File name:

HEU_KMS_Activator_30.2.0.exe

Full analysis: https://app.any.run/tasks/14385951-4104-43fd-8813-3cbbce952b3a
Verdict: Malicious activity
Analysis date: November 23, 2023, 11:55:50
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
qrcode
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

F18506AFEB56FCDE4A4F0AE9ED3B1134

SHA1:

B909944EBFD258A9401802EDC743AD759801949F

SHA256:

84FF818A54F8D74AC9F108F4EB59548C30E1187A55F9C979235E12B11310C174

SSDEEP:

98304:j+S9bgsTaFGQ0+mra19Dr7AoVMRuT7mGfVmH68TeOq8+:CMc6YGQ021tr71VLnmKVma8KP8+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 7Z.EXE (PID: 3480)
      • HEU_KMS_Activator_30.2.0.exe (PID: 2900)
      • kms.exe (PID: 3404)

    • Accesses system services(Win32_Service) via WMI (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Creates a writable file in the system directory

      • kms.exe (PID: 3404)

  • SUSPICIOUS

    • Detected use of alternative data streams (AltDS)

      • kms.exe (PID: 3404)

    • Drops 7-zip archiver for unpacking

      • HEU_KMS_Activator_30.2.0.exe (PID: 2900)

    • Reads the Internet Settings

      • cscript.exe (PID: 3632)
      • cscript.exe (PID: 3924)

    • Starts CMD.EXE for commands execution

      • kms.exe (PID: 3404)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 3632)
      • cscript.exe (PID: 3924)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • cscript.exe (PID: 3632)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 3632)
      • cscript.exe (PID: 3924)
      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 3020)
      • cmd.exe (PID: 4044)
      • cmd.exe (PID: 3684)
      • cmd.exe (PID: 1528)
      • cmd.exe (PID: 556)
      • cmd.exe (PID: 712)
      • cmd.exe (PID: 2692)
      • cmd.exe (PID: 3000)
      • cmd.exe (PID: 564)
      • cmd.exe (PID: 2448)
      • cmd.exe (PID: 900)
      • cmd.exe (PID: 2836)

    • The process executes VB scripts

      • cmd.exe (PID: 1860)
      • cmd.exe (PID: 296)
      • cmd.exe (PID: 1904)
      • cmd.exe (PID: 1936)
      • cmd.exe (PID: 2640)
      • cmd.exe (PID: 2788)
      • cmd.exe (PID: 2412)
      • cmd.exe (PID: 1064)
      • cmd.exe (PID: 680)
      • cmd.exe (PID: 564)
      • cmd.exe (PID: 2436)
      • cmd.exe (PID: 2732)
      • cmd.exe (PID: 3484)
      • cmd.exe (PID: 3112)
      • cmd.exe (PID: 3656)
      • cmd.exe (PID: 4000)
      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 4068)

    • Gets the drive type (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Reads data from a file (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Gets full path of the running script (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3808)
      • cscript.exe (PID: 3592)

    • Gets a collection of all available drive names (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Accesses WMI object, sets custom ImpersonationLevel (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Checks whether a specific file exists (SCRIPT)

      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Changes charset (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Reads data from a binary Stream object (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Accesses computer name via WMI (SCRIPT)

      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 3808)

    • Accesses system date via WMI (SCRIPT)

      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 3032)
      • cmd.exe (PID: 1376)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • cmd.exe (PID: 1996)
      • cmd.exe (PID: 328)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 1008)

    • Executes as Windows Service

      • kms-server.exe (PID: 2868)

  • INFO

    • Checks supported languages

      • HEU_KMS_Activator_30.2.0.exe (PID: 2900)
      • 7Z.EXE (PID: 3480)
      • kms.exe (PID: 3404)
      • 7Z.EXE (PID: 316)
      • kms-server.exe (PID: 1036)
      • kms-server.exe (PID: 2096)
      • kms-server.exe (PID: 2868)

    • Checks Windows language

      • HEU_KMS_Activator_30.2.0.exe (PID: 2900)
      • kms.exe (PID: 3404)

    • Reads the machine GUID from the registry

      • HEU_KMS_Activator_30.2.0.exe (PID: 2900)
      • kms.exe (PID: 3404)

    • Reads the computer name

      • 7Z.EXE (PID: 3480)
      • kms.exe (PID: 3404)
      • 7Z.EXE (PID: 316)
      • kms-server.exe (PID: 1036)
      • kms-server.exe (PID: 2868)
      • kms-server.exe (PID: 2096)

