File name:

HEUKMSActivator42.3.2.s.taiwebs.com.zip

Full analysis: https://app.any.run/tasks/45c6929b-a3c3-4561-856b-1e392dca7ea1
Verdict: Malicious activity
Analysis date: January 02, 2025, 15:10:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
qrcode
autoit
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

51FC1B29CB01B1ED3D8146F775B99D3A

SHA1:

A096C96F841DCC2820CA835444A83AD209596791

SHA256:

691E4DB0B06CB8D6AB5AE8B29BF19677707FC530379E02A3B3671280F7D74A1A

SSDEEP:

98304:yqdHujRiWoRg5LtSm6eO3udZ/r1ummFqZFscKvBvj91tPCYUzCsI5iqbsxGEfyKZ:diD7LTco

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses name of the domain to which a computer belongs via WMI (SCRIPT)

      • cscript.exe (PID: 2672)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 6736)
      • net.exe (PID: 3124)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • kms_x64.exe (PID: 132)

    • Executable content was dropped or overwritten

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • 7Z.EXE (PID: 6256)
      • kms_x64.exe (PID: 132)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6448)

    • Drops 7-zip archiver for unpacking

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)

    • Starts CMD.EXE for commands execution

      • kms_x64.exe (PID: 132)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 4320)
      • cscript.exe (PID: 5256)
      • cscript.exe (PID: 7124)
      • cscript.exe (PID: 5000)
      • cscript.exe (PID: 4548)
      • cscript.exe (PID: 7076)
      • cscript.exe (PID: 3140)
      • cscript.exe (PID: 6996)
      • cscript.exe (PID: 2672)
      • cscript.exe (PID: 6684)
      • cscript.exe (PID: 6624)
      • cscript.exe (PID: 6212)
      • cscript.exe (PID: 2728)
      • cscript.exe (PID: 4592)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6628)
      • sc.exe (PID: 6728)
      • sc.exe (PID: 6980)
      • sc.exe (PID: 3224)
      • sc.exe (PID: 5036)
      • sc.exe (PID: 5300)
      • sc.exe (PID: 4708)
      • sc.exe (PID: 6348)
      • sc.exe (PID: 5780)
      • sc.exe (PID: 1216)
      • sc.exe (PID: 7152)
      • sc.exe (PID: 5252)
      • sc.exe (PID: 4704)
      • sc.exe (PID: 6676)
      • sc.exe (PID: 6584)
      • sc.exe (PID: 5004)
      • sc.exe (PID: 3812)
      • sc.exe (PID: 6972)
      • sc.exe (PID: 6336)
      • sc.exe (PID: 3840)
      • sc.exe (PID: 3836)
      • sc.exe (PID: 4972)
      • sc.exe (PID: 4980)
      • sc.exe (PID: 6652)
      • sc.exe (PID: 6228)
      • sc.exe (PID: 1296)
      • sc.exe (PID: 5160)
      • sc.exe (PID: 4684)
      • sc.exe (PID: 6324)
      • sc.exe (PID: 4056)
      • sc.exe (PID: 4400)
      • sc.exe (PID: 4996)
      • sc.exe (PID: 2216)
      • sc.exe (PID: 8)
      • sc.exe (PID: 6388)
      • sc.exe (PID: 4136)
      • sc.exe (PID: 2436)
      • sc.exe (PID: 3820)
      • sc.exe (PID: 6892)
      • sc.exe (PID: 6580)
      • sc.exe (PID: 6724)
      • sc.exe (PID: 5684)
      • sc.exe (PID: 5988)
      • sc.exe (PID: 6408)
      • sc.exe (PID: 3680)
      • sc.exe (PID: 6940)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6216)
      • cmd.exe (PID: 6624)
      • cmd.exe (PID: 6676)
      • cmd.exe (PID: 6268)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 2548)
      • cmd.exe (PID: 6012)
      • cmd.exe (PID: 1544)
      • cmd.exe (PID: 5872)
      • cmd.exe (PID: 3936)
      • cmd.exe (PID: 640)
      • cmd.exe (PID: 5560)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 6444)
      • cmd.exe (PID: 2972)
      • cmd.exe (PID: 1620)
      • cmd.exe (PID: 6904)
      • cmd.exe (PID: 3092)
      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 6424)
      • cmd.exe (PID: 5856)
      • cmd.exe (PID: 6716)
      • cmd.exe (PID: 4120)
      • cmd.exe (PID: 4468)
      • cmd.exe (PID: 1172)
      • cmd.exe (PID: 5572)
      • cmd.exe (PID: 6876)
      • cmd.exe (PID: 1488)
      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 5212)
      • cmd.exe (PID: 3832)
      • cmd.exe (PID: 848)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 1468)
      • cmd.exe (PID: 3656)
      • cmd.exe (PID: 6924)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 4968)
      • cmd.exe (PID: 5208)
      • cmd.exe (PID: 4992)
      • cmd.exe (PID: 6736)
      • cmd.exe (PID: 1620)
      • cmd.exe (PID: 2220)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 4840)
      • cmd.exe (PID: 5912)

