File name:

Setup_File_KMS_Pico.exe

Full analysis: https://app.any.run/tasks/7759abb8-c8fd-4997-9eab-70a11f1d2613
Verdict: Malicious activity
Threats:

CryptBot is an advanced Windows-targeting infostealer delivered via pirate sites with "cracked" software. It has been first observed in the wild in 2019.

Malware Trends Tracker     >>>
Analysis date: October 19, 2023, 07:29:23
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
autoit
cryptbot
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

541F64D5D78ED7A50017728FEE6F4CE7

SHA1:

866D3056DC235C972087A3E9B7E4972C155DED76

SHA256:

7A79F51660CA4662F0E0B783DE8330F3C1157911968D04D8DD339A4AC0F3B386

SSDEEP:

196608:ZDz6BTdm03Pw4VrqACUdelOWZPrs+PPYJ:d6rm03PJqCdelOMrsqa

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • KMS_pico.exe (PID: 2516)
      • KMS_pico.exe (PID: 1232)
      • KMS_pico.tmp (PID: 3552)
      • KMS_pico.exe (PID: 3480)

    • Steals credentials

      • KMS_pico.exe (PID: 3480)

    • Application was dropped or rewritten from another process

      • KMS_pico.exe (PID: 1232)
      • KMS_pico.exe (PID: 2516)
      • UninsHs.exe (PID: 1372)
      • KMSELDI.exe (PID: 3928)
      • AutoPico.exe (PID: 3176)
      • consev.exe (PID: 1876)

    • CRYPTBOT has been detected (YARA)

      • KMS_pico.exe (PID: 3480)

    • Starts CMD.EXE for self-deleting

      • KMS_pico.exe (PID: 3480)

    • Creates a writable file the system directory

      • KMS_pico.tmp (PID: 3552)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 976)
      • cmd.exe (PID: 2740)

    • Loads dropped or rewritten executable

      • KMS_pico.tmp (PID: 3552)
      • KMSELDI.exe (PID: 3928)

    • Actions looks like stealing of personal data

      • KMS_pico.exe (PID: 3480)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Setup_File_KMS_Pico.exe (PID: 556)
      • KMS_pico.exe (PID: 3480)

    • Drops the AutoIt3 executable file

      • KMS_pico.exe (PID: 3480)

    • Reads the Windows owner or organization settings

      • KMS_pico.tmp (PID: 3552)

    • Reads browser cookies

      • KMS_pico.exe (PID: 3480)

    • Process drops legitimate windows executable

      • KMS_pico.tmp (PID: 3552)

    • Starts CMD.EXE for commands execution

      • KMS_pico.tmp (PID: 3552)
      • KMS_pico.exe (PID: 3480)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 3672)

    • Executing commands from ".cmd" file

      • KMS_pico.tmp (PID: 3552)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1904)

    • Creates or modifies Windows services

      • KMSELDI.exe (PID: 3928)

    • The process executes via Task Scheduler

      • consev.exe (PID: 1876)

    • Searches for installed software

      • KMS_pico.exe (PID: 3480)

  • INFO

    • Reads the computer name

      • Setup_File_KMS_Pico.exe (PID: 556)
      • KMS_pico.exe (PID: 3480)
      • KMS_pico.tmp (PID: 4028)
      • KMS_pico.tmp (PID: 3552)
      • KMSELDI.exe (PID: 3928)
      • AutoPico.exe (PID: 3176)
      • wmpnscfg.exe (PID: 3116)

    • Checks supported languages

      • Setup_File_KMS_Pico.exe (PID: 556)
      • KMS_pico.exe (PID: 2516)
      • KMS_pico.tmp (PID: 4028)
      • KMS_pico.exe (PID: 3480)
      • KMS_pico.exe (PID: 1232)
      • KMS_pico.tmp (PID: 3552)
      • UninsHs.exe (PID: 1372)
      • KMSELDI.exe (PID: 3928)
      • AutoPico.exe (PID: 3176)
      • wmpnscfg.exe (PID: 3116)
      • consev.exe (PID: 1876)

    • Reads CPU info

      • KMS_pico.exe (PID: 3480)

    • Create files in a temporary directory

      • KMS_pico.exe (PID: 2516)
      • Setup_File_KMS_Pico.exe (PID: 556)
      • KMS_pico.exe (PID: 3480)
      • KMS_pico.exe (PID: 1232)
      • KMS_pico.tmp (PID: 3552)

    • Creates files or folders in the user directory

      • KMS_pico.exe (PID: 3480)

    • Reads product name

      • KMS_pico.exe (PID: 3480)
      • KMSELDI.exe (PID: 3928)
      • AutoPico.exe (PID: 3176)

    • Reads the machine GUID from the registry

      • KMS_pico.exe (PID: 3480)
      • KMSELDI.exe (PID: 3928)
      • AutoPico.exe (PID: 3176)
      • wmpnscfg.exe (PID: 3116)