    • Reads mouse settings

      • kms.exe (PID: 3404)
      • HEU_KMS_Activator_30.2.0.exe (PID: 2900)

    • Create files in a temporary directory

      • HEU_KMS_Activator_30.2.0.exe (PID: 2900)
      • kms.exe (PID: 3404)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 3632)
      • cscript.exe (PID: 3924)
      • cscript.exe (PID: 1236)
      • cscript.exe (PID: 1348)
      • cscript.exe (PID: 2268)
      • cscript.exe (PID: 1928)
      • cscript.exe (PID: 2740)
      • cscript.exe (PID: 536)
      • cscript.exe (PID: 1460)
      • cscript.exe (PID: 2240)
      • cscript.exe (PID: 2820)
      • cscript.exe (PID: 2492)
      • cscript.exe (PID: 3344)
      • cscript.exe (PID: 3156)
      • cscript.exe (PID: 3540)
      • cscript.exe (PID: 3572)
      • cscript.exe (PID: 3596)
      • cscript.exe (PID: 3592)
      • cscript.exe (PID: 4008)
      • cscript.exe (PID: 3808)

    • Reads product name

      • kms.exe (PID: 3404)

    • Reads Environment values

      • kms.exe (PID: 3404)

    • Reads Microsoft Office registry keys

      • kms.exe (PID: 3404)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (43.5)
.exe | Win32 EXE Yoda's Crypter (42.7)
.exe | Win32 Executable (generic) (7.2)
.exe | Generic Win/DOS Executable (3.2)
.exe | DOS Executable Generic (3.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:04:02 18:08:20+02:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.16
CodeSize: 385024
InitializedDataSize: 4358144
UninitializedDataSize: 4911104
EntryPoint: 0x50cd70
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 30.2.0.0
ProductVersionNumber: 30.2.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Unicode
FileVersion: 30.2.0.0
Comments: KMS/数字权利/KMS38/OEM激活
FileDescription: HEU KMS Activator™
ProductVersion: 30.2.0.0
LegalCopyright: 知彼而知己
Productname: HEU KMS Activator
CompanyName: 知彼而知己
OriginalFileName: HEU_KMS_Activator_v30.2.0
InternalName: HEU_KMS_Activator_v30.2.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
170
Monitored processes
87
Malicious processes
39
Suspicious processes
2

Behavior graph

Click at the process to see the details
start heu_kms_activator_30.2.0.exe 7z.exe no specs kms.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs 7z.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs regedit.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs cscript.exe no specs cmd.exe no specs regedit.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs kms-server.exe no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs netstat.exe no specs cmd.exe no specs netsh.exe no specs kms-server.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs kms-server.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs heu_kms_activator_30.2.0.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296C:\Windows\system32\cmd.exe /c set "Path=%SystemRoot%;%SystemRoot%\system32;%SystemRoot%\System32\Wbem;%SystemRoot\System32\WindowsPowerShell\v1.0\" & cscript "C:\Program Files\Microsoft Office\Office14\\ospp.vbs" /inslic:"C:\Windows\_temp_heu168yyds\Licenses\Office2010\OneNote\OneNote_KMS_Client_PL.xrm-ms"C:\Windows\System32\cmd.exe—kms.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
316C:\Windows\_temp_heu168yyds\7Z.EXE x "C:\Windows\_temp_heu168yyds\files.7z" -y -o"C:\Windows\_temp_heu168yyds" Licenses\Office2010C:\Windows\_temp_heu168yyds\7Z.EXE—kms.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Standalone Console
Exit code:
0
Version:
19.00
Modules
Images
c:\windows\_temp_heu168yyds\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
328C:\Windows\system32\cmd.exe /c set "Path=%SystemRoot%;%SystemRoot%\system32;%SystemRoot%\System32\Wbem;%SystemRoot\System32\WindowsPowerShell\v1.0\" & netsh advfirewall firewall delete rule name="heu-kms-mini"C:\Windows\System32\cmd.exe—kms.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
536cscript "C:\Program Files\Microsoft Office\Office14\\ospp.vbs" /inslic:"C:\Windows\_temp_heu168yyds\Licenses\Office2010\OneNote\OneNote_MAK_OOB.xrm-ms"C:\Windows\System32\cscript.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft ® Console Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\cscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
556C:\Windows\system32\cmd.exe /c sc query sppsvcC:\Windows\System32\cmd.exe—kms.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
564C:\Windows\system32\cmd.exe /c set "Path=%SystemRoot%;%SystemRoot%\system32;%SystemRoot%\System32\Wbem;%SystemRoot\System32\WindowsPowerShell\v1.0\" & cscript "C:\Program Files\Microsoft Office\Office14\\ospp.vbs" /inslic:"C:\Windows\_temp_heu168yyds\Licenses\Office2010\Word\Word_KMS_Client_OOB.xrm-ms"C:\Windows\System32\cmd.exe—kms.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
564C:\Windows\system32\cmd.exe /c sc query WinMgmtC:\Windows\System32\cmd.exe—kms.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
680C:\Windows\system32\cmd.exe /c set "Path=%SystemRoot%;%SystemRoot%\system32;%SystemRoot%\System32\Wbem;%SystemRoot\System32\WindowsPowerShell\v1.0\" & cscript "C:\Program Files\Microsoft Office\Office14\\ospp.vbs" /inslic:"C:\Windows\_temp_heu168yyds\Licenses\Office2010\OneNote\OneNote_MAK_PPDLIC.xrm-ms"C:\Windows\System32\cmd.exe—kms.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
712C:\Windows\system32\cmd.exe /c sc query osppsvcC:\Windows\System32\cmd.exe—kms.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
756sc query ClickToRunSvcC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
4 743
Read events
4 591
Write events
152
Delete events
0

