File name:

HEUKMSActivator42.3.2.s.taiwebs.com.zip

Full analysis: https://app.any.run/tasks/45c6929b-a3c3-4561-856b-1e392dca7ea1
Verdict: Malicious activity
Analysis date: January 02, 2025, 15:10:32
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
qrcode
autoit
upx
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

51FC1B29CB01B1ED3D8146F775B99D3A

SHA1:

A096C96F841DCC2820CA835444A83AD209596791

SHA256:

691E4DB0B06CB8D6AB5AE8B29BF19677707FC530379E02A3B3671280F7D74A1A

SSDEEP:

98304:yqdHujRiWoRg5LtSm6eO3udZ/r1ummFqZFscKvBvj91tPCYUzCsI5iqbsxGEfyKZ:diD7LTco

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Accesses name of the domain to which a computer belongs via WMI (SCRIPT)

      • cscript.exe (PID: 2672)

    • Starts NET.EXE for service management

      • cmd.exe (PID: 6736)
      • net.exe (PID: 3124)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6448)

    • Executable content was dropped or overwritten

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • 7Z.EXE (PID: 6256)
      • kms_x64.exe (PID: 132)

    • Drops 7-zip archiver for unpacking

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)

    • Detected use of alternative data streams (AltDS)

      • kms_x64.exe (PID: 132)

    • Starts CMD.EXE for commands execution

      • kms_x64.exe (PID: 132)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 4320)
      • cscript.exe (PID: 5256)
      • cscript.exe (PID: 7124)
      • cscript.exe (PID: 5000)
      • cscript.exe (PID: 4548)
      • cscript.exe (PID: 2728)
      • cscript.exe (PID: 7076)
      • cscript.exe (PID: 6996)
      • cscript.exe (PID: 3140)
      • cscript.exe (PID: 6684)
      • cscript.exe (PID: 6624)
      • cscript.exe (PID: 6212)
      • cscript.exe (PID: 2672)
      • cscript.exe (PID: 4592)

    • Windows service management via SC.EXE

      • sc.exe (PID: 6728)
      • sc.exe (PID: 6628)
      • sc.exe (PID: 6980)
      • sc.exe (PID: 3224)
      • sc.exe (PID: 5300)
      • sc.exe (PID: 5036)
      • sc.exe (PID: 4708)
      • sc.exe (PID: 6348)
      • sc.exe (PID: 5780)
      • sc.exe (PID: 3812)
      • sc.exe (PID: 1216)
      • sc.exe (PID: 7152)
      • sc.exe (PID: 5252)
      • sc.exe (PID: 4704)
      • sc.exe (PID: 6676)
      • sc.exe (PID: 6940)
      • sc.exe (PID: 6584)
      • sc.exe (PID: 6972)
      • sc.exe (PID: 3840)
      • sc.exe (PID: 6652)
      • sc.exe (PID: 6336)
      • sc.exe (PID: 3836)
      • sc.exe (PID: 4972)
      • sc.exe (PID: 5004)
      • sc.exe (PID: 3680)
      • sc.exe (PID: 4400)
      • sc.exe (PID: 2216)
      • sc.exe (PID: 4996)
      • sc.exe (PID: 6228)
      • sc.exe (PID: 1296)
      • sc.exe (PID: 5160)
      • sc.exe (PID: 4684)
      • sc.exe (PID: 6324)
      • sc.exe (PID: 4980)
      • sc.exe (PID: 8)
      • sc.exe (PID: 6388)
      • sc.exe (PID: 4136)
      • sc.exe (PID: 2436)
      • sc.exe (PID: 3820)
      • sc.exe (PID: 6892)
      • sc.exe (PID: 4056)
      • sc.exe (PID: 6724)
      • sc.exe (PID: 5988)
      • sc.exe (PID: 5684)
      • sc.exe (PID: 6408)
      • sc.exe (PID: 6580)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 6624)
      • cmd.exe (PID: 6216)
      • cmd.exe (PID: 6676)
      • cmd.exe (PID: 6268)
      • cmd.exe (PID: 4308)
      • cmd.exe (PID: 2548)
      • cmd.exe (PID: 6012)
      • cmd.exe (PID: 1544)
      • cmd.exe (PID: 3936)
      • cmd.exe (PID: 5872)
      • cmd.exe (PID: 640)
      • cmd.exe (PID: 5560)
      • cmd.exe (PID: 6444)
      • cmd.exe (PID: 6904)
      • cmd.exe (PID: 1620)
      • cmd.exe (PID: 2972)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 4500)
      • cmd.exe (PID: 6424)
      • cmd.exe (PID: 5856)
      • cmd.exe (PID: 4120)
      • cmd.exe (PID: 6716)
      • cmd.exe (PID: 4468)
      • cmd.exe (PID: 1172)
      • cmd.exe (PID: 3092)
      • cmd.exe (PID: 3832)
      • cmd.exe (PID: 5572)
      • cmd.exe (PID: 5212)
      • cmd.exe (PID: 2796)
      • cmd.exe (PID: 1488)
      • cmd.exe (PID: 1468)
      • cmd.exe (PID: 6876)
      • cmd.exe (PID: 2120)
      • cmd.exe (PID: 848)
      • cmd.exe (PID: 2220)
      • cmd.exe (PID: 3656)
      • cmd.exe (PID: 6924)
      • cmd.exe (PID: 4992)
      • cmd.exe (PID: 6620)
      • cmd.exe (PID: 4968)
      • cmd.exe (PID: 6736)
      • cmd.exe (PID: 1620)
      • cmd.exe (PID: 5208)
      • cmd.exe (PID: 3040)
      • cmd.exe (PID: 4840)
      • cmd.exe (PID: 5912)