    • Connects to unusual port

      • kms_x64.exe (PID: 132)

    • The executable file from the user directory is run by the CMD process

      • kms-server.exe (PID: 6420)
      • kms-server.exe (PID: 6748)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1856)
      • cmd.exe (PID: 1400)
      • cmd.exe (PID: 4876)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 3140)
      • cscript.exe (PID: 2672)
      • cscript.exe (PID: 6684)
      • cscript.exe (PID: 6624)
      • cscript.exe (PID: 6212)
      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 4872)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 3140)
      • cscript.exe (PID: 2672)
      • cscript.exe (PID: 6624)
      • cscript.exe (PID: 6684)
      • cscript.exe (PID: 6212)

    • The process executes VB scripts

      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 5028)
      • cmd.exe (PID: 6740)
      • cmd.exe (PID: 6860)
      • cmd.exe (PID: 2484)
      • cmd.exe (PID: 1292)
      • cmd.exe (PID: 6652)
      • cmd.exe (PID: 4360)

    • The process downloads a VBScript from the remote host

      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 1292)

    • Gets the drive type (SCRIPT)

      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 4872)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 4872)

    • Accesses computer name via WMI (SCRIPT)

      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 4872)

    • Gets a collection of all available drive names (SCRIPT)

      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 4872)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6448)

    • Checks supported languages

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)
      • 7Z.EXE (PID: 6256)

    • The sample compiled with chinese language support

      • 7Z.EXE (PID: 6256)
      • WinRAR.exe (PID: 6448)

    • The sample compiled with english language support

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)

    • Create files in a temporary directory

      • 7Z.EXE (PID: 6256)
      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)

    • Reads mouse settings

      • kms_x64.exe (PID: 132)
      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6448)
      • cscript.exe (PID: 4320)
      • cscript.exe (PID: 5256)
      • cscript.exe (PID: 7124)
      • cscript.exe (PID: 5000)
      • cscript.exe (PID: 2144)
      • cscript.exe (PID: 3436)

    • Reads the computer name

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • 7Z.EXE (PID: 6256)

    • The process uses AutoIt

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)

    • UPX packer has been detected

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)

    • Reads Environment values

      • kms_x64.exe (PID: 132)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 4320)
      • cscript.exe (PID: 5256)
      • cscript.exe (PID: 7124)
      • cscript.exe (PID: 5000)
      • cscript.exe (PID: 4548)
      • cscript.exe (PID: 2728)
      • cscript.exe (PID: 7076)
      • cscript.exe (PID: 6996)
      • cscript.exe (PID: 2672)
      • cscript.exe (PID: 6684)
      • cscript.exe (PID: 6212)
      • cscript.exe (PID: 4012)
      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 2144)
      • cscript.exe (PID: 3436)
      • cscript.exe (PID: 4592)

    • Reads product name

      • kms_x64.exe (PID: 132)

    • Reads Microsoft Office registry keys

      • kms_x64.exe (PID: 132)

    • Creates files in the program directory

      • cmd.exe (PID: 6848)
      • kms_x64.exe (PID: 132)

    • Checks proxy server information

      • cscript.exe (PID: 1328)

    • Reads the software policy settings

      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 2144)

    • Creates files or folders in the user directory

      • cscript.exe (PID: 1328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:01:02 20:41:54
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: HEU KMS Activator 42.3.2/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
363
Monitored processes
227
Malicious processes
10
Suspicious processes
10

