File name:

KMSpico-setup.exe

Full analysis: https://app.any.run/tasks/53a33b9b-bd98-487f-bae3-50d1fb58660b
Verdict: Malicious activity
Analysis date: August 23, 2024, 15:31:40
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A02164371A50C5FF9FA2870EF6E8CFA3

SHA1:

060614723F8375ECAAD8B249FF07E3BE082D7F25

SHA256:

64C731ADBE1B96CB5765203B1E215093DCF268D020B299445884A4AE62ED2D3A

SSDEEP:

98304:CgbTbhBxCLS0Kx/XRCsFlPsKh9ApbeicTkxchy6pA32b7SuzWl:rxBxCLS3xZCsFyBzxcE6pAGbq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 7004)

    • Changes image file execution options

      • KMSELDI.exe (PID: 1048)
      • AutoPico.exe (PID: 7052)
      • KMSELDI.exe (PID: 5556)

    • Application was injected by another process

      • rundll32.exe (PID: 6988)

  • SUSPICIOUS

    • Drops the executable file immediately after the start

      • KMSpico-setup.exe (PID: 6740)
      • KMSpico-setup.exe (PID: 6836)
      • KMSpico-setup.tmp (PID: 6864)
      • KMSELDI.exe (PID: 1048)

    • Reads security settings of Internet Explorer

      • KMSpico-setup.tmp (PID: 6760)

    • Executable content was dropped or overwritten

      • KMSpico-setup.exe (PID: 6740)
      • KMSpico-setup.tmp (PID: 6864)
      • KMSpico-setup.exe (PID: 6836)
      • KMSELDI.exe (PID: 1048)

    • Reads the date of Windows installation

      • KMSpico-setup.tmp (PID: 6760)
      • SystemSettings.exe (PID: 6384)

    • Process drops legitimate windows executable

      • KMSpico-setup.tmp (PID: 6864)

    • Reads the Windows owner or organization settings

      • KMSpico-setup.tmp (PID: 6864)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6980)

    • Modifies the phishing filter of IE

      • KMSpico-setup.tmp (PID: 6864)

    • Executing commands from ".cmd" file

      • KMSpico-setup.tmp (PID: 6864)

    • Starts CMD.EXE for commands execution

      • KMSpico-setup.tmp (PID: 6864)

  • INFO

    • Checks supported languages

      • KMSpico-setup.exe (PID: 6740)
      • KMSpico-setup.tmp (PID: 6760)
      • KMSpico-setup.tmp (PID: 6864)
      • KMSpico-setup.exe (PID: 6836)
      • KMSELDI.exe (PID: 1048)
      • AutoPico.exe (PID: 7052)
      • UninsHs.exe (PID: 6892)
      • KMSELDI.exe (PID: 5556)
      • SystemSettings.exe (PID: 6384)
      • SECOH-QAD.exe (PID: 2728)

    • Reads the computer name

      • KMSpico-setup.tmp (PID: 6760)
      • KMSpico-setup.tmp (PID: 6864)
      • AutoPico.exe (PID: 7052)
      • KMSELDI.exe (PID: 5556)
      • KMSELDI.exe (PID: 1048)
      • SystemSettings.exe (PID: 6384)

    • Process checks computer location settings

      • KMSpico-setup.tmp (PID: 6760)

    • Create files in a temporary directory

      • KMSpico-setup.exe (PID: 6740)
      • KMSpico-setup.exe (PID: 6836)
      • KMSpico-setup.tmp (PID: 6864)

    • Creates files in the program directory

      • KMSpico-setup.tmp (PID: 6864)
      • KMSELDI.exe (PID: 1048)
      • AutoPico.exe (PID: 7052)
      • KMSELDI.exe (PID: 5556)

    • Creates a software uninstall entry

      • KMSpico-setup.tmp (PID: 6864)

    • Reads Environment values

      • KMSELDI.exe (PID: 1048)
      • AutoPico.exe (PID: 7052)
      • KMSELDI.exe (PID: 5556)

    • Reads Microsoft Office registry keys

      • KMSELDI.exe (PID: 1048)
      • AutoPico.exe (PID: 7052)
      • KMSELDI.exe (PID: 5556)

    • Reads product name

      • KMSELDI.exe (PID: 1048)
      • AutoPico.exe (PID: 7052)
      • KMSELDI.exe (PID: 5556)

    • Reads the machine GUID from the registry

      • AutoPico.exe (PID: 7052)
      • KMSELDI.exe (PID: 5556)
      • KMSELDI.exe (PID: 1048)
      • SystemSettings.exe (PID: 6384)