Modification events

(PID) Process:(3632) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3632) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3632) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3632) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3924) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3924) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3924) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3924) cscript.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2260) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1696) netsh.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17A\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
Executable files
12
Suspicious files
6
Text files
294
Unknown types
0

Dropped files

PID
Process
Filename
Type
2900HEU_KMS_Activator_30.2.0.exeC:\Windows\_temp_heu168yyds\KMSmini.7zcompressed
MD5:A6DD14E413F468A0A858C65A6A91ACA0
SHA256:8C9F9E572F4B31D842D8E5852852590CB82B95E594E29E7714FF958752717231
2900HEU_KMS_Activator_30.2.0.exeC:\Windows\_temp_heu168yyds\7Z.EXEexecutable
MD5:43141E85E7C36E31B52B22AB94D5E574
SHA256:EA308C76A2F927B160A143D94072B0DCE232E04B751F0C6432A94E05164E716D
2900HEU_KMS_Activator_30.2.0.exeC:\Windows\_temp_heu168yyds\files.7zcompressed
MD5:C7926C9B1DFE047575916F8016F36555
SHA256:C02C302C2F9861B4120664AD32B74280A5F13DAE54735AD858691837AA496888
2900HEU_KMS_Activator_30.2.0.exeC:\Users\admin\AppData\Local\Temp\autE650.tmpcompressed
MD5:C7926C9B1DFE047575916F8016F36555
SHA256:C02C302C2F9861B4120664AD32B74280A5F13DAE54735AD858691837AA496888
2900HEU_KMS_Activator_30.2.0.exeC:\Users\admin\AppData\Local\Temp\ScriptTemp.initext
MD5:73B988A2A2092F8796C3A8A17A7B0283
SHA256:A35BB11E7DAD4493E1D72E1C8780D5A8939B164A6A62F963A5DA03C295102ED0
34807Z.EXEC:\Windows\_temp_heu168yyds\OtherOfficeOSPP\slerror.xmltext
MD5:36F7DADFE84E62DA00292D0569C3F523
SHA256:B3378A3178F3E52094DB20E8A828011CD8882017919522A544BAEF3057BD11D3
34807Z.EXEC:\Windows\_temp_heu168yyds\pic\12-2.bmpimage
MD5:8BB9FCBBAE84BE58619AC7E340B34F60
SHA256:80E1B7511127D4B36FC7F5A16FBBFFEDDBCA2BDFC44C010D02B4657C94F3D20D
34807Z.EXEC:\Windows\_temp_heu168yyds\Office2010OSPP\OSPP.VBStext
MD5:572E9A87757AC96C7677FD1B1B113C55
SHA256:008CF05944053116A095AD466561D3FD4BE8A7DE79E5ADA7C5DAAB492F730465
34807Z.EXEC:\Windows\_temp_heu168yyds\Office2010OSPP\SLERROR.XMLtext
MD5:DF1EF05879E06C5F09F3E1022F37B5CB
SHA256:D49ADF2DABBBF6AA43CE4E336AF4F768207DF75302EBF568A94A5350AAC988C5
34807Z.EXEC:\Windows\_temp_heu168yyds\pic\1-1.bmpimage
MD5:854FDB63B26F58D482A85F4A7D87EB75
SHA256:8D3B094B0984A03453F11D7D587226F4E29665E1B0E04B76F009A8E8268FE18C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
HEU_KMS_Activator_30.2.0.exe