    • Connects to unusual port

      • kms_x64.exe (PID: 132)

    • The executable file from the user directory is run by the CMD process

      • kms-server.exe (PID: 6420)
      • kms-server.exe (PID: 6748)

    • Uses ICACLS.EXE to modify access control lists

      • cmd.exe (PID: 1856)
      • cmd.exe (PID: 1400)
      • cmd.exe (PID: 4876)

    • The process executes VB scripts

      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 5028)
      • cmd.exe (PID: 6740)
      • cmd.exe (PID: 6860)
      • cmd.exe (PID: 2484)
      • cmd.exe (PID: 4360)
      • cmd.exe (PID: 1292)
      • cmd.exe (PID: 6652)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 3140)
      • cscript.exe (PID: 2672)
      • cscript.exe (PID: 6684)
      • cscript.exe (PID: 6624)
      • cscript.exe (PID: 6212)
      • cscript.exe (PID: 4872)
      • cscript.exe (PID: 1328)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 3140)
      • cscript.exe (PID: 2672)
      • cscript.exe (PID: 6684)
      • cscript.exe (PID: 6624)
      • cscript.exe (PID: 6212)

    • The process downloads a VBScript from the remote host

      • cmd.exe (PID: 4640)
      • cmd.exe (PID: 1292)

    • Gets the drive type (SCRIPT)

      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 4872)

    • Accesses computer name via WMI (SCRIPT)

      • cscript.exe (PID: 4872)
      • cscript.exe (PID: 1328)

    • Gets a collection of all available drive names (SCRIPT)

      • cscript.exe (PID: 4872)
      • cscript.exe (PID: 1328)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 4872)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6448)

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6448)
      • cscript.exe (PID: 4320)
      • cscript.exe (PID: 5256)
      • cscript.exe (PID: 7124)
      • cscript.exe (PID: 5000)
      • cscript.exe (PID: 2144)
      • cscript.exe (PID: 3436)

    • Reads mouse settings

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)

    • The sample compiled with chinese language support

      • WinRAR.exe (PID: 6448)
      • 7Z.EXE (PID: 6256)

    • Reads the computer name

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • 7Z.EXE (PID: 6256)