    • Manual execution by a user

      • KMSELDI.exe (PID: 5160)
      • KMSELDI.exe (PID: 5556)

    • Reads the software policy settings

      • SystemSettings.exe (PID: 6384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (71.1)
.exe | Win32 Executable Delphi generic (9.1)
.scr | Windows screen saver (8.4)
.dll | Win32 Dynamic Link Library (generic) (4.2)
.exe | Win32 Executable (generic) (2.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 40448
InitializedDataSize: 27648
UninitializedDataSize: -
EntryPoint: 0xa5f8
OSVersion: 1
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 10.2.0.0
ProductVersionNumber: 10.2.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: KMSpico Setup
FileVersion: 10.2.0
LegalCopyright: ByELDI
ProductName: KMSpico
ProductVersion: 10.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
19
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start kmspico-setup.exe kmspico-setup.tmp no specs kmspico-setup.exe kmspico-setup.tmp cmd.exe no specs cmd.exe no specs conhost.exe no specs uninshs.exe no specs conhost.exe no specs kmseldi.exe sc.exe no specs schtasks.exe no specs autopico.exe secoh-qad.exe no specs sppextcomobj.exe no specs kmseldi.exe no specs kmseldi.exe systemsettings.exe rundll32.exe

Process information

PID
CMD
Path
Indicators
Parent process
872SCHTASKS /Create /TN "AutoPico Daily Restart" /TR "'C:\Program Files\KMSpico\AutoPico.exe' /silent" /SC DAILY /ST 23:59:59 /RU "NT AUTHORITY\SYSTEM" /RL Highest /FC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
1044C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—SECOH-QAD.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1048"C:\Program Files\KMSpico\KMSELDI.exe" /silent /backupC:\Program Files\KMSpico\KMSELDI.exe
KMSpico-setup.tmp
User:
admin
Company:
@ByELDI
Integrity Level:
HIGH
Description:
KMS GUI ELDI
Exit code:
4294967295
Version:
37.1.0.0
Modules
Images
c:\program files\kmspico\kmseldi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1636sc create "Service KMSELDI" binPath= "C:\Program Files\KMSpico\Service_KMS.exe" type= own error= normal start= auto DisplayName= "Service KMSELDI"C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2728C:\WINDOWS\SECOH-QAD.exe C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\SECOH-QAD.exe—svchost.exe
User:
NETWORK SERVICE
Integrity Level:
SYSTEM
Exit code:
4294967295
Modules
Images
c:\windows\secoh-qad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
5160"C:\Program Files\KMSpico\KMSELDI.exe" C:\Program Files\KMSpico\KMSELDI.exe—explorer.exe
User:
admin
Company:
@ByELDI
Integrity Level:
MEDIUM
Description:
KMS GUI ELDI
Exit code:
3221226540
Version:
37.1.0.0
Modules
Images
c:\program files\kmspico\kmseldi.exe
c:\windows\system32\ntdll.dll
5556"C:\Program Files\KMSpico\KMSELDI.exe" C:\Program Files\KMSpico\KMSELDI.exe
explorer.exe
User:
admin
Company:
@ByELDI
Integrity Level:
HIGH
Description:
KMS GUI ELDI
Exit code:
0
Version:
37.1.0.0
Modules
Images
c:\program files\kmspico\kmseldi.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6384"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanelC:\Windows\ImmersiveControlPanel\SystemSettings.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Settings
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\immersivecontrolpanel\systemsettings.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
6740"C:\Users\admin\AppData\Local\Temp\KMSpico-setup.exe" C:\Users\admin\AppData\Local\Temp\KMSpico-setup.exe
explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
KMSpico Setup
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\local\temp\kmspico-setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6760"C:\Users\admin\AppData\Local\Temp\is-DEIT5.tmp\KMSpico-setup.tmp" /SL5="$6025A,2952592,69120,C:\Users\admin\AppData\Local\Temp\KMSpico-setup.exe" C:\Users\admin\AppData\Local\Temp\is-DEIT5.tmp\KMSpico-setup.tmp—KMSpico-setup.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.52.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-deit5.tmp\kmspico-setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
20 295
Read events
20 125
Write events
157
Delete events
13