    • Checks proxy server information

      • KMS_pico.exe (PID: 3480)

    • Application was dropped or rewritten from another process

      • KMS_pico.tmp (PID: 4028)
      • KMS_pico.tmp (PID: 3552)

    • Creates files in the program directory

      • KMS_pico.tmp (PID: 3552)
      • KMSELDI.exe (PID: 3928)
      • AutoPico.exe (PID: 3176)

    • Reads Environment values

      • KMSELDI.exe (PID: 3928)
      • AutoPico.exe (PID: 3176)
      • KMS_pico.exe (PID: 3480)

    • Reads Microsoft Office registry keys

      • KMSELDI.exe (PID: 3928)
      • AutoPico.exe (PID: 3176)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3116)

    • Reads mouse settings

      • consev.exe (PID: 1876)

    • Reads Windows Product ID

      • KMS_pico.exe (PID: 3480)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

CryptBot

(PID) Process(3480) KMS_pico.exe
C2http://sgizfn14.top/gate.php;
Options
CookiesFirefoxfalse
Screenshottrue
Wallettrue
ChromeExttrue
CookiesEdgefalse
HistoryEdgefalse
Desktoptrue
EdgeExttrue
HistoryChromefalse
EdgeDBtrue
CookiesOperafalse
ChromeDBtrue
CookiesChromefalse
Firefoxfalse
HistoryFirefoxfalse
Edgefalse
FirefoxDBtrue
Operafalse
Chromefalse
HistoryOperafalse
ScreenFile$CREEN.PNG
PasswordFile_AllPasswords.txt
FirefoxDBFolder_Firefox
InfoFile_Information.txt
DesktopFolder_Desktop
CookiesFile_AllCookies.txt
ChromeDBFolder_Chrome
DeleteAfterEndtrue
HistoryFile_AllHistory.txt
UserAgentMozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
Prefixmrd-
EdgeDBFolder_Edge
MessageAfterEndfalse
WalletFolder_Wallet
ExternalDownload
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

LanguageId: en
ProductVersion: 1.3.541.1
ProductName: Dropbox Update
OriginalFileName: DropboxUpdateSetup.exe
LegalCopyright: Copyright: Dropbox, Inc. 2015 (Omaha Copyright Google Inc.)
InternalName: Dropbox Update Setup
FileVersion: 1.3.541.1
FileDescription: Dropbox Update Setup
CompanyName: Dropbox, Inc.
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Windows NT 32-bit
FileFlags: (none)
FileFlagsMask: 0x003f
ProductVersionNumber: 1.3.541.1
FileVersionNumber: 1.3.541.1
Subsystem: Windows GUI
SubsystemVersion: 5.1
ImageVersion: -
OSVersion: 5.1
EntryPoint: 0x1ec40
UninitializedDataSize: -
InitializedDataSize: 787968
CodeSize: 201216
LinkerVersion: 14
PEType: PE32
ImageFileCharacteristics: Executable, 32-bit
TimeStamp: 2020:12:01 18:00:55+00:00
MachineType: Intel 386 or later, and compatibles
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
20
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
556"C:\Users\admin\AppData\Local\Temp\Setup_File_KMS_Pico.exe" C:\Users\admin\AppData\Local\Temp\Setup_File_KMS_Pico.exe—explorer.exe
User:
admin
Company:
Dropbox, Inc.
Integrity Level:
MEDIUM
Description:
Dropbox Update Setup
Exit code:
0
Version:
1.3.541.1
Modules
Images
c:\users\admin\appdata\local\temp\setup_file_kms_pico.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
976"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Task.cmd""C:\Windows\System32\cmd.exe—KMS_pico.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1232"C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe" /SPAWNWND=$C01D6 /NOTIFYWND=$C01E8 C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe
KMS_pico.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
KMSpico Setup
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\roaming\faxjrc\kms_pico.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1372"C:\Program Files\KMSpico\UninsHs.exe" /r0=KMSpico,default,C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exeC:\Program Files\KMSpico\UninsHs.exe—KMS_pico.tmp
User:
admin
Company:
Han-soft
Integrity Level:
HIGH
Description:
Uninstall for InnoSetup by Han-soft
Exit code:
0
Version:
2.1.0.283
Modules
Images
c:\program files\kmspico\uninshs.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\rpcrt4.dll
1876C:\Users\admin\AppData\Roaming\faxjrc\consev.exe "C:\Users\admin\AppData\Roaming\faxjrc\consev.dat"C:\Users\admin\AppData\Roaming\faxjrc\consev.exe—taskeng.exe
User:
admin
Company:
AutoIt Team
Integrity Level:
MEDIUM
Description:
AutoIt v3 Script
Exit code:
0
Version:
3, 3, 14, 5
Modules
Images
c:\users\admin\appdata\roaming\faxjrc\consev.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\version.dll
1904"C:\Windows\system32\cmd.exe" /C ""C:\Program Files\KMSpico\scripts\Install_Service.cmd""C:\Windows\System32\cmd.exe—KMS_pico.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\cmd.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2516C:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exeC:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exe—cmd.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
KMSpico Setup
Exit code:
0
Version:
10.2.0
Modules
Images
c:\users\admin\appdata\roaming\faxjrc\kms_pico.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\oleaut32.dll
2740 /C schtasks /create /tn \Diagnostic\Service /tr """"C:\Users\admin\AppData\Roaming\faxjrc\consev.exe""" """C:\Users\admin\AppData\Roaming\faxjrc\consev.dat"""" /du 9700:18 /st 00:02 /sc once /ri 1 /fC:\Windows\System32\cmd.exe—KMS_pico.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3116"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
3168timeout -t 5 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
Total events
4 275
Read events
4 243
Write events
23
Delete events
9