    • Checks supported languages

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • 7Z.EXE (PID: 6256)
      • kms_x64.exe (PID: 132)

    • The sample compiled with english language support

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)

    • Create files in a temporary directory

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • 7Z.EXE (PID: 6256)
      • kms_x64.exe (PID: 132)

    • UPX packer has been detected

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 4320)
      • cscript.exe (PID: 5256)
      • cscript.exe (PID: 7124)
      • cscript.exe (PID: 5000)
      • cscript.exe (PID: 4548)
      • cscript.exe (PID: 2728)
      • cscript.exe (PID: 6996)
      • cscript.exe (PID: 7076)
      • cscript.exe (PID: 6684)
      • cscript.exe (PID: 6212)
      • cscript.exe (PID: 2672)
      • cscript.exe (PID: 1328)
      • cscript.exe (PID: 4012)
      • cscript.exe (PID: 4592)
      • cscript.exe (PID: 2144)
      • cscript.exe (PID: 3436)

    • Reads Microsoft Office registry keys

      • kms_x64.exe (PID: 132)

    • Reads Environment values

      • kms_x64.exe (PID: 132)

    • Reads product name

      • kms_x64.exe (PID: 132)

    • The process uses AutoIt

      • HEU_KMS_Activator_v42.3.2.exe (PID: 6208)
      • kms_x64.exe (PID: 132)

    • Creates files in the program directory

      • cmd.exe (PID: 6848)
      • kms_x64.exe (PID: 132)

    • Checks proxy server information

      • cscript.exe (PID: 1328)

    • Creates files or folders in the user directory

      • cscript.exe (PID: 1328)

    • Reads the software policy settings

      • cscript.exe (PID: 2144)
      • cscript.exe (PID: 1328)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:01:02 20:41:54
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: HEU KMS Activator 42.3.2/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
363
Monitored processes
227
Malicious processes
10
Suspicious processes
10

Behavior graph

Click at the process to see the details
start winrar.exe heu_kms_activator_v42.3.2.exe no specs heu_kms_activator_v42.3.2.exe 7z.exe conhost.exe no specs kms_x64.exe cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs kms-server.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs kms-server.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs rundll32.exe no specs sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs cscript.exe no specs cmd.exe no specs conhost.exe no specs icacls.exe no specs cmd.exe no specs conhost.exe no specs kms-server.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs net.exe no specs net1.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs cmd.exe no specs conhost.exe no specs sc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
8sc query TrustedInstallerC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Service Control Manager Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
132C:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\x64\kms_x64.exeC:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\x64\kms_x64.exe
HEU_KMS_Activator_v42.3.2.exe
User:
admin
Company:
知彼而知己
Integrity Level:
HIGH
Description:
HEU KMS Activator™
Version:
42.3.2.0
Modules
Images
c:\users\admin\appdata\local\temp\_temp_heu168yyds\x64\kms_x64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
436\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
520C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
540icacls C:\WINDOWS\System32\SECOPatcher.dll /resetC:\Windows\System32\icacls.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\icacls.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
624C:\WINDOWS\system32\cmd.exe /c C:\WINDOWS\System32\cscript.exe //nologo //Job:WmiQuery "C:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\xml\wim.xml?.wsf" SoftwareLicensingService VersionC:\Windows\System32\cmd.exe—kms_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
624\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
640C:\WINDOWS\system32\cmd.exe /c sc query osppsvcC:\Windows\System32\cmd.exe—kms_x64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1060
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
644\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
22 880
Read events
22 857
Write events
20
Delete events
3

Modification events

(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\HEUKMSActivator42.3.2.s.taiwebs.com.zip
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6448) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(132) kms_x64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Licensing\Resiliency
Operation:writeName:TimeOfLastHeartbeatFailure
Value:
2040-01-01T00:00:00Z
Executable files
11
Suspicious files
11
Text files
87
Unknown types
0