Modification events

(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
D01A00008F94759171F5DA01
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
9A16DD8F33500A2D0A430E84D40FA0553D65A177857282CDCFB09DF59F4B58C9
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
C:\Program Files\KMSpico\AutoPico.exe
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
21CD5593EC6FF27C8F28F463A9F0803AB9BFBF9EF5BF08A400DA3A64A39ABA39
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
Operation:delete valueName:EnableSmartScreen
Value:
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System
Operation:writeName:EnableSmartScreen
Value:
0
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:delete valueName:SmartScreenEnabled
Value:
Off
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SmartScreenEnabled
Value:
Off
(PID) Process:(6864) KMSpico-setup.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter
Operation:delete valueName:EnabledV9
Value:
Executable files
26
Suspicious files
38
Text files
716
Unknown types
0

Dropped files

PID
Process
Filename
Type
6740KMSpico-setup.exeC:\Users\admin\AppData\Local\Temp\is-DEIT5.tmp\KMSpico-setup.tmpexecutable
MD5:1778C1F66FF205875A6435A33229AB3C
SHA256:95C06ACAC4FE4598840E5556F9613D43AA1039C52DAC64536F59E45A70F79DA6
6864KMSpico-setup.tmpC:\Windows\System32\Vestris.ResourceLib.dllexecutable
MD5:3D733144477CADCF77009EF614413630
SHA256:392D73617FD0A55218261572ECE2F50301E0CFA29B5ED24C3F692130AA406AF3
6864KMSpico-setup.tmpC:\Program Files\KMSpico\DevComponents.DotNetBar2.dllexecutable
MD5:1397B23F30681F97049DF61F94F54D05
SHA256:FA76151A783250014AC8FA55D4C833100A623FCAD1D6E2DDADCDE259F5709609
6864KMSpico-setup.tmpC:\Program Files\KMSpico\is-QJHOD.tmpexecutable
MD5:3D733144477CADCF77009EF614413630
SHA256:392D73617FD0A55218261572ECE2F50301E0CFA29B5ED24C3F692130AA406AF3
6836KMSpico-setup.exeC:\Users\admin\AppData\Local\Temp\is-RUO8U.tmp\KMSpico-setup.tmpexecutable
MD5:1778C1F66FF205875A6435A33229AB3C
SHA256:95C06ACAC4FE4598840E5556F9613D43AA1039C52DAC64536F59E45A70F79DA6
6864KMSpico-setup.tmpC:\Program Files\KMSpico\unins000.exeexecutable
MD5:30C7E8E918403B9247315249A8842CE5
SHA256:6D4FA6727CA952B7B44FA9F3538D84B64E06C76908C76FADE7846532A7115A49
6864KMSpico-setup.tmpC:\Users\admin\AppData\Local\Temp\is-9HGKB.tmp\_isetup\_shfoldr.dllexecutable
MD5:92DC6EF532FBB4A5C3201469A5B5EB63
SHA256:9884E9D1B4F8A873CCBD81F8AD0AE257776D2348D027D811A56475E028360D87
6864KMSpico-setup.tmpC:\Windows\System32\is-68D65.tmpexecutable
MD5:3D733144477CADCF77009EF614413630
SHA256:392D73617FD0A55218261572ECE2F50301E0CFA29B5ED24C3F692130AA406AF3
6864KMSpico-setup.tmpC:\Windows\System32\is-AVK48.tmpexecutable
MD5:3D733144477CADCF77009EF614413630
SHA256:392D73617FD0A55218261572ECE2F50301E0CFA29B5ED24C3F692130AA406AF3
6864KMSpico-setup.tmpC:\Program Files\KMSpico\is-CI14Q.tmpexecutable
MD5:245824502AEFE21B01E42F61955AA7F4
SHA256:0A265B4BB8ACCEAFAFFB001632FA7E4C3F8AC39A71EDA37F253E15BC1B8DB90D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
56
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5744
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5744
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6804
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
2368
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5744
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7096
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5336
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
1028
SystemSettings.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3916
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3888
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5744
svchost.exe
40.126.32.76:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5744
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
7096
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
7096
backgroundTaskHost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6804
SIHClient.exe
20.114.59.183:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
google.com
  • 142.250.74.206
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.32.76
  • 40.126.32.138
  • 40.126.32.68
  • 20.190.160.14
  • 20.190.160.17
  • 20.190.160.20
  • 40.126.32.74
  • 40.126.32.140
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
arc.msn.com
  • 20.31.169.57
  • 20.223.35.26
whitelisted
slscr.update.microsoft.com
  • 20.114.59.183
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.166.126.56
whitelisted
3.pool.ntp.org
  • 131.234.220.231
  • 79.133.44.136
  • 194.50.19.117
  • 129.70.132.32
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
KMSpico-setup.exe