Behavior graph

Click at the process to see the details
start winrar.exe heu_kms_activator_v42.3.2.exe no specs heu_kms_activator_v42.3.2.exe 7z.exe conhost.exe no specs kms_x64.exe cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs kms-server.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs kms-server.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs rundll32.exe no specs sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs kms-server.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8sc query TrustedInstallerC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
132C:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\x64\kms_x64.exeC:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\x64\kms_x64.exe
HEU_KMS_Activator_v42.3.2.exe
User:
admin
Company:
知彼而知己
Integrity Level:
HIGH
Description:
HEU KMS Activator™
Version:
42.3.2.0
Modules
Images
c:\users\admin\appdata\local\temp\_temp_heu168yyds\x64\kms_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
520C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
540icacls C:\WINDOWS\System32\SECOPatcher.dll /resetC:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
624C:\WINDOWS\system32\cmd.exe /c C:\WINDOWS\System32\cscript.exe //nologo //Job:WmiQuery "C:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\xml\wim.xml?.wsf" SoftwareLicensingService VersionC:\Windows\System32\cmd.exe—kms_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640C:\WINDOWS\system32\cmd.exe /c sc query osppsvcC:\Windows\System32\cmd.exe—kms_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 880
Read events
22 857
Write events
20
Delete events
3

Modification events

(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HEUKMSActivator42.3.2.s.taiwebs.com.zip
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(132) kms_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\Resiliency
Operation:writeName:TimeOfLastHeartbeatFailure
Value:
2040-01-01T00:00:00Z
Executable files
11
Suspicious files
11
Text files
87
Unknown types
0

Dropped files

PID
Process
Filename
Type
6448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6448.46071\HEU KMS Activator 42.3.2\HEU_KMS_Activator_v42.3.2.exeexecutable
MD5:2C1D71A76EA8928500291D4972ADFAF1
SHA256:E12852FF90376F907F0FA17FD48919EF1D1DB76ECE121879B55B67DD311B3060
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\splashlogo.jpgimage
MD5:03361B7B3BAB104DFF232D8AB607319F
SHA256:81FF582D54D96E22AC5E54B0BC914560B2D0E85EB775DCF500EEBA1BFD9F72F8
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\ScriptTemp.initext
MD5:E15F92E7903E2FBC311267AB2DAD58B3
SHA256:F0AF3988122C5AED026C18DCEB345057457BEA373555A1E3EF120C716434A1CD
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\autBA9A.tmpcompressed
MD5:C022A6BEB2C849DD00E15D340248FF43
SHA256:715AFB6A75D68E0B2645D0E7665A43BB7F9218FB4DC78C70B99629263A8D5E2A
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\autB9ED.tmpbinary
MD5:3A349B600BB8FED89C6BF260E2E227FC
SHA256:9EFCD38D69C487EA1D4A9BA88F82F44993C2747B88871CF279CFF5C5891E8C51
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\autBB27.tmpcompressed
MD5:6A07CA86E2A06DEA55700327A3B3A594
SHA256:1BF9EAACA0FF1076DE4854C734C0AEE6EC62B61E46F899AB954C0210919D34F0
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\~DF488CA17D6A41FEA0.TMPbinary
MD5:3B2259EDD564CA00F477EB5AF43AD676
SHA256:39F989EC038D54B85BB126978D0686932A986BE10D3F9A793006F9695A29C317
6448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6448.46071\HEU KMS Activator 42.3.2\更新地址：微信公众号.jpgimage
MD5:123A56F34EEE911CF7947E67082643A5
SHA256:36483CEA085373955D9C504FAF8D0A608A4109760A7BCC36FC38887C8C45DDEC
6448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6448.46071\HEU KMS Activator 42.3.2\更新日志.txttext
MD5:A0210CF26F7ACC67DFB9CAF6B928D0E1
SHA256:7FF77278A7A420EBBCF19C74F45C9856D2ECBC14496D2535B6D2C45A95C10839
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\KMSmini.7zcompressed
MD5:C022A6BEB2C849DD00E15D340248FF43
SHA256:715AFB6A75D68E0B2645D0E7665A43BB7F9218FB4DC78C70B99629263A8D5E2A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
37
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1328
cscript.exe
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
1328
cscript.exe
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
unknown
—
—
whitelisted
6376
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2548
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2548
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
23.48.23.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3508
svchost.exe
23.48.23.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3508
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
104.126.37.168:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.193
  • 23.48.23.166
  • 23.48.23.177
  • 23.48.23.162
  • 23.48.23.173
  • 23.48.23.169
  • 23.48.23.164
  • 23.48.23.167
  • 23.48.23.190
  • 23.48.23.181
  • 23.48.23.175
  • 23.48.23.178
  • 23.48.23.186
  • 23.48.23.192
  • 23.48.23.180
  • 23.48.23.191
  • 23.48.23.182
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.bing.com
  • 104.126.37.168
  • 104.126.37.170
  • 104.126.37.144
  • 104.126.37.171
  • 104.126.37.153
  • 104.126.37.161
  • 104.126.37.155
  • 104.126.37.184
  • 104.126.37.179
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.134
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUKMSActivator42.3.2.s.taiwebs.com.zip