWS\Sysnative\reg.exe" query "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpywareC:\Windows\System32\reg.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1072"C:\WINDOWS\Sysnative\cmd.exe" /c cscript //nologo "C:\Users\admin\AppData\Local\Temp\slmgr.vbs" /dlv allC:\Windows\System32\cmd.exe—KMSAuto.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
Total events
17 265
Read events
17 207
Write events
58
Delete events
0

Modification events

(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\KMSAuto++ Portable v1.9.9 b06.7z
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7476) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7276) BackgroundTransferHost.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\Internet Settings\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
18
Suspicious files
10
Text files
2 380
Unknown types
0

Dropped files

PID
Process
Filename
Type
3180BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\23dc5a3b-1ac4-41ce-a091-bdb327c339d8.down_data —
MD5:—
SHA256:—
7476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7476.40384\KMSAuto++ Portable v1.9.9 b06\readme_en.txttext
MD5:7A4FB804AF171AD041C65E3E46FD00B2
SHA256:C7A2D7FA7DCF9A08A5179720F81B947221F0E94BC797878352ECAE52D923C939
7476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7476.40384\KMSAuto++ Portable v1.9.9 b06\KMSAuto++ x64.exeexecutable
MD5:E228E241AAE4651B107F08179B9E9089
SHA256:E4FD36E9E3C1ED840A08097AC4DAAA59F9FA9449997DB6A7E0B99EA0C01CDD2B
7476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7476.40384\KMSAuto++ Portable v1.9.9 b06\KMSAuto++.initext
MD5:BC0334923377BD5E30A84695A347BBE8
SHA256:CE273D0485CEDEF6540F290D0332ADE2A2AC853A723C780BC439B70C37FC8F98
7476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7476.40384\KMSAuto++ Portable v1.9.9 b06\KMSAutoLite.initext
MD5:2A86E9EA22AEA5E9045FCE2E3C7BADBA
SHA256:9778EF93C59CA1E6E86F82E2FC01121BD4A76D0176B2D710D7FF64322A6F6567
7476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7476.40384\KMSAuto++ Portable v1.9.9 b06\readme_ru.txttext
MD5:89921EBFDAC4677B4ECC8972B2880FA8
SHA256:F82E3B77099BAF8C31F2C6F81F511B049EC5D08D3848834076AFD401FAB143DB
7476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7476.40384\KMSAuto++ Portable v1.9.9 b06\KMSAuto x64.exeexecutable
MD5:79231A73533F237D64BECC7AD95584B9
SHA256:C2C47FDAFAB559F05907DAB7865EF1F3B84C3B7C6B6E7BEE24CD708A55269CF6
7476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7476.40384\KMSAuto++ Portable v1.9.9 b06\KMSAuto.exeexecutable
MD5:D798854AC7161951BF8D224F3505A4D7
SHA256:26145F0E7ED61CDD31C6236D19FD1627B28928D672BBFF09312557C8E57FFCFC
7476WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRb7476.40384\KMSAuto++ Portable v1.9.9 b06\KMSAuto++.exeexecutable
MD5:324C898621297AF29E77076909BF52F9
SHA256:6785EC0D7D578777E46016DDB03894B344E30A5025F4A1B9E7A4642CBA14131F
3180BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\12264c31-5e7a-40ca-9e9b-69eb6361fa6d.up_meta_securebinary
MD5:EE9E42226DB119A21F3912BCB3C82BA9
SHA256:DDF1C2486FFEE21B9368E18AA7F68ED69D3B890DFF51872747C96CCC971DA7F9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
28
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7900
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
7900
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
5212
cscript.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
NL
binary
824 b
whitelisted
5212
cscript.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
NL
binary
557 b
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
3180
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
DE
binary
314 b
whitelisted
7616
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
DE
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7616
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7616
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3180
BackgroundTransferHost.exe
104.126.37.171:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.18.14
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
  • 2.16.164.49
  • 2.16.164.120
  • 2.16.164.72
  • 2.16.164.9
whitelisted
client.wns.windows.com
  • 20.197.71.89
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.23
  • 40.126.31.0
  • 40.126.31.1
  • 20.190.159.68
  • 40.126.31.130
  • 40.126.31.2
  • 40.126.31.69
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.186
  • 104.126.37.163
  • 104.126.37.185
  • 104.126.37.177
  • 104.126.37.179
  • 104.126.37.170
  • 104.126.37.178
  • 104.126.37.176
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSAuto++ Portable v1.9.9 b06.7z