Modification events

(PID) Process:(556) Setup_File_KMS_Pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(556) Setup_File_KMS_Pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(556) Setup_File_KMS_Pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(556) Setup_File_KMS_Pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3480) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3480) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3480) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3480) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000056010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3480) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3480) KMS_pico.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
Executable files
23
Suspicious files
87
Text files
716
Unknown types
0

Dropped files

PID
Process
Filename
Type
556Setup_File_KMS_Pico.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\KMS_pico.exe —
MD5:—
SHA256:—
3480KMS_pico.exeC:\Users\admin\AppData\Roaming\faxjrc\consev.exeexecutable
MD5:C56B5F0201A3B3DE53E561FE76912BFD
SHA256:237D1BCA6E056DF5BB16A1216A434634109478F882D3B1D58344C801D184F95D
3480KMS_pico.exeC:\Users\admin\AppData\Local\Temp\3E2C.tmpbinary
MD5:17F95CAF560E05E9B51AA429081A31BC
SHA256:14D3A68B607FFA75CC9285BA0DB474EF3452DCFA1F9E96529C067B194A6F9AF1
3480KMS_pico.exeC:\Users\admin\AppData\Local\Temp\3E1B.tmpbinary
MD5:17F95CAF560E05E9B51AA429081A31BC
SHA256:14D3A68B607FFA75CC9285BA0DB474EF3452DCFA1F9E96529C067B194A6F9AF1
3480KMS_pico.exeC:\Users\admin\AppData\Roaming\faxjrc\consev.dattext
MD5:532B7CC788160997EA22DEEC6F7D69F8
SHA256:DFB8264953A5D0D7DB1EB289430285B488A147F44DDEBAEC70B6EC7D7219FAF0
3480KMS_pico.exeC:\Users\admin\AppData\Roaming\faxjrc\KMS_pico.exeexecutable
MD5:A02164371A50C5FF9FA2870EF6E8CFA3
SHA256:64C731ADBE1B96CB5765203B1E215093DCF268D020B299445884A4AE62ED2D3A
2516KMS_pico.exeC:\Users\admin\AppData\Local\Temp\is-1CUT5.tmp\KMS_pico.tmpexecutable
MD5:1778C1F66FF205875A6435A33229AB3C
SHA256:95C06ACAC4FE4598840E5556F9613D43AA1039C52DAC64536F59E45A70F79DA6
3480KMS_pico.exeC:\Users\admin\AppData\Local\Temp\3EAA.tmpbinary
MD5:8A7582AF1F2D6B0383C8A955A623AF86
SHA256:DEC597F44990462BF14BCAD05E9D9C20BC636446E62C1671EF4DEE9B151DEF24
3480KMS_pico.exeC:\Users\admin\AppData\Local\Temp\3ECB.tmpbinary
MD5:FBD34F0AB5E3F18371CF71395F40C3C5
SHA256:17C9F4CB0FA71685013A864174352D87B1FE35CC3F3B499DF92EEDA3ABB8F862
3480KMS_pico.exeC:\Users\admin\AppData\Local\Temp\3EBA.tmpbinary
MD5:C944D26D2618E307D10F2C8AD90613E4
SHA256:EE55F8E332F3AF11C9D30638B11EB9E7F214DC32BA4E15EBF2CDAE9CB86D05FF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
2
Threats
1

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3928
KMSELDI.exe
185.120.22.12:123
3.pool.ntp.org
—
—
unknown

DNS requests

Domain
IP
Reputation
sgizfn14.top
  • —
unknown
3.pool.ntp.org
  • 185.254.97.53
  • 54.38.156.22
  • 45.9.61.155
  • 185.120.22.12
whitelisted

Threats

PID
Process
Class
Message
1088
svchost.exe
Potentially Bad Traffic
ET DNS Query to a *.top domain - Likely Hostile
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Setup_File_KMS_Pico.exe