Dropped files

PID
Process
Filename
Type
6448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6448.46071\HEU KMS Activator 42.3.2\更新日志.txttext
MD5:A0210CF26F7ACC67DFB9CAF6B928D0E1
SHA256:7FF77278A7A420EBBCF19C74F45C9856D2ECBC14496D2535B6D2C45A95C10839
6448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6448.46071\HEU KMS Activator 42.3.2\更新地址：微信公众号.jpgimage
MD5:123A56F34EEE911CF7947E67082643A5
SHA256:36483CEA085373955D9C504FAF8D0A608A4109760A7BCC36FC38887C8C45DDEC
6448WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6448.46071\HEU KMS Activator 42.3.2\HEU_KMS_Activator_v42.3.2.exeexecutable
MD5:2C1D71A76EA8928500291D4972ADFAF1
SHA256:E12852FF90376F907F0FA17FD48919EF1D1DB76ECE121879B55B67DD311B3060
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\7Z.EXEexecutable
MD5:43141E85E7C36E31B52B22AB94D5E574
SHA256:EA308C76A2F927B160A143D94072B0DCE232E04B751F0C6432A94E05164E716D
62567Z.EXEC:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\pic\1-1.bmpimage
MD5:854FDB63B26F58D482A85F4A7D87EB75
SHA256:8D3B094B0984A03453F11D7D587226F4E29665E1B0E04B76F009A8E8268FE18C
62567Z.EXEC:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\Office2010OSPP\OSPP.VBStext
MD5:572E9A87757AC96C7677FD1B1B113C55
SHA256:008CF05944053116A095AD466561D3FD4BE8A7DE79E5ADA7C5DAAB492F730465
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\autBB86.tmpbinary
MD5:E25E09DF3DB990F98A165990B2F48B02
SHA256:52F64C84948068514240283D6C7FA1204E81CA0549CF0159FCACC556A950CD94
62567Z.EXEC:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\Office2010OSPP\SLERROR.XMLtext
MD5:DF1EF05879E06C5F09F3E1022F37B5CB
SHA256:D49ADF2DABBBF6AA43CE4E336AF4F768207DF75302EBF568A94A5350AAC988C5
62567Z.EXEC:\Users\admin\AppData\Local\Temp\_temp_heu168yyds\OtherOfficeOSPP\slerror.xmltext
MD5:36F7DADFE84E62DA00292D0569C3F523
SHA256:B3378A3178F3E52094DB20E8A828011CD8882017919522A544BAEF3057BD11D3
6208HEU_KMS_Activator_v42.3.2.exeC:\Users\admin\AppData\Local\Temp\splashlogo.jpgimage
MD5:03361B7B3BAB104DFF232D8AB607319F
SHA256:81FF582D54D96E22AC5E54B0BC914560B2D0E85EB775DCF500EEBA1BFD9F72F8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
37
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
23.48.23.193:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3508
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6376
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
2548
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2548
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1328
cscript.exe
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3508
svchost.exe
23.48.23.193:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3508
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
104.126.37.168:443
www.bing.com
Akamai International B.V.
DE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1076
svchost.exe
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.48.23.193
  • 23.48.23.166
  • 23.48.23.177
  • 23.48.23.162
  • 23.48.23.173
  • 23.48.23.169
  • 23.48.23.164
  • 23.48.23.167
  • 23.48.23.190
  • 23.48.23.181
  • 23.48.23.175
  • 23.48.23.178
  • 23.48.23.186
  • 23.48.23.192
  • 23.48.23.180
  • 23.48.23.191
  • 23.48.23.182
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 88.221.169.152
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.bing.com
  • 104.126.37.168
  • 104.126.37.170
  • 104.126.37.144
  • 104.126.37.171
  • 104.126.37.153
  • 104.126.37.161
  • 104.126.37.155
  • 104.126.37.184
  • 104.126.37.179
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.68
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.134
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
fd.api.iris.microsoft.com
  • 20.223.36.55
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEUKMSActivator42.3.2.s.taiwebs.com.zip